🚀 tf-controller

kubernetes/apps/flux-system/kustomization.yaml

@@ -7,5 +7,6 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./addons/ks.yaml
+  - ./tf-controller/ks.yaml
   - ./weave-gitops/ks.yaml
   # Standard Resources

kubernetes/apps/flux-system/tf-controller/app/externalsecret.yaml

@@ -0,0 +1,38 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: tf-controller-sops
+  namespace: flux-system
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: tf-controller-sops-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: keys.txt
+      remoteRef:
+        key: tf-controller
+        property: sops_key
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: tf-controller-op
+  namespace: flux-system
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: tf-controller-op-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: OP_CONNECT_TOKEN
+      remoteRef:
+        key: tf-controller
+        property: 1password_connect_token

kubernetes/apps/flux-system/tf-controller/app/helmrelease.yaml

@@ -0,0 +1,33 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: tf-controller
+  namespace: flux-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: tf-controller
+      version: 0.15.1
+      sourceRef:
+        kind: HelmRepository
+        name: weaveworks
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    installCRDs: true
+    metrics:
+      enabled: true
+      serviceMonitor:
+        enabled: true

kubernetes/apps/flux-system/tf-controller/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml

kubernetes/apps/flux-system/tf-controller/ks.yaml

@@ -0,0 +1,43 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-tf-controller
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  dependsOn:
+    - name: cluster-apps-external-secrets-stores
+  path: ./kubernetes/apps/flux-system/tf-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-tf-controller-terraforms
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  dependsOn:
+    - name: cluster-apps-external-secrets-stores
+    - name: cluster-apps-tf-controller
+  path: ./kubernetes/apps/flux-system/tf-controller/terraforms
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/apps/flux-system/tf-controller/terraforms/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./ocirepository.yaml
+  #- ./terraform.yaml

kubernetes/apps/flux-system/tf-controller/terraforms/ocirepository.yaml

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: terraform
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: oci://ghcr.io/auricom/manifests/terraform
+  ref:
+    tag: main

kubernetes/apps/flux-system/tf-controller/terraforms/terraform.yaml

@@ -0,0 +1,37 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/infra.contrib.fluxcd.io/terraform_v1alpha2.json
+apiVersion: infra.contrib.fluxcd.io/v1alpha2
+kind: Terraform
+metadata:
+  name: storage-apps
+  namespace: flux-system
+spec:
+  suspend: false
+  approvePlan: auto
+  interval: 12h
+  path: ./storage/apps
+  sourceRef:
+    kind: OCIRepository
+    name: terraform
+    namespace: flux-system
+  backendConfig:
+    disable: true
+  cliConfigSecretRef:
+    name: tf-controller-tfrc-secret
+  runnerPodTemplate:
+    spec:
+      env:
+        - name: OP_CONNECT_HOST
+          value: http://onepassword-connect.kube-system.svc.cluster.local:8080
+        - name: OP_CONNECT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: tf-controller-op-secret
+              key: OP_CONNECT_TOKEN
+      volumeMounts:
+        - name: sops
+          mountPath: /home/runner/.config/sops/age/keys.txt
+          subPath: keys.txt
+      volumes:
+        - name: sops
+          secret:
+            secretName: tf-controller-sops-secret

kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml

@@ -14,7 +14,8 @@ spec:
       interval: 30m
       sourceRef:
         kind: HelmRepository
-        name: weave-gitops
+        name: weaveworks
+        namespace: flux-system
   maxHistory: 2
   install:
     createNamespace: true

kubernetes/flux/repositories/helm/kustomization.yaml

@@ -32,4 +32,4 @@ resources:
   - ./rook-ceph.yaml
   - ./stakater.yaml
   - ./vector.yaml
-  - ./weave-gitops.yaml
+  - ./weaveworks.yaml

kubernetes/flux/repositories/helm/weaveworks.yaml

@@ -1,11 +1,11 @@
 ---
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helmrepository_v1beta2.json
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/source.toolkit.fluxcd.io/helmrepository_v1beta2.json
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
-  name: weave-gitops
+  name: weaveworks
   namespace: flux-system
 spec:
-  interval: 30m
+  type: oci
-  url: https://helm.gitops.weave.works
+  interval: 5m
-  timeout: 3m
+  url: oci://ghcr.io/weaveworks/charts