flux: infra observability

deploy/flux/.env.d/.gitignore

@@ -0,0 +1,3 @@
+**
+!.sops.pub.asc
+!.gitignore

deploy/flux/infra-sync.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: infra
+  namespace: git-limbosolutions-com
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: git-limbosolutions-com
+  path: deploy/infra
+  prune: true

deploy/flux/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - git-repo.yaml
+ - infra-sync.yaml
 secretGenerator:
   - name: flux-repo-ssh-credentials
     files:

deploy/infra/cd-serviceaccount.yaml

@@ -1,53 +0,0 @@
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: continuous-deploy
-  namespace: git-limbosolutions-com
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: continuous-deploy
-  annotations:
-    kubernetes.io/service-account.name: continuous-deploy
-type: kubernetes.io/service-account-token
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: git-limbosolutions-com
-  name: continuous-deploy
-rules:
-- apiGroups: [""]
-  resources: ["pods", "services", "secrets", "configmaps", "persistentvolumeclaims"]
-  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
-
-- apiGroups: ["apps"]
-  resources: ["deployments", "statefulsets"]
-  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
-
-- apiGroups: ["batch"]
-  resources: ["cronjobs", "jobs"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: continuous-deploy
-  namespace:  git-limbosolutions-com
-subjects:
-- kind: ServiceAccount
-  name: continuous-deploy
-  namespace: git-limbosolutions-com
-roleRef:
-  kind: Role
-  name: continuous-deploy
-  apiGroup: rbac.authorization.k8s.io
-

deploy/infra/kustomization.yaml

@@ -1,15 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
-  - cd-serviceaccount.yaml
   - network-policies.yaml
   - certificate.yaml
   - ingress-web.yaml
   - ingress-web-public.yaml
   - ingress-ssh.yaml
   - ingress-ssh-public.yaml
-generatorOptions:
-  disableNameSuffixHash: true
-