flux: infra observability

.gitignore

@@ -1,5 +1,5 @@
 tmp
 **.env
-**.private.**
+**.dec.**
 **.local.**
 .kube/**

README.md

@@ -8,7 +8,6 @@ Using [gitea](https://git.limbosolutions.com/kb/gitea) as git server.
 - [Deploy](#deploy)
   - [Continuous Deploy](#continuous-deploy)
   - [App](#app)
-  - [Infra](#infra)
 - [Backups](#backups)
 
 ## SSO
@@ -22,7 +21,7 @@ References:
 - <https://gitea.com/gitea/helm-gitea>
 - <https://dl.gitea.com/charts/>
 
-Migration to flux
+Migration to flux.
 
 For fluxcd setup execute.
 
@@ -67,14 +66,6 @@ Deploy App
 
 - [backups-kustomization](/deploy/app/kustomization.yaml)
 
-### Infra
-
-```bash
-./ops-scripts/apply-infra.sh
-```
-
-- [kustomization](/deploy/infra/kustomization.yaml)
-
 
   
 ## Backups

deploy/flux/.env.d/.gitignore

@@ -0,0 +1,3 @@
+**
+!.sops.pub.asc
+!.gitignore

deploy/flux/infra-sync.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: infra
+  namespace: git-limbosolutions-com
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: git-limbosolutions-com
+  path: deploy/infra
+  prune: true

deploy/flux/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - git-repo.yaml
+ - infra-sync.yaml
 secretGenerator:
   - name: flux-repo-ssh-credentials
     files:

deploy/infra/cd-serviceaccount.yaml

@@ -1,53 +0,0 @@
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: continuous-deploy
-  namespace: git-limbosolutions-com
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: continuous-deploy
-  annotations:
-    kubernetes.io/service-account.name: continuous-deploy
-type: kubernetes.io/service-account-token
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  namespace: git-limbosolutions-com
-  name: continuous-deploy
-rules:
-- apiGroups: [""]
-  resources: ["pods", "services", "secrets", "configmaps", "persistentvolumeclaims"]
-  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
-
-- apiGroups: ["apps"]
-  resources: ["deployments", "statefulsets"]
-  verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
-
-- apiGroups: ["batch"]
-  resources: ["cronjobs", "jobs"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: continuous-deploy
-  namespace:  git-limbosolutions-com
-subjects:
-- kind: ServiceAccount
-  name: continuous-deploy
-  namespace: git-limbosolutions-com
-roleRef:
-  kind: Role
-  name: continuous-deploy
-  apiGroup: rbac.authorization.k8s.io
-

deploy/infra/kustomization.yaml

@@ -1,15 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
-  - cd-serviceaccount.yaml
   - network-policies.yaml
   - certificate.yaml
   - ingress-web.yaml
   - ingress-web-public.yaml
   - ingress-ssh.yaml
   - ingress-ssh-public.yaml
-generatorOptions:
-  disableNameSuffixHash: true
-
 

ops-scripts/apply-infra.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-set -e
-echo "Executing infra deploy."
-
-kubectl kustomize deploy/infra | kubectl -n git-limbosolutions-com apply -f -
-
-