jakman85andClaude Opus 4.8
a108d5ab98
Operator directive: don't diverge architecture to avoid asking for credentials; provision them upfront via SOPS and keep the existing (unified) graph. Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2; monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance. Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's; restore unified base graph (dev = ../base + cluster-vars + SOPS decryption, R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes. platform/kustomization.yaml now phased (single shared list): Phase-2 set = kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components commented with phase markers. SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia); bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real secret values (operator encrypts). Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
27 lines
1.9 KiB
YAML
27 lines
1.9 KiB
YAML
---
|
|
# Top-level platform kustomization — the entrypoint the Flux `platform` Kustomization renders
|
|
# (clusters/base/platform.yaml, path: ./platform).
|
|
#
|
|
# UNIFIED GRAPH (R-ENV-02): dev and prod both render THIS single list; overlays differ only by
|
|
# cluster-vars. Components are enabled here PER PHASE as their phase opens (roadmap/phases.md) —
|
|
# the same pattern by which kyverno was previously deferred. Credentials each component needs are
|
|
# provisioned upfront as SOPS-encrypted Secrets (bootstrap/sops/, .sops.yaml), so enabling a
|
|
# component is never gated on a credential ask — only on its phase and readiness.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
# ---- Phase 2 — Platform Core: Network, Storage, TLS, DNS, Ingress ----
|
|
- kyverno # admission enforcer FIRST — policies present before other components reconcile
|
|
- cilium # CNI (adopts the running Ansible-installed release; parity verified)
|
|
- longhorn # replicated block storage / CSI
|
|
- cert-manager # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
|
|
- externaldns # auto DNS records — needs SOPS `cloudflare-api-token`
|
|
- gateway # Gateway API listeners (ingress; replaces Traefik)
|
|
# ---- Later phases: enabled when their phase opens (creds already provisioned via SOPS) ----
|
|
# - monitoring # Phase 4 (Observability): kube-prometheus-stack + Loki + Alloy + Alertmanager
|
|
# - velero # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
|
|
# - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate
|
|
# - kubevirt # Phase 5 (IaaS proof): KubeVirt + CDI
|
|
# - keycloak # Phase 6 (Catalog + C2 UI): foundational IdP — needs SOPS `keycloak-admin-credentials`
|
|
# - oauth2-proxy # Phase 6: forward-auth — needs SOPS `oauth2-proxy-credentials`
|