Update dependency fluxcd/flux2 to v2.5.1

Reviewed-on: https://git.front.kjuulh.io/clank/kubernetes-state/pulls/1

.drone.yml

@@ -0,0 +1,9 @@
+
+kind: pipeline
+type: docker
+name: "test"
+steps:
+  - name: test
+    image: harbor.front.kjuulh.io/docker-proxy/library/bash:latest
+    commands:
+      - echo 'Run tests'

apps/base/nginx/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: nginx
+resources:
+  - namespace.yaml
+  - release.yaml

apps/base/nginx/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nginx

apps/base/nginx/release.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: nginx
+  namespace: nginx
+spec:
+  releaseName: nginx
+  chart:
+    spec:
+      chart: nginx
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 5m
+  install:
+    remediation:
+      retries: 3
+  values:
+    service:
+      type: ClusterIP

apps/production/kustomization.yaml

@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - controller.yaml
+  - ../base/nginx
-

clank/apps/prod/darklight/client.yaml

@@ -1,52 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: darklight
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: darklight-client-deployment
-  namespace: darklight
-  labels:
-    app: darklight-client
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: darklight-client
-  template:
-    metadata:
-      labels:
-        app: darklight-client
-    spec:
-      containers:
-      - name: darklight-client
-        image: kasperhermansen/darklight-client
-        ports:
-        - containerPort: 3000
-        livenessProbe:
-          httpGet:
-            path: /
-            port: 3000
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 3000
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: darklight-client
-  namespace: darklight
-spec:
-  ports:
-  - port: 80
-    name: http
-    targetPort: 3000
-  selector:
-    app: darklight-client

clank/apps/prod/darklight/ingress.yaml

@@ -1,26 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: darklight
-  namespace: darklight
-spec:
-  entryPoints:
-    - web
-    - websecure
-  routes:
-    - match: Host(`darklight.kjuulh.app`) 
-      kind: Rule
-      services: 
-        - name: darklight-client
-          kind: Service
-          namespace: darklight
-          port: 80
-    - match: Host(`darklight-api.kjuulh.app`) 
-      kind: Rule
-      services: 
-        - name: darklight-server
-          kind: Service
-          namespace: darklight
-          port: 80
-  tls:
-    secretName: clank-cert

clank/apps/prod/darklight/server.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: darklight-server-deployment
-  namespace: darklight
-  labels:
-    app: darklight-server
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: darklight-server
-  template:
-    metadata:
-      labels:
-        app: darklight-server
-    spec:
-      containers:
-      - name: darklight-server
-        image: kasperhermansen/darklight-server:latest
-        ports:
-        - containerPort: 8000
-        livenessProbe:
-          httpGet:
-            path: /download/healthz
-            port: 8000
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          httpGet:
-            path: /download/healthz
-            port: 8000
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: darklight-server
-  namespace: darklight
-spec:
-  ports:
-  - port: 80
-    name: http
-    targetPort: 8000
-  selector:
-    app: darklight-server

clank/apps/prod/wishlist/app.yaml

@@ -1,52 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: wishlist
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wishlist-deployment
-  namespace: wishlist
-  labels:
-    app: wishlist
-spec:
-  replicas: 3
-  selector:
-    matchLabels:
-      app: wishlist
-  template:
-    metadata:
-      labels:
-        app: wishlist
-    spec:
-      containers:
-      - name: wishlist
-        image: kasperhermansen/wishlist-2022
-        ports:
-        - containerPort: 80
-        livenessProbe:
-          httpGet:
-            path: /
-            port: 80
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 80
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wishlist
-  namespace: wishlist
-spec:
-  ports:
-  - port: 80
-    name: http
-    targetPort: 80
-  selector:
-    app: wishlist

clank/apps/test/podinfo-source.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: podinfo
-  namespace: flux-system
-spec:
-  interval: 5min
-  ref:
-    branch: master
-  url: https://github.com/stefanprodan/podinfo
-

clank/clusters/prod/darklight/app.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: darklight
-  namespace: prod
-spec:
-  interval: 10m0s
-  retryInterval: 30s
-  path: ./clank/apps/prod/darklight
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: darklight

clank/clusters/prod/wishlist/app.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: wishlist 
-  namespace: prod
-spec:
-  interval: 10m0s
-  retryInterval: 30s
-  path: ./clank/apps/prod/wishlist
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-    namespace: flux-system
-  targetNamespace: wishlist

clank/platform/cert-manager/cloudflare-secret.sealed.yaml

@@ -1,16 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: cloudflare-api-token-secret
-  namespace: cert-manager
-spec:
-  encryptedData:
-    api-token: AgB8kf7TaAZpwTCn4aYNY5+aCpFyTPwVGLhQL8S6Muoss8/jz+9RIH7WPIxeyTlfjtTw8dzjro3SYfkZ9FHNiL8AS3/YDU9ZHoD1JTrlLB8j6lvPvuMbc0iXimNDWtU5KCwGwjC6gw6TNhnAns1EwMsCH93W2e9XUOYHz4NLxcaue284p0t9JgmtXLi220WCqoG7fs2hQo9dhYitcpmjnOEQRBA75t8paxc3jSA3BqKKeTm0KtYSgOENtahs/u3GQRmLu3y7L9epAyJOUCw1q23jgGZugAmDXY7b2gPXxAF0LMLrjI9l3UAl6FT0fUTrhQZxNZfurIFfV+yVFAkO2nGDlFWkN9xlxV8QzGPeTZEISI3/3aV5+MbJKV2bamOckh2q5Tj5xVAHB5pBc0CJzLpy8okmLnheNZXFRp/jlbH+D9p/sZErFt7TmvZfJS/GYCF/PRjzNwZlFWgiQ3ITTbGcEymXvfRS2NntsU1RCohUw4byAzYw/pxdGx7GA+irFTJyVQ2KwYdkR/P69PotHD0LGyHNWuLcrC1/kbq0lQtSvKHKUNbQM4jSVUweLgSYHlyxKft5F42eunR8BOG1EmUpdR2Y7U86HylwR5CxMJcpkO7a9EfoHDwMMegt1cgbPr37uXN+BKZ3uNUJ9AorZbvnrmFn7gAju+b3URTvaOldlCEaBA0fA8zfbF9lMFz1Lv6zzqOCGhXbOz/1wDUbGKjd2dS0pqIMmp7HOVEyP7TeW2LPJFdkj1F4
-  template:
-    data: null
-    metadata:
-      creationTimestamp: null
-      name: cloudflare-api-token-secret
-      namespace: cert-manager
-

clank/platform/postgres/git.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: postgres
-  namespace: postgres
-spec:
-  interval: 5min
-  ref:
-    branch: main
-  url: https://github.com/CrunchyData/postgres-operator-examples
-

clank/platform/sealed-secrets/controller.yaml

@@ -1,252 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-service-proxier
-  name: sealed-secrets-service-proxier
-  namespace: kube-system
-rules:
-- apiGroups:
-  - ""
-  resourceNames:
-  - sealed-secrets-controller
-  resources:
-  - services
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resourceNames:
-  - 'http:sealed-secrets-controller:'
-  - sealed-secrets-controller
-  resources:
-  - services/proxy
-  verbs:
-  - create
-  - get
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-key-admin
-  name: sealed-secrets-key-admin
-  namespace: kube-system
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: secrets-unsealer
-subjects:
-- kind: ServiceAccount
-  name: sealed-secrets-controller
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations: {}
-  labels:
-    name: secrets-unsealer
-  name: secrets-unsealer
-rules:
-- apiGroups:
-  - bitnami.com
-  resources:
-  - sealedsecrets
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - bitnami.com
-  resources:
-  - sealedsecrets/status
-  verbs:
-  - update
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - get
-  - list
-  - create
-  - update
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - events
-  verbs:
-  - create
-  - patch
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
-spec:
-  minReadySeconds: 30
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      name: sealed-secrets-controller
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      annotations: {}
-      labels:
-        name: sealed-secrets-controller
-    spec:
-      containers:
-      - args: []
-        command:
-        - controller
-        env: []
-        image: docker.io/bitnami/sealed-secrets-controller:v0.17.5
-        imagePullPolicy: Always
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: http
-        name: sealed-secrets-controller
-        ports:
-        - containerPort: 8080
-          name: http
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: http
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1001
-        stdin: false
-        tty: false
-        volumeMounts:
-        - mountPath: /tmp
-          name: tmp
-      imagePullSecrets: []
-      initContainers: []
-      securityContext:
-        fsGroup: 65534
-      serviceAccountName: sealed-secrets-controller
-      terminationGracePeriodSeconds: 30
-      volumes:
-      - emptyDir: {}
-        name: tmp
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: sealedsecrets.bitnami.com
-spec:
-  group: bitnami.com
-  names:
-    kind: SealedSecret
-    listKind: SealedSecretList
-    plural: sealedsecrets
-    singular: sealedsecret
-  scope: Namespaced
-  versions:
-  - name: v1alpha1
-    schema:
-      openAPIV3Schema:
-        properties:
-          spec:
-            type: object
-            x-kubernetes-preserve-unknown-fields: true
-          status:
-            x-kubernetes-preserve-unknown-fields: true
-        type: object
-    served: true
-    storage: true
-    subresources:
-      status: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
-spec:
-  ports:
-  - port: 8080
-    targetPort: 8080
-  selector:
-    name: sealed-secrets-controller
-  type: ClusterIP
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-service-proxier
-  name: sealed-secrets-service-proxier
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: sealed-secrets-service-proxier
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:authenticated
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  annotations: {}
-  labels:
-    name: sealed-secrets-controller
-  name: sealed-secrets-controller
-  namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: sealed-secrets-key-admin
-subjects:
-- kind: ServiceAccount
-  name: sealed-secrets-controller
-  namespace: kube-system

clank/platform/traefik/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  # - release.yaml
-  - traefik.values.yaml
-  - ingress.yaml

clusters/production/apps.yaml

@@ -1,15 +1,16 @@
----
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
-  name: podinfo
+  name: apps
   namespace: flux-system
 spec:
   interval: 10m0s
-  retryInterval: 30s
+  dependsOn:
-  path: ./kustomize
+    - name: infrastructure
-  prune: true
   sourceRef:
     kind: GitRepository
-    name: podinfo
+    name: flux-system
-  targetNamespace: default
+  path: ./apps/production
+  prune: true
+  wait: true
+  timeout: 5m0s

clusters/production/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: ssh://git@git.front.kjuulh.io/clank/kubernetes-state.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./clusters/production
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

clusters/production/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml

clusters/production/infrastructure.yaml

@@ -1,13 +1,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
-  name: platform
+  name: infrastructure
   namespace: flux-system
 spec:
   interval: 10m0s
-  path: ./clank/platform
-  prune: true
   sourceRef:
     kind: GitRepository
     name: flux-system
-    namespace: flux-system
+  path: ./infrastructure
+  prune: true

infrastructure/cert-manager/certificate.yaml

@@ -1,4 +1,3 @@
----
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -15,7 +14,7 @@ spec:
     kind: ClusterIssuer
   secretTemplate:
     annotations:
-      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"  
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "platform,kube-system,wishlist,darklight"  # Control destination namespaces
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "kube-system"  # Control destination namespaces
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" # Auto create reflection for matching namespaces
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "platform,wishlist,darklight" # Control auto-reflection namespaces
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "kube-system" #

infrastructure/cert-manager/cloudflare-secret.sealed.yaml

@@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: cloudflare-api-token-secret
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgBfxV2k7bG5Zf9KIvaSGwgisxhpi6Wxg6TlgIqdJmARkWezhnM7kc41oU2FxK2rOroYF4ailxBJVbCyeCSPoaPu7sn9Fc7+EgGvlb1DOHKvLVLXoAdu3b1opta6gYi05Uzc8anU9uAsMoEJFcn71RTzFIGNMVKVs2VovtajtRf6UW61kNaC54wmMPuhEYsYKYs75sCc/CgmhMD7P8bx6/b6f7QnsksP07mR5GXS1Q8DePu4dHGx9FhMNXVu+lajyd6wW2eLk0EqzNsZ1cSoK3gZrbpKtHGOkuO6TIoBPAgtgqN8wQzurFkeHowTuEU7GMas0FJtP5b/uH0GwKzYeKvqLvX2LLybwiD/idb/fGSZiPIdk5g3ENSOa8bUiVB78mVGXfSWmVcJCAmKY5uB7vRxq44jZI6eTvalrZoAFKF0zzHi1PBTOimgiDUWJXNd6gVORcqqvsbuAOYi/8KzBSXd+qR+EGbAfYgC/0UAhQPr2uuH0MP1x2gnOLtulxU5oRMvtSzMVZrv85qGrkp1KOtK5oQoDT6kgNZKJ6FBV8JsKhISPUGdM0xsgH+cXyqVZ73UlyohaiPYVHpvoRtcMMw0zQM/tQnhMdstEKQgsSGuzg8g7cOgv2aiYFL1sfm08XEofCBeBXrTNodxAa77I4KnNeB1tbR/WXdX/kzLxb0aGheCxsv8nDU3KJyrvAbRj9wVL3hnBnIc6p/bg8KPLrJkp2Qe+3ree/7Wma0+qhlswdvjLn4dGeb9
+  template:
+    data: null
+    metadata:
+      creationTimestamp: null
+      name: cloudflare-api-token-secret
+      namespace: cert-manager
+

infrastructure/cert-manager/cluster-issuer.yaml

@@ -7,7 +7,7 @@ spec:
     # You must replace this email address with your own.
     # Let's Encrypt will use this to contact you about expiring
     # certificates, and issues related to your account.
-    email: contact@kjuulh.io
+    email: contact@kasperhermansen.com
     server: https://acme-v02.api.letsencrypt.org/directory
     privateKeySecretRef:
       # Secret resource that will be used to store the account's private key.

infrastructure/cert-manager/create-secret.sh

@@ -1,19 +1,15 @@
 #!/bin/bash
-
 echo "Encrypt secret with 'sealed-secrets'"
-
 kubectl -n default create secret generic cloudflare-api-token-secret \
 --from-literal=api-token="$1" \
 --namespace="cert-manager" \
 --dry-run=client \
 -o yaml > cloudflare-secret.yaml
-
 echo "secret: $1"
-
+kubeseal \
-kubeseal --format=yaml \
+  --format=yaml \
+  --controller-name=sealed-secrets \
+  --controller-namespace=kube-system \
 < cloudflare-secret.yaml > cloudflare-secret.sealed.yaml
-
 echo "Updated/created secret"
-
 rm cloudflare-secret.yaml
-

infrastructure/cert-manager/kustomization.yaml

@@ -1,8 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: cert-manager
 resources:
-  - cert-manager.yaml
+  - namespace.yaml
-  - certificate.yaml
+  - release.yaml
   - cloudflare-secret.sealed.yaml
   - cluster-issuer.yaml
-
+  - certificate.yaml

infrastructure/cert-manager/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager

infrastructure/cert-manager/release.yaml

@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  releaseName: cert-manager
+  chart:
+    spec:
+      chart: cert-manager
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: flux-system
+  interval: 30m
+  install:
+    remediation:
+      retries: 3
+  values:
+    installCRDs: true
+    service:
+      type: ClusterIP

infrastructure/kustomization.yaml

@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sources
-  - reflector
   - traefik
   - cert-manager
   - sealed-secrets
+  - reflector
   - postgres

infrastructure/postgres/create-db.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+
+SUBJECT=$1
+PGPASSWORD=$2
+
+PASSWORD=$(openssl rand -hex 20)
+ID=$(openssl rand -hex 5)
+
+kubectl run "postgres-client-$ID" --rm -i --image "bitnami/postgresql" -n postgres --env="PGPASSWORD=$PGPASSWORD" --command -- psql --host postgres-postgresql -U postgres <<SQL
+CREATE DATABASE $SUBJECT;
+CREATE USER $SUBJECT with encrypted password '$PASSWORD';
+grant all privileges on database $SUBJECT to $SUBJECT;
+SQL
+
+echo "$PASSWORD"

infrastructure/postgres/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: postgres
+resources:
+  - namespace.yaml
+  - release.yaml

infrastructure/postgres/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres

infrastructure/postgres/port-forward-db.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+
+PGPASSWORD=$1
+
+kubectl run postgres-client --rm --tty -i --image "bitnami/postgresql" -n postgres --env="PGPASSWORD=$PGPASSWORD" --command -- psql --host postgres-postgresql -U postgres

infrastructure/postgres/release.yaml

@@ -2,19 +2,20 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: postgres
-  namespace: postgres
 spec:
   releaseName: postgres
   chart:
     spec:
-      chart: postgres
+      chart: postgresql
       sourceRef:
-        kind: GitRepository
+        kind: HelmRepository
-        name: postgres 
+        name: bitnami
-        namespace: postgres
+        namespace: flux-system
-        path: ./helm/install
+      version: "11.6.3"
-      version: "0.3.0"
   interval: 1h0m0s
   install:
     remediation:
       retries: 3
+  values:
+    global:
+      storageClass: hcloud-volumes

infrastructure/sealed-secrets/kustomization.yaml

@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - git.yaml
   - release.yaml

infrastructure/sealed-secrets/release.yaml

@@ -1,19 +1,18 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
-  name: traefik
+  name: sealed-secrets
   namespace: kube-system
 spec:
-  releaseName: traefik
+  releaseName: sealed-secrets
   chart:
     spec:
-      chart: traefik
+      chart: sealed-secrets
       sourceRef:
         kind: HelmRepository
-        name: traefik
+        name: bitnami
         namespace: flux-system
-      version: "10.19.5"
+  interval: 30m
-  interval: 1h0m0s
   install:
     remediation:
       retries: 3

infrastructure/sources/bitnami.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: bitnami
+spec:
+  interval: 30m
+  url: https://charts.bitnami.com/bitnami

infrastructure/sources/jetstack.yaml

@@ -1,7 +1,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
-  name: traefik
+  name: jetstack
 spec:
   interval: 30m
-  url: https://helm.traefik.io/traefik
+  url: https://charts.jetstack.io

infrastructure/sources/kustomization.yaml

@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: flux-system
 resources:
+  - bitnami.yaml
+  - jetstack.yaml
   - emberstack.yaml
-  - traefik.yaml

infrastructure/traefik/helmconfig.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: kube-system
 spec:
   failurePolicy: abort
-  valuesContent: |-
+  valuesContent: |
     logs:
       general:
         level: INFO
@@ -19,9 +19,6 @@ spec:
         namespaces:
           - "default"
           - "kube-system"
-          - "wishlist"
-          - "darklight"
-
       kubernetesIngress:
         enabled: true
         allowExternalNameServices: true
@@ -31,9 +28,6 @@ spec:
         namespaces: 
           - "default"
           - "kube-system"
-          - "wishlist"
-          - "darklight"
-
         # IP used for Kubernetes Ingress endpoints
         publishedService:
           enabled: true
@@ -59,4 +53,5 @@ spec:
       - "--entryPoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8"
       - "--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,10.0.0.0/8"
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=127.0.0.1/32,10.0.0.0/8"
-      - "--providers.kubernetescrd.allowCrossNamespace=true"
+      - "--providers.kubernetescrd.allowCrossNamespace=true"    
+

infrastructure/traefik/ingress.yaml

@@ -1,4 +1,3 @@
----
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
@@ -16,23 +15,3 @@ spec:
           kind: TraefikService
   tls:
     secretName: clank-cert
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: wishlist
-  namespace: wishlist
-spec:
-  entryPoints:
-    - web
-    - websecure
-  routes:
-    - match: Host(`wishlist.kjuulh.app`) 
-      kind: Rule
-      services: 
-        - name: wishlist
-          kind: Service
-          namespace: wishlist
-          port: 80
-  tls:
-    secretName: clank-cert

infrastructure/traefik/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - client.yaml
+  - helmconfig.yaml
-  - server.yaml
   - ingress.yaml

pub-sealed-secrets.pem

@@ -1,28 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEzTCCArWgAwIBAgIRAKEa+ZM214zPc+OIpLSmfxIwDQYJKoZIhvcNAQELBQAw
-ADAeFw0yMjA1MDgyMDI4MjZaFw0zMjA1MDUyMDI4MjZaMAAwggIiMA0GCSqGSIb3
-DQEBAQUAA4ICDwAwggIKAoICAQC5S/jTgBcc3GbSCl1S7Do3SnX7HUrlgvIWYTLi
-6D2+l3Bvpkb70kGi8pXN3N+Ijv3dQEu847G1jsiTKjcT8CAEGh6PSK6VmTUHQNzE
-TXYusmde66Ob4806DQtG/nEP9tt3N+ZrgCLB2lrD6P7OHO4Eiw+f5eWvKqF1zH8M
-MS98/Gwrf2rjVfkfy+wreFFOcJd9hX1+rR12JVd6FWC/5jesmTdmw6nZEiTc7sFf
-qN3GEQQFG15dwlmFk8WueZxYcMhcXxQGzMBa292LvpWs15+vAum0/n+o9dOu4FaJ
-3V9Qj2A4e35dd39Rm1rCAfpFNu7euYUM88K5/sbH+8Iswk2mm/MnFO2+G+U24uij
-PIsoLz5G0vHNpbSzjqTP/oBMwyfgcu8m2im+X5XBFIP5kFM5fJhPbTIxNLah1OxJ
-dLnc5ymSxIVOSh6lyO3vkwxeBI7jowzQWpisXHav8H5eFeTWvg3kOJuhZgV+kQOd
-WUohsKB8BJh1psrk/Yo4TvMAnj/gfXRRvXBbOeydHU+PlAVJKWfpFx3yOnC5/XuP
-SGCY52NfCP+Hy0L+uQJ6y6xVVwG4xJkPCsMlP7zpcwtmsgd/cBHP3gvoK6Hly8DZ
-z06bs2BdeVkARUghd8y6o4paXZxde74OLMQYgILR1MYA6w0NyLFp6fmbFlYMnnfp
-lwsmIQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAAEwDwYDVR0TAQH/BAUwAwEB/zAd
-BgNVHQ4EFgQUPXJCXyBH0esFFwXjkJ3k/ID9Yg0wDQYJKoZIhvcNAQELBQADggIB
-AE6s5RCqmFTH/c3I18mFBVQd5pSi/Tp1JJIslBIa11cyp9HUf45iUti93k6ngcAU
-yRsp/qgOVHgBrRCNls6ftg4KvKrDbpvsjQ/j5ppsdQhXKXXfUBowuY7OdapC5td1
-QErT6c2R4zhuSQog5D/YqnEK/z2CuVd3Fr2HM6vHF8HXrmAe4FNuUi8JQSJzbVzw
-QuZW8LbWuFrf/F6x9vNBdmNaLKEsz/hiVDGmygdpgBjzaVIYMCP9DauupxgXxtL6
-ojg8gWCJvFwbegci6MPXWLSs9pPXH8sso6z9nQcMSlKcHaG4EP5cTiGOc1Mc3G8F
-a+TcldQovT49AjEtRkI3e607Pjj1Q+ygMevJ2/IOXGPUHfRPAaix19v58yievcHl
-g9lY6rTjT4anzUnkOFsTqU+RMLH+4UaPqsmws0y+m8TCK/Z2iLdhL9Kby0r4AwhB
-wjGv8kH/mkL2MZWSramBvPnn/hJ5fEky5M83J/Lg/BfXyncIODu7G/I2f4AJJqXw
-9e8wpa9eJ6vRstVnPqBbZSxz0YS8z5oIhElOmVP7Swbhm40lCaSgocc76fER6rTx
-HIYZP2zOtSdnP9GuR4IXlMbEaGA9y/B4LBNPWtYH+atRhxCQuI5CQFcZ5hZptQ7P
-7gY+thU0IL50aLgWTu0GhlZ+gGXG5poyBp3zYgm6tQvT
------END CERTIFICATE-----

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}