jakman85andClaude Opus 4.8
e6b4062310
Run a single Gitea container on the host (bootstrap/gitea/), outside the cluster, while the cluster is built; Flux pulls this repo from it over the k3s-dev NAT gateway (http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git, public repo => no creds, NAT-only). Wired the flux-system GitRepository url in clusters/dev. Migrates to in-cluster Gitea in Phase 6. Pins confirmed. Author-only; gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
---
|
|
# clusters/dev — the ACTIVE build target overlay.
|
|
#
|
|
# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here.
|
|
# This overlay adds NO resources of its own. Its ONLY job is to patch the shared cluster-vars
|
|
# ConfigMap with dev-scoped values (R-ENV-02). The base reconciliation graph is reused verbatim.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- ../base
|
|
patches:
|
|
# --- SOPS decryption + bootstrap source (PM-inlined from bootstrap/flux/patches/, 2026-08-16) ---
|
|
# Inlined (not cross-dir file refs) to stay within kustomize's default load restrictions.
|
|
# Realises the commented decryption TODOs in clusters/base and sets the real source URL.
|
|
# The `sops-age` Secret is created out-of-band (bootstrap/sops/install-age-key.sh) — name only.
|
|
- patch: |-
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: platform
|
|
namespace: flux-system
|
|
spec:
|
|
decryption:
|
|
provider: sops
|
|
secretRef:
|
|
name: sops-age
|
|
- patch: |-
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: apps
|
|
namespace: flux-system
|
|
spec:
|
|
decryption:
|
|
provider: sops
|
|
secretRef:
|
|
name: sops-age
|
|
- patch: |-
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: GitRepository
|
|
metadata:
|
|
name: flux-system
|
|
namespace: flux-system
|
|
spec:
|
|
# Phase-1 bootstrap source: a single Gitea container on the HOST (bootstrap/gitea/),
|
|
# reachable from the cluster on the k3s-dev NAT gateway. PUBLIC repo => Flux needs no
|
|
# creds (NAT-only). Phase 6 cutover -> in-cluster gitea.home.keithjackson.dev (docs/05).
|
|
url: http://10.73.0.1:3000/Home-Network/home-network-k3s-impl.git
|
|
ref:
|
|
branch: main
|
|
# --- dev-scoped cluster-vars (R-ENV-02) ---
|
|
- target:
|
|
kind: ConfigMap
|
|
name: cluster-vars
|
|
patch: |-
|
|
- op: replace
|
|
path: /data/cluster_env
|
|
value: "dev"
|
|
# DNS-01 against LE staging while iterating (avoids prod rate limits) — ADR-0006.
|
|
- op: replace
|
|
path: /data/acme_cluster_issuer
|
|
value: "letsencrypt-staging"
|
|
# dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
|
|
- op: replace
|
|
path: /data/longhorn_default_replica_count
|
|
value: "3"
|
|
# smaller retention / volumes to keep the dev workstation footprint light.
|
|
- op: replace
|
|
path: /data/monitoring_prometheus_retention
|
|
value: "3d"
|
|
- op: replace
|
|
path: /data/monitoring_prometheus_pvc_size
|
|
value: "5Gi"
|
|
- op: replace
|
|
path: /data/monitoring_loki_pvc_size
|
|
value: "5Gi"
|
|
# single-replica control-plane addons in dev (no HA needed to iterate).
|
|
- op: replace
|
|
path: /data/keycloak_replicas
|
|
value: "1"
|
|
- op: replace
|
|
path: /data/oauth2_proxy_replicas
|
|
value: "1"
|
|
- op: replace
|
|
path: /data/velero_retention
|
|
value: "72h"
|