Skip to content

Commit dd5c4dc

Browse files
xunholyxunholy
committed
feat: major 2.7.0 fluxcd updates
Signed-off-by: Michael Fornaro <[email protected]>
1 parent e7e588d commit dd5c4dc

File tree

8 files changed

+128
-14
lines changed

8 files changed

+128
-14
lines changed

‎.renovate/customManagers.json5‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
managerFilePatterns: [
88
"/(^|/).+\\.env$/",
99
"/(^|/).+\\.sh$/",
10-
"/(^|/).+\\.ya?ml(?:\\.j2)?$/"
10+
"/(^|/).+\\.ya?ml(?:\\.j2)?$/",
1111
],
1212
matchStrings: [
1313
// # renovate: datasource=github-releases depName=k3s-io/k3s
@@ -23,5 +23,12 @@
2323
],
2424
datasourceTemplate: "{{#if datasource}}{{{datasource}}}{{else}}github-releases{{/if}}",
2525
},
26+
{
27+
customType: "regex",
28+
description: "Process OCI dependencies",
29+
managerFilePatterns: ["/\\.yaml(?:\\.j2)?$/"],
30+
matchStrings: ["oci://(?<depName>[^:]+):(?<currentValue>\\S+)"],
31+
datasourceTemplate: "docker",
32+
},
2633
],
2734
}

‎.renovate/groups.json5‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,34 @@
55
description: "Actions Runner Controller Group",
66
groupName: "Actions Runner Controller",
77
matchDatasources: ["docker"],
8-
matchPackageNames: ["/gha-runner-scale-set-controller/", "/gha-runner-scale-set/"],
8+
matchPackageNames: [
9+
"/gha-runner-scale-set-controller/",
10+
"/gha-runner-scale-set/",
11+
],
912
group: {
1013
commitMessageTopic: "{{{groupName}}} group",
1114
},
15+
minimumGroupSize: 2,
1216
},
1317
{
1418
description: ["Talos Group"],
1519
groupName: "Talos",
1620
matchPackagePatterns: ["siderolabs/talosctl", "siderolabs/installer"],
1721
matchDatasources: ["docker"],
1822
group: {
19-
commitMessageTopic: "{{{groupName}}} group"
23+
commitMessageTopic: "{{{groupName}}} group",
2024
},
25+
minimumGroupSize: 2,
2126
},
2227
{
2328
description: "Istio Group",
2429
groupName: "istio",
2530
matchDatasources: ["helm"],
2631
matchPackagePatterns: ["gateway", "istio-base", "istio-cni", "istiod"],
2732
group: {
28-
commitMessageTopic: "{{{groupName}}} group"
33+
commitMessageTopic: "{{{groupName}}} group",
2934
},
35+
minimumGroupSize: 4,
3036
},
3137
{
3238
description: "Cilium Group",
@@ -41,10 +47,15 @@
4147
description: "Flux Operator Group",
4248
groupName: "Flux Operator",
4349
matchDatasources: ["docker"],
44-
matchPackageNames: ["/flux-operator/", "/flux-instance/"],
50+
matchPackageNames: [
51+
"/flux-operator/",
52+
"/flux-instance/",
53+
"/flux-operator-manifests/",
54+
],
4555
group: {
4656
commitMessageTopic: "{{{groupName}}} group",
4757
},
58+
minimumGroupSize: 3,
4859
},
4960
{
5061
description: "Cert-Manager Group",
@@ -63,6 +74,7 @@
6374
group: {
6475
commitMessageTopic: "{{{groupName}}} group",
6576
},
77+
minimumGroupSize: 2,
6678
},
67-
]
79+
],
6880
}

‎.sops.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ creation_rules:
2626
- path_regex: terraform/.*/*.enc.ya?ml
2727
pgp: 0635B8D34037A9453003FB7B93CAA682FF4C9014
2828
mac_only_encrypted: true
29+
# AGE encrypted Kubernetes secret files
30+
- path_regex: kubernetes/.*/*.enc.age.ya?ml
31+
encrypted_regex: ^(data|stringData)$
32+
mac_only_encrypted: true
33+
age: age19gj66fq5v2veu940ftyj4pkw0w5tgxgddlyqnd00pnjzyndevurqx70g4t
2934

3035
stores:
3136
yaml:

‎.taskfiles/bootstrap/Taskfile.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,13 @@ tasks:
6262
cmds:
6363
- kubectl create namespace flux-system --dry-run=client -oyaml | kubectl apply -f -
6464
- sops --decrypt "{{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/sops-gpg.encrypted.yaml" | kubectl apply -f -
65+
- sops --decrypt "{{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/sops-age.encrypted.yaml" | kubectl apply -f -
6566
- sops --decrypt "{{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/cluster-secrets.enc.yaml" | kubectl apply -f -
6667
- sops --decrypt "{{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/github-auth.enc.yaml" | kubectl apply -f -
6768
- kubectl apply -f {{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/cluster-config.yaml
6869
preconditions:
6970
- test -f {{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/sops-gpg.encrypted.yaml
71+
- test -f {{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/sops-age.encrypted.yaml
7072
- test -f {{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/github-auth.enc.yaml
7173
- test -f {{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/cluster-secrets.enc.yaml
7274
- test -f {{.ROOT_DIR}}/kubernetes/clusters/{{.CLUSTER_ID}}/secrets/cluster-config.yaml

‎kubernetes/clusters/cluster-0/flux-system/flux-instance/app/values.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ instance:
99
- kustomize-controller
1010
- helm-controller
1111
- notification-controller
12+
- source-watcher
1213
commonAnnotations:
1314
fluxcd.controlplane.io/reconcile: "enabled"
1415
fluxcd.controlplane.io/reconcileEvery: "1h"
@@ -27,6 +28,7 @@ instance:
2728
path: ./clusters/cluster-0
2829
kustomize:
2930
patches:
31+
# OPTIONAL: Allow cluster-autoscaler to evict flux controllers if needed
3032
- patch: |
3133
apiVersion: apps/v1
3234
kind: Deployment
@@ -46,6 +48,7 @@ instance:
4648
memory: 2Gi
4749
target:
4850
kind: Deployment
51+
# REQUIRED: Increase concurrency and requeue time for helm-controller
4952
- patch: |
5053
- op: add
5154
path: /spec/template/spec/containers/0/args/-
@@ -59,6 +62,7 @@ instance:
5962
target:
6063
kind: Deployment
6164
name: helm-controller
65+
# REQUIRED: Increase concurrency and requeue time for kustomize-controller
6266
- patch: |
6367
- op: replace
6468
path: /spec/template/spec/volumes/0
@@ -78,6 +82,7 @@ instance:
7882
target:
7983
kind: Deployment
8084
name: kustomize-controller
85+
# REQUIRED: Increase concurrency and requeue time for source-controller
8186
- patch: |
8287
- op: add
8388
path: /spec/template/spec/containers/0/args/-
@@ -88,6 +93,7 @@ instance:
8893
target:
8994
kind: Deployment
9095
name: source-controller
96+
# REQUIRED: KustomizeController SOPS decryption for all Kustomizations
9197
- patch: |
9298
apiVersion: kustomize.toolkit.fluxcd.io/v1
9399
kind: Kustomization
@@ -109,8 +115,33 @@ instance:
109115
target:
110116
kind: Kustomization
111117
name: flux-system
118+
# OPTIONAL: Remove CPU limits from all controllers to avoid OOMKills
112119
- patch: |
113120
- op: remove
114121
path: /spec/template/spec/containers/0/resources/limits/cpu
115122
target:
116123
kind: Deployment
124+
# REQUIRED: Controller-level SOPS decryption
125+
- patch: |
126+
- op: add
127+
path: /spec/template/spec/containers/0/args/-
128+
value: --sops-age-secret=sops-age-secret
129+
target:
130+
kind: Deployment
131+
name: kustomize-controller
132+
- # REQUIRED: Watch configmaps and secrets attached to HelmReleases and Kustomizations
133+
- patch: |
134+
- op: add
135+
path: /spec/template/spec/containers/0/args/-
136+
value: --watch-configs-label-selector=owner!=helm
137+
target:
138+
kind: Deployment
139+
name: (helm-controller|kustomize-controller)
140+
# REQUIRED: Cancel health checks on new Kustomizations revisions
141+
- patch: |
142+
- op: add
143+
path: /spec/template/spec/containers/0/args/-
144+
value: --feature-gates=CancelHealthCheckOnNewRevision=true
145+
target:
146+
kind: Deployment
147+
name: kustomize-controller

‎kubernetes/clusters/cluster-0/ks.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,45 @@ spec:
4040
name: sops-gpg
4141
target:
4242
labelSelector: substitution.flux/enabled=true
43+
# Add HelmRelease defaults to all Kustomizations
44+
- patch: |-
45+
apiVersion: kustomize.toolkit.fluxcd.io/v1
46+
kind: Kustomization
47+
metadata:
48+
name: not-used
49+
spec:
50+
patches:
51+
- patch: |-
52+
apiVersion: helm.toolkit.fluxcd.io/v2
53+
kind: HelmRelease
54+
metadata:
55+
name: not-used
56+
spec:
57+
driftDetection:
58+
mode: enabled
59+
install:
60+
crds: CreateReplace
61+
createNamespace: true
62+
replace: true
63+
strategy:
64+
name: RetryOnFailure
65+
timeout: 10m
66+
rollback:
67+
recreate: true
68+
force: true
69+
cleanupOnFail: true
70+
test:
71+
enable: true
72+
upgrade:
73+
cleanupOnFail: true
74+
crds: CreateReplace
75+
remediation:
76+
remediateLastFailure: true
77+
retries: 3
78+
strategy: rollback
79+
target:
80+
group: helm.toolkit.fluxcd.io
81+
kind: HelmRelease
82+
target:
83+
group: kustomize.toolkit.fluxcd.io
84+
kind: Kustomization

‎kubernetes/clusters/cluster-0/secrets/sops-age.encrypted.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
data:
3+
age.agekey: ENC[AES256_GCM,data:T0SIW1jH/L+sBx9x4iBFLtxSuiw5h47LfgHa+qNwXzw85n4RCq0qztEN/HGon7RhDFwkkcJuNTeGim3z4SYeoh3wmdoqwmWLVSyVHaiKvvOOM1cjKXK4wcY7ixy9Qd0bIAZR2fYdGKY+baIBfWiEgajv8a2SpmE6vHfCTVf0N5vl4DXoXKdAQnWrPvqkaur+NhAkLGLpWKMny3BLPnJWlcdRD6YGcfQxyX9JtgpMIvDFuLMVdBL4KM9nWiyjP05ofFIvSa6abzmyP+TIelVUc/eC9T+zBc2loTrnS2de8609H0xSADqKcQFF3KHY3C85Mn3JI3lw8V1RNuF3,iv:Nz7dlXcJi8kR4AfVQAsNvtjB2Gsd7er+e0HvUzxvueI=,tag:dNDKN06P3B89u1f6KGYCyQ==,type:str]
4+
kind: Secret
5+
metadata:
6+
name: sops-age-secret
7+
namespace: flux-system
8+
annotations:
9+
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
10+
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
11+
type: Opaque
12+
sops:
13+
gcp_kms:
14+
- resource_id: projects/raspbernetes/locations/global/keyRings/sops/cryptoKeys/sops-key
15+
created_at: "2021-04-14T09:56:06Z"
16+
enc: CiQAesqCOZISRRQTtLQ+hwyFXhAxPjfddIigwq/psm2fijO9cY0SSQA2cmGUMUZt4TJGNgqSOPLWe7w0nfFekhINR3Q45P6KEsWlr22cZZf0KygEOufqGOnmuFZyCqlSJmmbAgiqGgx5sUgu9rIwUWw=
17+
lastmodified: "2025-09-30T22:16:28Z"
18+
mac: ENC[AES256_GCM,data:CFLqmVBffFJ0VcQQj42cVmEScTXVX078oDviNl9CSUbLLuadVZ0jXOot3iVYO3qQwUoSfh7N4S1/EIipgOcwsnADMSbMp59DlCXofkye+n1JDebOUUOd49lrI4a7krNZgk7YTVOXHZXN9IszoQZrYilqIgdmTwogRGWjd6wMdr0=,iv:sySsvWKhbZua1wkhXoy7fIqSloUOayEWmNfsJuFnmZI=,tag:W06zQglZY0ulxy1dyVtVJw==,type:str]
19+
encrypted_regex: ^(data|stringData)$
20+
version: 3.10.2

‎kubernetes/clusters/cluster-0/secrets/sops-gpg.encrypted.yaml‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,11 @@ metadata:
1010
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
1111
type: Opaque
1212
sops:
13-
kms: []
1413
gcp_kms:
1514
- resource_id: projects/raspbernetes/locations/global/keyRings/sops/cryptoKeys/sops-key
1615
created_at: "2021-04-14T09:56:06Z"
1716
enc: CiQAesqCOZISRRQTtLQ+hwyFXhAxPjfddIigwq/psm2fijO9cY0SSQA2cmGUMUZt4TJGNgqSOPLWe7w0nfFekhINR3Q45P6KEsWlr22cZZf0KygEOufqGOnmuFZyCqlSJmmbAgiqGgx5sUgu9rIwUWw=
18-
azure_kv: []
19-
hc_vault: []
20-
age: []
21-
lastmodified: "2025-02-27T03:51:14Z"
22-
mac: ENC[AES256_GCM,data:pHoTerdt43LoZ2kmUn3J0Itk/QzM8aBWPGrlGMwbwxE0hq57TK7ZAA1Qg10oK7m3ngKnG5RbVbjBQaja7MiUZ1qPhsy/ce3ls/RwLYAj2OBwSC2kMz3Q1byupwJia5/Zl4DdG6tdHi4Lh2zfrPR5d0Kqn1959t+Hr7yFxaIAY2o=,iv:zu2QBC5FJ/S1fxFiQpmbY+hKs0MmvMibBrzRbmgJmoA=,tag:uQfTfQJYzxMunL35lR3Jxw==,type:str]
23-
pgp: []
17+
lastmodified: "2025-09-30T22:07:37Z"
18+
mac: ENC[AES256_GCM,data:4xtynWTJ0lz22v/+cHwl5P+KydEExa3exgAPjhNhI4qn1RSoGHr8XiUCrBdfcruxtoITb9d5DubUoCNSj0rSpFO3gVZ8BMOF7pckCI1bgwCsi3+MhYTyieAW5x6Qiw0k+DqcMLbYsyqhWFa+rmCHgc5rlTB3apJJS6i0TKxm7Kw=,iv:o5o5BY/dTrdmbTn4/s9taZSvo3KKo55GOGzIQm63438=,tag:Fs4cadWAyC9jJB9S9E3E0A==,type:str]
2419
encrypted_regex: ^(data|stringData)$
25-
version: 3.9.1
20+
version: 3.10.2

0 commit comments

Comments
 (0)