jakman85andClaude Opus 4.8
d9a80e5350
Prep only — nothing deployed; running cluster untouched. Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/ = 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring, monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base platform/apps and adds ./rollout, so only the no-secret tier reconciles; the secret-blocked components are simply not created until hand-offs arrive. The no-secret tier carries no SOPS content, so it needs no sops-age key. prod is untouched (still builds the monolith). Convergence path coded in (delete rollout/ + the two deletes) — R-ENV-02 divergence flagged for architect review. Component hardening via cluster-vars (prod keeps strict posture): - KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector excludes system+platform namespaces. - MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default); Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers. Cilium parity verified against the live CNI (no-op adopt). Validated: kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
101 lines
4.0 KiB
YAML
101 lines
4.0 KiB
YAML
---
|
|
# clusters/dev — the ACTIVE build target overlay.
|
|
#
|
|
# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here.
|
|
# TRANSITIONAL (Phase-2 bootstrap): this overlay reuses the base source + cluster-vars, but
|
|
# REPLACES the monolithic base `platform`/`apps` Kustomizations with a per-component NO-SECRET
|
|
# rollout (./rollout) — so dev brings up cilium/longhorn/monitoring/kyverno in order WITHOUT
|
|
# dragging in the secret-blocked components. It patches cluster-vars with dev values (R-ENV-02)
|
|
# and softens Kyverno for bootstrap. CONVERGENCE: delete ./rollout + the two $patch:delete
|
|
# below to return to the unified base graph once all operator hand-offs land. See DECISIONS-LOG.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- ../base
|
|
- rollout
|
|
patches:
|
|
# --- Drop the monolithic base platform/apps Kustomizations. They reconcile ALL 11 components
|
|
# as one unit (incl. secret-blocked cert-manager/externaldns/velero/keycloak/oauth2-proxy/
|
|
# image-automation/gateway/kubevirt); ./rollout replaces them with the per-component
|
|
# no-secret set for dev bootstrap. Remove these two deletes to re-adopt the unified graph.
|
|
# (No decryption patch is needed here: the rollout components carry no SOPS content, so
|
|
# the `sops-age` Secret is not required for the dev bootstrap tier.) ---
|
|
- patch: |-
|
|
$patch: delete
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: platform
|
|
namespace: flux-system
|
|
- patch: |-
|
|
$patch: delete
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: apps
|
|
namespace: flux-system
|
|
- patch: |-
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: GitRepository
|
|
metadata:
|
|
name: flux-system
|
|
namespace: flux-system
|
|
spec:
|
|
# Phase-1 bootstrap source: a single Gitea container on the HOST (bootstrap/gitea/),
|
|
# reachable from the cluster on the k3s-dev NAT gateway. PUBLIC repo => Flux needs no
|
|
# creds (NAT-only). Phase 6 cutover -> in-cluster gitea.home.keithjackson.dev (docs/05).
|
|
url: http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git
|
|
ref:
|
|
branch: main
|
|
# --- dev-scoped cluster-vars (R-ENV-02) ---
|
|
- target:
|
|
kind: ConfigMap
|
|
name: cluster-vars
|
|
patch: |-
|
|
- op: replace
|
|
path: /data/CLUSTER_ENV
|
|
value: "dev"
|
|
# DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
|
|
- op: replace
|
|
path: /data/ACME_CLUSTER_ISSUER
|
|
value: "letsencrypt-staging"
|
|
# dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
|
|
- op: replace
|
|
path: /data/LONGHORN_DEFAULT_REPLICA_COUNT
|
|
value: "3"
|
|
# smaller retention / volumes to keep the dev workstation footprint light.
|
|
- op: replace
|
|
path: /data/MONITORING_PROMETHEUS_RETENTION
|
|
value: "3d"
|
|
- op: replace
|
|
path: /data/MONITORING_PROMETHEUS_PVC_SIZE
|
|
value: "5Gi"
|
|
- op: replace
|
|
path: /data/MONITORING_LOKI_PVC_SIZE
|
|
value: "5Gi"
|
|
# single-replica control-plane addons in dev (no HA needed to iterate).
|
|
- op: replace
|
|
path: /data/KEYCLOAK_REPLICAS
|
|
value: "1"
|
|
- op: replace
|
|
path: /data/OAUTH2_PROXY_REPLICAS
|
|
value: "1"
|
|
- op: replace
|
|
path: /data/VELERO_RETENTION
|
|
value: "72h"
|
|
# dev-softened Kyverno for cold-start (base defaults Enforce/Fail/3 = prod posture).
|
|
- op: replace
|
|
path: /data/KYVERNO_VALIDATION_ACTION
|
|
value: "Audit"
|
|
- op: replace
|
|
path: /data/KYVERNO_WEBHOOK_FAILURE_POLICY
|
|
value: "Ignore"
|
|
- op: replace
|
|
path: /data/KYVERNO_ADMISSION_REPLICAS
|
|
value: "1"
|
|
# dev: no Grafana admin Secret yet → empty makes the chart use its default admin password
|
|
# (dev-only, NAT-isolated). Prod keeps the by-name SOPS secret from the base default.
|
|
- op: replace
|
|
path: /data/GRAFANA_ADMIN_SECRET
|
|
value: ""
|