Update dependency fluxcd/flux2 to v2.5.1

Reviewed-on: https://git.front.kjuulh.io/clank/kubernetes-state/pulls/1

.drone.yml

@@ -0,0 +1,9 @@
+
+kind: pipeline
+type: docker
+name: "test"
+steps:
+  - name: test
+    image: harbor.front.kjuulh.io/docker-proxy/library/bash:latest
+    commands:
+      - echo 'Run tests'

apps/base/nginx/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nginx
+resources:
+  - namespace.yaml
+  - release.yaml

apps/base/nginx/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nginx

apps/base/nginx/release.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: nginx
+  namespace: nginx
+spec:
+  releaseName: nginx
+  chart:
+    spec:
+      chart: nginx
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 5m
+  install:
+    remediation:
+      retries: 3
+  values:
+    service:
+      type: ClusterIP

apps/production/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base/nginx

clank/apps/prod/wishlist/app.yaml

@@ -1,65 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: wishlist
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wishlist-ingress
-  namespace: wishlist
-  annotations:
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.tls.certresolver: le
-spec:
-  tls:
-    - hosts:
-        - wishlist.kjuulh.app
-  rules:
-    - host: wishlist.kjuulh.app
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wishlist-service
-                port:
-                  number: 80
-                    
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wishlist-deployment
-  namespace: wishlist
-  labels:
-    app: wishlist
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: wishlist
-  template:
-    metadata:
-      labels:
-        app: wishlist
-    spec:
-      containers:
-      - name: wishlist
-        image: kasperhermansen/wishlist-2022
-        ports:
-        - containerPort: 80
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wishlist-service
-  namespace: wishlist
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    run: wishlist

clank/apps/test/podinfo-source.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: podinfo
-  namespace: flux-system
-spec:
-  interval: 30s
-  ref:
-    branch: master
-  url: https://github.com/stefanprodan/podinfo
-

clank/clusters/platform/cert-manager/cert-manager.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: cert-manager
-  namespace: platform
-spec:
-  interval: 30m0s
-  retryInterval: 30s
-  path: ./clank/platform/cert-manager
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: cert-manager
-  targetNamespace: default

clank/clusters/platform/sealed-secrets/sealed-secrets.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: sealed-secrets
-  namespace: platform
-spec:
-  interval: 30m0s
-  retryInterval: 30s
-  path: ./clank/platform/sealed-secrets
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: sealed-secrets
-    namespace: flux-system

clank/clusters/platform/traefik/traefik.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: traefik
-  namespace: platform
-spec:
-  interval: 30m0s
-  retryInterval: 30s
-  path: ./clank/platform/traefik
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: traefik
-    namespace: flux-system

clank/clusters/prod/wishlist/app.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: wishlist 
-  namespace: prod
-spec:
-  interval: 10m0s
-  retryInterval: 30s
-  path: ./clank/apps/prod/wishlist
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: apps
-  targetNamespace: default

clank/platform/cert-manager/certificate.yaml

@@ -1,21 +0,0 @@
-#apiVersion: cert-manager.io/v1
-#kind: ClusterIssuer
-#metadata:
-#  name: letsencrypt-issuer
-#spec:
-#  acme:
-#    # You must replace this email address with your own.
-#    # Let's Encrypt will use this to contact you about expiring
-#    # certificates, and issues related to your account.
-#    email: contact@kjuulh.io
-#    server: https://acme-staging-v02.api.letsencrypt.org/directory
-#    privateKeySecretRef:
-#      # Secret resource that will be used to store the account's private key.
-#      name: letsencrypt-issuer-secret
-#    # Add a single challenge solver, HTTP01 using nginx
-#    solvers:
-#    - dns01:
-#      cloudflare:
-#        apiTokenSecretRef:
-#          name: cloudflare-api-token-secret
-#          key: api-token

clank/platform/sealed-secrets/controller.yaml

@@ -1,252 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-service-proxier
-  name: sealed-secrets-service-proxier
-  namespace: kube-system
-rules:
-- apiGroups:
-  - ""
-  resourceNames:
-  - sealed-secrets-controller
-  resources:
-  - services
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resourceNames:
-  - 'http:sealed-secrets-controller:'
-  - sealed-secrets-controller
-  resources:
-  - services/proxy
-  verbs:
-  - create
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-key-admin
-  name: sealed-secrets-key-admin
-  namespace: kube-system
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: secrets-unsealer
-subjects:
-- kind: ServiceAccount
-  name: sealed-secrets-controller
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations: {}
-  labels:
-    name: secrets-unsealer
-  name: secrets-unsealer
-rules:
-- apiGroups:
-  - bitnami.com
-  resources:
-  - sealedsecrets
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - bitnami.com
-  resources:
-  - sealedsecrets/status
-  verbs:
-  - update
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - get
-  - list
-  - create
-  - update
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
-spec:
-  minReadySeconds: 30
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      name: sealed-secrets-controller
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      annotations: {}
-      labels:
-        name: sealed-secrets-controller
-    spec:
-      containers:
-      - args: []
-        command:
-        - controller
-        env: []
-        image: docker.io/bitnami/sealed-secrets-controller:v0.17.5
-        imagePullPolicy: Always
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: http
-        name: sealed-secrets-controller
-        ports:
-        - containerPort: 8080
-          name: http
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: http
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1001
-        stdin: false
-        tty: false
-        volumeMounts:
-        - mountPath: /tmp
-          name: tmp
-      imagePullSecrets: []
-      initContainers: []
-      securityContext:
-        fsGroup: 65534
-      serviceAccountName: sealed-secrets-controller
-      terminationGracePeriodSeconds: 30
-      volumes:
-      - emptyDir: {}
-        name: tmp
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: sealedsecrets.bitnami.com
-spec:
-  group: bitnami.com
-  names:
-    kind: SealedSecret
-    listKind: SealedSecretList
-    plural: sealedsecrets
-    singular: sealedsecret
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        properties:
-          spec:
-            type: object
-            x-kubernetes-preserve-unknown-fields: true
-          status:
-            x-kubernetes-preserve-unknown-fields: true
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
-spec:
-  ports:
-  - port: 8080
-    targetPort: 8080
-  selector:
-    name: sealed-secrets-controller
-  type: ClusterIP
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-service-proxier
-  name: sealed-secrets-service-proxier
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: sealed-secrets-service-proxier
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:authenticated
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: sealed-secrets-key-admin
-subjects:
-- kind: ServiceAccount
-  name: sealed-secrets-controller
-  namespace: kube-system

clusters/production/apps.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: apps
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  dependsOn:
+    - name: infrastructure
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./apps/production
+  prune: true
+  wait: true
+  timeout: 5m0s

clusters/production/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/production
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/production/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml

clusters/production/infrastructure.yaml

@@ -1,15 +1,12 @@
----
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
-  name: podinfo
+  name: infrastructure
   namespace: flux-system
 spec:
   interval: 10m0s
-  retryInterval: 30s
-  path: ./kustomize
-  prune: true
   sourceRef:
     kind: GitRepository
-    name: podinfo
-  targetNamespace: default
+    name: flux-system
+  path: ./infrastructure
+  prune: true

infrastructure/cert-manager/certificate.yaml

@@ -0,0 +1,20 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: clank
+  namespace: cert-manager
+spec:
+  commonName: kjuulh.app
+  secretName: clank-cert
+  dnsNames:
+    - kjuulh.app
+    - "*.kjuulh.app"
+  issuerRef:
+    name: letsencrypt-issuer
+    kind: ClusterIssuer
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "kube-system"  # Control destination namespaces
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" # Auto create reflection for matching namespaces
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "kube-system" #

infrastructure/cert-manager/cloudflare-secret.sealed.yaml

@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: cloudflare-api-token-secret
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgBfxV2k7bG5Zf9KIvaSGwgisxhpi6Wxg6TlgIqdJmARkWezhnM7kc41oU2FxK2rOroYF4ailxBJVbCyeCSPoaPu7sn9Fc7+EgGvlb1DOHKvLVLXoAdu3b1opta6gYi05Uzc8anU9uAsMoEJFcn71RTzFIGNMVKVs2VovtajtRf6UW61kNaC54wmMPuhEYsYKYs75sCc/CgmhMD7P8bx6/b6f7QnsksP07mR5GXS1Q8DePu4dHGx9FhMNXVu+lajyd6wW2eLk0EqzNsZ1cSoK3gZrbpKtHGOkuO6TIoBPAgtgqN8wQzurFkeHowTuEU7GMas0FJtP5b/uH0GwKzYeKvqLvX2LLybwiD/idb/fGSZiPIdk5g3ENSOa8bUiVB78mVGXfSWmVcJCAmKY5uB7vRxq44jZI6eTvalrZoAFKF0zzHi1PBTOimgiDUWJXNd6gVORcqqvsbuAOYi/8KzBSXd+qR+EGbAfYgC/0UAhQPr2uuH0MP1x2gnOLtulxU5oRMvtSzMVZrv85qGrkp1KOtK5oQoDT6kgNZKJ6FBV8JsKhISPUGdM0xsgH+cXyqVZ73UlyohaiPYVHpvoRtcMMw0zQM/tQnhMdstEKQgsSGuzg8g7cOgv2aiYFL1sfm08XEofCBeBXrTNodxAa77I4KnNeB1tbR/WXdX/kzLxb0aGheCxsv8nDU3KJyrvAbRj9wVL3hnBnIc6p/bg8KPLrJkp2Qe+3ree/7Wma0+qhlswdvjLn4dGeb9
+  template:
+    data: null
+    metadata:
+      creationTimestamp: null
+      name: cloudflare-api-token-secret
+      namespace: cert-manager
+

infrastructure/cert-manager/cluster-issuer.yaml

@@ -0,0 +1,25 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-issuer
+spec:
+  acme:
+    # You must replace this email address with your own.
+    # Let's Encrypt will use this to contact you about expiring
+    # certificates, and issues related to your account.
+    email: contact@kasperhermansen.com
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      # Secret resource that will be used to store the account's private key.
+      name: letsencrypt-issuer-secret
+    # Add a single challenge solver, HTTP01 using nginx
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: api-token
+      selector:
+        dnsNames:
+        - 'kjuulh.app'
+        - '*.kjuulh.app'

infrastructure/cert-manager/create-secret.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+echo "Encrypt secret with 'sealed-secrets'"
+kubectl -n default create secret generic cloudflare-api-token-secret \
+--from-literal=api-token="$1" \
+--namespace="cert-manager" \
+--dry-run=client \
+-o yaml > cloudflare-secret.yaml
+echo "secret: $1"
+kubeseal \
+  --format=yaml \
+  --controller-name=sealed-secrets \
+  --controller-namespace=kube-system \
+< cloudflare-secret.yaml > cloudflare-secret.sealed.yaml
+echo "Updated/created secret"
+rm cloudflare-secret.yaml

infrastructure/cert-manager/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - namespace.yaml
+  - release.yaml
+  - cloudflare-secret.sealed.yaml
+  - cluster-issuer.yaml
+  - certificate.yaml

infrastructure/cert-manager/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager

infrastructure/cert-manager/release.yaml

@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  releaseName: cert-manager
+  chart:
+    spec:
+      chart: cert-manager
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: flux-system
+  interval: 30m
+  install:
+    remediation:
+      retries: 3
+  values:
+    installCRDs: true
+    service:
+      type: ClusterIP

infrastructure/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sources
+  - traefik
+  - cert-manager
+  - sealed-secrets
+  - reflector
+  - postgres

infrastructure/postgres/create-db.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+SUBJECT=$1
+PGPASSWORD=$2
+
+PASSWORD=$(openssl rand -hex 20)
+ID=$(openssl rand -hex 5)
+
+kubectl run "postgres-client-$ID" --rm -i --image "bitnami/postgresql" -n postgres --env="PGPASSWORD=$PGPASSWORD" --command -- psql --host postgres-postgresql -U postgres <<SQL
+CREATE DATABASE $SUBJECT;
+CREATE USER $SUBJECT with encrypted password '$PASSWORD';
+grant all privileges on database $SUBJECT to $SUBJECT;
+SQL
+
+echo "$PASSWORD"

infrastructure/postgres/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: postgres
+resources:
+  - namespace.yaml
+  - release.yaml

infrastructure/postgres/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres

infrastructure/postgres/port-forward-db.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+
+PGPASSWORD=$1
+
+kubectl run postgres-client --rm --tty -i --image "bitnami/postgresql" -n postgres --env="PGPASSWORD=$PGPASSWORD" --command -- psql --host postgres-postgresql -U postgres

infrastructure/postgres/release.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: postgres
+spec:
+  releaseName: postgres
+  chart:
+    spec:
+      chart: postgresql
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+      version: "11.6.3"
+  interval: 1h0m0s
+  install:
+    remediation:
+      retries: 3
+  values:
+    global:
+      storageClass: hcloud-volumes

infrastructure/reflector/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: reflector
+resources:
+  - namespace.yaml
+  - release.yaml

infrastructure/reflector/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: reflector

infrastructure/reflector/release.yaml

@@ -0,0 +1,18 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: reflector
+spec:
+  releaseName: reflector
+  chart:
+    spec:
+      chart: reflector
+      sourceRef:
+        kind: HelmRepository
+        name: emberstack
+        namespace: flux-system
+      version: "6.1.47"
+  interval: 1h0m0s
+  install:
+    remediation:
+      retries: 3

infrastructure/sealed-secrets/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - release.yaml

infrastructure/sealed-secrets/release.yaml

@@ -0,0 +1,18 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  releaseName: sealed-secrets
+  chart:
+    spec:
+      chart: sealed-secrets
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 30m
+  install:
+    remediation:
+      retries: 3

infrastructure/sources/bitnami.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: bitnami
+spec:
+  interval: 30m
+  url: https://charts.bitnami.com/bitnami

infrastructure/sources/emberstack.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: emberstack
+spec:
+  interval: 30m
+  url: https://emberstack.github.io/helm-charts

infrastructure/sources/jetstack.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: jetstack
+spec:
+  interval: 30m
+  url: https://charts.jetstack.io

infrastructure/sources/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - bitnami.yaml
+  - jetstack.yaml
+  - emberstack.yaml

infrastructure/traefik/helmconfig.yaml

@@ -0,0 +1,57 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  failurePolicy: abort
+  valuesContent: |
+    logs:
+      general:
+        level: INFO
+    providers:
+      kubernetesCRD:
+        enabled: true
+        allowCrossNamespace: true
+        allowExternalNameServices: true
+        # ingressClass: traefik-internal
+        # labelSelector: environment=production,method=traefik
+        namespaces:
+          - "default"
+          - "kube-system"
+      kubernetesIngress:
+        enabled: true
+        allowExternalNameServices: true
+        allowEmptyServices: true
+        # ingressClass: traefik-internal
+        # labelSelector: environment=production,method=traefik
+        namespaces: 
+          - "default"
+          - "kube-system"
+        # IP used for Kubernetes Ingress endpoints
+        publishedService:
+          enabled: true
+          # Published Kubernetes Service to copy status from. Format: namespace/servicename
+          # By default this Traefik service
+          # pathOverride: ""
+    service:
+      enabled: true
+      type: LoadBalancer
+      annotations:
+        "load-balancer.hetzner.cloud/name": "clank"
+        # make hetzners load-balancer connect to our nodes via our private k3s
+        "load-balancer.hetzner.cloud/use-private-ip": "true"
+        # keep hetzner-ccm from exposing our private ingress ip, which in general isn't routeable from the public internet
+        "load-balancer.hetzner.cloud/disable-private-ingress": "true"
+        # disable ipv6 by default, because external-dns doesn't support AAAA for hcloud yet https://github.com/kubernetes-sigs/external-dns/issues/2044
+        "load-balancer.hetzner.cloud/ipv6-disabled": "true"
+        "load-balancer.hetzner.cloud/location": "fsn1"
+        "load-balancer.hetzner.cloud/type": "lb11"
+        "load-balancer.hetzner.cloud/uses-proxyprotocol": "true"
+    additionalArguments:
+      - "--entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8"
+      - "--entryPoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8"
+      - "--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,10.0.0.0/8"
+      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,10.0.0.0/8"
+      - "--providers.kubernetescrd.allowCrossNamespace=true"    
+

infrastructure/traefik/ingress.yaml

@@ -1,4 +1,3 @@
----
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
@@ -14,3 +13,5 @@ spec:
       services: # Service to redirect requests to
         - name: api@internal # Special service created by Traefik pod
           kind: TraefikService
+  tls:
+    secretName: clank-cert

infrastructure/traefik/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmconfig.yaml
+  - ingress.yaml

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}