feat!: big time operator

[onedr0p]

Flux operator?

https://youtube.com/watch?v=5C_41X_PepI

[bot-ross]

--- kubernetes/shared Kustomization: flux-system/cluster-shared HelmRepository: flux-system/controlplaneio

+++ kubernetes/shared Kustomization: flux-system/cluster-shared HelmRepository: flux-system/controlplaneio

@@ -0,0 +1,14 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-shared
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: controlplaneio
+  namespace: flux-system
+spec:
+  interval: 5m
+  type: oci
+  url: oci://ghcr.io/controlplaneio-fluxcd/charts
+
--- kubernetes/main/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-addons

+++ kubernetes/main/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-addons

@@ -1,37 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: flux-addons
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: flux-addons
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-  - name: external-secrets-stores
-  interval: 30m
-  path: ./kubernetes/main/apps/flux-system/addons/app
-  postBuild:
-    substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-      optional: true
-    - kind: Secret
-      name: cluster-secrets
-      optional: true
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  targetNamespace: flux-system
-  timeout: 5m
-  wait: false
-
--- kubernetes/main/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-operator

+++ kubernetes/main/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-operator

@@ -0,0 +1,35 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: flux-operator
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: flux-operator
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 30m
+  path: ./kubernetes/main/apps/flux-system/flux-operator/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+      optional: true
+    - kind: Secret
+      name: cluster-secrets
+      optional: true
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: flux-system
+  timeout: 5m
+  wait: true
+
--- kubernetes/main/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-config

+++ kubernetes/main/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-config

@@ -0,0 +1,37 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: flux-config
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: flux-config
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: flux-operator
+  interval: 30m
+  path: ./kubernetes/main/apps/flux-system/flux-operator/config
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+      optional: true
+    - kind: Secret
+      name: cluster-secrets
+      optional: true
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: flux-system
+  timeout: 5m
+  wait: false
+
--- kubernetes/main/flux Kustomization: flux-system/cluster OCIRepository: flux-system/flux-manifests

+++ kubernetes/main/flux Kustomization: flux-system/cluster OCIRepository: flux-system/flux-manifests

@@ -1,15 +0,0 @@

----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: OCIRepository
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: flux-manifests
-  namespace: flux-system
-spec:
-  interval: 10m
-  ref:
-    tag: v2.4.0
-  url: oci://ghcr.io/fluxcd/flux-manifests
-
--- kubernetes/main/flux Kustomization: flux-system/cluster Kustomization: flux-system/flux

+++ kubernetes/main/flux Kustomization: flux-system/cluster Kustomization: flux-system/flux

@@ -1,102 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: flux
-  namespace: flux-system
-spec:
-  interval: 10m
-  patches:
-  - patch: |
-      $patch: delete
-      apiVersion: apps/v1
-      kind: Deployment
-      metadata:
-        name: all
-    target:
-      kind: Deployment
-      name: (image-automation-controller|image-reflector-controller)
-  - patch: |
-      $patch: delete
-      apiVersion: networking.k8s.io/v1
-      kind: NetworkPolicy
-      metadata:
-        name: all
-    target:
-      group: networking.k8s.io
-      kind: NetworkPolicy
-  - patch: |
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --concurrent=10
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --requeue-dependency=5s
-    target:
-      kind: Deployment
-      name: (kustomize-controller|helm-controller|source-controller)
-  - patch: |
-      apiVersion: apps/v1
-      kind: Deployment
-      metadata:
-        name: all
-      spec:
-        template:
-          spec:
-            containers:
-              - name: manager
-                resources:
-                  limits:
-                    memory: 2Gi
-    target:
-      kind: Deployment
-      name: (kustomize-controller|helm-controller|source-controller)
-  - patch: |
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --concurrent=20
-      - op: replace
-        path: /spec/template/spec/volumes/0
-        value:
-          name: temp
-          emptyDir:
-            medium: Memory
-    target:
-      kind: Deployment
-      name: kustomize-controller
-  - patch: |
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --helm-cache-max-size=10
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --helm-cache-ttl=60m
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --helm-cache-purge-interval=5m
-    target:
-      kind: Deployment
-      name: source-controller
-  - patch: |
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --feature-gates=OOMWatch=true
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --oom-watch-memory-threshold=95
-      - op: add
-        path: /spec/template/spec/containers/0/args/-
-        value: --oom-watch-interval=500ms
-    target:
-      kind: Deployment
-      name: helm-controller
-  path: ./
-  prune: true
-  sourceRef:
-    kind: OCIRepository
-    name: flux-manifests
-  wait: true
-
--- kubernetes/main/flux Kustomization: flux-system/cluster FluxInstance: flux-system/flux

+++ kubernetes/main/flux Kustomization: flux-system/cluster FluxInstance: flux-system/flux

@@ -0,0 +1,96 @@

+---
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  annotations:
+    fluxcd.controlplane.io/reconcile: enabled
+    fluxcd.controlplane.io/reconcileEvery: 10m
+    fluxcd.controlplane.io/reconcileTimeout: 1m
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: flux
+  namespace: flux-system
+spec:
+  cluster:
+    domain: cluster.local
+    multitenant: false
+    networkPolicy: false
+    type: kubernetes
+  components:
+  - source-controller
+  - kustomize-controller
+  - helm-controller
+  - notification-controller
+  distribution:
+    artifact: oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests
+    registry: ghcr.io/fluxcd
+    version: v2.4.0
+  kustomize:
+    patches:
+    - patch: |
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --concurrent=10
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --requeue-dependency=5s
+      target:
+        kind: Deployment
+        name: (kustomize-controller|helm-controller|source-controller)
+    - patch: |
+        apiVersion: apps/v1
+        kind: Deployment
+        metadata:
+          name: all
+        spec:
+          template:
+            spec:
+              containers:
+                - name: manager
+                  resources:
+                    limits:
+                      memory: 2Gi
+      target:
+        kind: Deployment
+        name: (kustomize-controller|helm-controller|source-controller)
+    - patch: |
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --concurrent=20
+        - op: replace
+          path: /spec/template/spec/volumes/0
+          value:
+            name: temp
+            emptyDir:
+              medium: Memory
+      target:
+        kind: Deployment
+        name: kustomize-controller
+    - patch: |
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --helm-cache-max-size=10
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --helm-cache-ttl=60m
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --helm-cache-purge-interval=5m
+      target:
+        kind: Deployment
+        name: source-controller
+    - patch: |
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --feature-gates=OOMWatch=true
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --oom-watch-memory-threshold=95
+        - op: add
+          path: /spec/template/spec/containers/0/args/-
+          value: --oom-watch-interval=500ms
+      target:
+        kind: Deployment
+        name: helm-controller
+
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons PodMonitor: flux-system/flux-system

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons PodMonitor: flux-system/flux-system

@@ -1,35 +0,0 @@

----
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
-  labels:
-    app.kubernetes.io/component: monitoring
-    app.kubernetes.io/name: flux-addons
-    app.kubernetes.io/part-of: flux
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: flux-system
-  namespace: flux-system
-spec:
-  namespaceSelector:
-    matchNames:
-    - flux-system
-  podMetricsEndpoints:
-  - port: http-prom
-    relabelings:
-    - action: keep
-      regex: Running
-      sourceLabels:
-      - __meta_kubernetes_pod_phase
-  selector:
-    matchExpressions:
-    - key: app
-      operator: In
-      values:
-      - helm-controller
-      - source-controller
-      - kustomize-controller
-      - notification-controller
-      - image-automation-controller
-      - image-reflector-controller
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons PrometheusRule: flux-system/flux-rules

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons PrometheusRule: flux-system/flux-rules

@@ -1,35 +0,0 @@

----
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: flux-rules
-  namespace: flux-system
-spec:
-  groups:
-  - name: flux.rules
-    rules:
-    - alert: FluxComponentAbsent
-      annotations:
-        summary: Flux component has disappeared from Prometheus target discovery.
-      expr: |
-        absent(up{job=~".*flux-system.*"} == 1)
-      for: 15m
-      labels:
-        severity: critical
-    - alert: FluxReconciliationFailure
-      annotations:
-        summary: '{{ $labels.kind }} {{ $labels.namespace }}/{{ $labels.name }} reconciliation
-          has been failing for more than 15 minutes.'
-      expr: |
-        max(gotk_reconcile_condition{status="False",type="Ready"}) by (namespace, name, kind)
-          +
-        on(namespace, name, kind) (max(gotk_reconcile_condition{status="Deleted"})
-          by (namespace, name, kind)) * 2 == 1
-      for: 15m
-      labels:
-        severity: critical
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons ExternalSecret: flux-system/github-token

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons ExternalSecret: flux-system/github-token

@@ -1,24 +0,0 @@

----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: github-token
-  namespace: flux-system
-spec:
-  dataFrom:
-  - extract:
-      key: flux
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: github-token-secret
-    template:
-      data:
-        token: '{{ .FLUX_GITHUB_TOKEN }}'
-      engineVersion: v2
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Provider: flux-system/github

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Provider: flux-system/github

@@ -1,16 +0,0 @@

----
-apiVersion: notification.toolkit.fluxcd.io/v1beta3
-kind: Provider
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: github
-  namespace: flux-system
-spec:
-  address: https://github.com/onedr0p/home-ops
-  secretRef:
-    name: github-token-secret
-  type: github
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Alert: flux-system/github

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Alert: flux-system/github

@@ -1,18 +0,0 @@

----
-apiVersion: notification.toolkit.fluxcd.io/v1beta3
-kind: Alert
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: github
-  namespace: flux-system
-spec:
-  eventSeverity: info
-  eventSources:
-  - kind: Kustomization
-    name: '*'
-  providerRef:
-    name: github
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons ExternalSecret: flux-system/github-webhook-token

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons ExternalSecret: flux-system/github-webhook-token

@@ -1,24 +0,0 @@

----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: github-webhook-token
-  namespace: flux-system
-spec:
-  dataFrom:
-  - extract:
-      key: flux
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: onepassword-connect
-  target:
-    name: github-webhook-token-secret
-    template:
-      data:
-        token: '{{ .FLUX_GITHUB_WEBHOOK_TOKEN }}'
-      engineVersion: v2
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Ingress: flux-system/webhook-receiver

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Ingress: flux-system/webhook-receiver

@@ -1,24 +0,0 @@

----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: webhook-receiver
-  namespace: flux-system
-spec:
-  ingressClassName: external
-  rules:
-  - host: flux-webhook.devbu.io
-    http:
-      paths:
-      - backend:
-          service:
-            name: webhook-receiver
-            port:
-              number: 80
-        path: /hook/
-        pathType: Prefix
-
--- kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Receiver: flux-system/home-ops

+++ kubernetes/main/apps/flux-system/addons/app Kustomization: flux-system/flux-addons Receiver: flux-system/home-ops

@@ -1,31 +0,0 @@

----
-apiVersion: notification.toolkit.fluxcd.io/v1
-kind: Receiver
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/name: flux-addons
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: home-ops
-  namespace: flux-system
-spec:
-  events:
-  - ping
-  - push
-  resources:
-  - apiVersion: source.toolkit.fluxcd.io/v1
-    kind: GitRepository
-    name: home-kubernetes
-    namespace: flux-system
-  - apiVersion: kustomize.toolkit.fluxcd.io/v1
-    kind: Kustomization
-    name: cluster
-    namespace: flux-system
-  - apiVersion: kustomize.toolkit.fluxcd.io/v1
-    kind: Kustomization
-    name: cluster-apps
-    namespace: flux-system
-  secretRef:
-    name: github-webhook-token-secret
-  type: github
-
--- kubernetes/main/apps/flux-system/flux-operator/app Kustomization: flux-system/flux-operator HelmRelease: flux-system/flux-operator

+++ kubernetes/main/apps/flux-system/flux-operator/app Kustomization: flux-system/flux-operator HelmRelease: flux-system/flux-operator

@@ -0,0 +1,32 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-operator
+    kustomize.toolkit.fluxcd.io/name: flux-operator
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: flux-operator
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: flux-operator
+      sourceRef:
+        kind: HelmRepository
+        name: controlplaneio
+        namespace: flux-system
+      version: 0.12.0
+  install:
+    remediation:
+      retries: 3
+  interval: 30m
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  valuesFrom:
+  - kind: ConfigMap
+    name: flux-operator-helm-values-fb7h5gm7k8
+
--- kubernetes/main/apps/flux-system/flux-operator/app Kustomization: flux-system/flux-operator ConfigMap: flux-system/flux-operator-helm-values-fb7h5gm7k8

+++ kubernetes/main/apps/flux-system/flux-operator/app Kustomization: flux-system/flux-operator ConfigMap: flux-system/flux-operator-helm-values-fb7h5gm7k8

@@ -0,0 +1,16 @@

+---
+apiVersion: v1
+data:
+  values.yaml: |
+    ---
+    serviceMonitor:
+      create: true
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-operator
+    kustomize.toolkit.fluxcd.io/name: flux-operator
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: flux-operator-helm-values-fb7h5gm7k8
+  namespace: flux-system
+
--- kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config ExternalSecret: flux-system/github-token

+++ kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config ExternalSecret: flux-system/github-token

@@ -0,0 +1,24 @@

+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: github-token
+  namespace: flux-system
+spec:
+  dataFrom:
+  - extract:
+      key: flux
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: github-token-secret
+    template:
+      data:
+        token: '{{ .FLUX_GITHUB_TOKEN }}'
+      engineVersion: v2
+
--- kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Provider: flux-system/github

+++ kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Provider: flux-system/github

@@ -0,0 +1,16 @@

+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: github
+  namespace: flux-system
+spec:
+  address: https://github.com/onedr0p/home-ops
+  secretRef:
+    name: github-token-secret
+  type: github
+
--- kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Alert: flux-system/github

+++ kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Alert: flux-system/github

@@ -0,0 +1,18 @@

+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: github
+  namespace: flux-system
+spec:
+  eventSeverity: info
+  eventSources:
+  - kind: Kustomization
+    name: '*'
+  providerRef:
+    name: github
+
--- kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config ExternalSecret: flux-system/github-webhook-token

+++ kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config ExternalSecret: flux-system/github-webhook-token

@@ -0,0 +1,24 @@

+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: github-webhook-token
+  namespace: flux-system
+spec:
+  dataFrom:
+  - extract:
+      key: flux
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: github-webhook-token-secret
+    template:
+      data:
+        token: '{{ .FLUX_GITHUB_WEBHOOK_TOKEN }}'
+      engineVersion: v2
+
--- kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Ingress: flux-system/webhook-receiver

+++ kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Ingress: flux-system/webhook-receiver

@@ -0,0 +1,24 @@

+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: webhook-receiver
+  namespace: flux-system
+spec:
+  ingressClassName: external
+  rules:
+  - host: flux-webhook.devbu.io
+    http:
+      paths:
+      - backend:
+          service:
+            name: webhook-receiver
+            port:
+              number: 80
+        path: /hook/
+        pathType: Prefix
+
--- kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Receiver: flux-system/home-ops

+++ kubernetes/main/apps/flux-system/flux-operator/config Kustomization: flux-system/flux-config Receiver: flux-system/home-ops

@@ -0,0 +1,31 @@

+---
+apiVersion: notification.toolkit.fluxcd.io/v1
+kind: Receiver
+metadata:
+  labels:
+    app.kubernetes.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/name: flux-config
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: home-ops
+  namespace: flux-system
+spec:
+  events:
+  - ping
+  - push
+  resources:
+  - apiVersion: source.toolkit.fluxcd.io/v1
+    kind: GitRepository
+    name: home-kubernetes
+    namespace: flux-system
+  - apiVersion: kustomize.toolkit.fluxcd.io/v1
+    kind: Kustomization
+    name: cluster
+    namespace: flux-system
+  - apiVersion: kustomize.toolkit.fluxcd.io/v1
+    kind: Kustomization
+    name: cluster-apps
+    namespace: flux-system
+  secretRef:
+    name: github-webhook-token-secret
+  type: github
+

[bot-ross]

--- HelmRelease: flux-system/flux-operator ServiceAccount: flux-system/flux-operator

+++ HelmRelease: flux-system/flux-operator ServiceAccount: flux-system/flux-operator

@@ -0,0 +1,12 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flux-operator
+  namespace: flux-system
+  labels:
+    app.kubernetes.io/name: flux-operator
+    app.kubernetes.io/instance: flux-operator
+    app.kubernetes.io/managed-by: Helm
+automountServiceAccountToken: true
+
--- HelmRelease: flux-system/flux-operator ClusterRoleBinding: flux-system/flux-operator

+++ HelmRelease: flux-system/flux-operator ClusterRoleBinding: flux-system/flux-operator

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: flux-operator
+  labels:
+    app.kubernetes.io/name: flux-operator
+    app.kubernetes.io/instance: flux-operator
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: flux-operator
+  namespace: flux-system
+
--- HelmRelease: flux-system/flux-operator Service: flux-system/flux-operator

+++ HelmRelease: flux-system/flux-operator Service: flux-system/flux-operator

@@ -0,0 +1,20 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: flux-operator
+  namespace: flux-system
+  labels:
+    app.kubernetes.io/name: flux-operator
+    app.kubernetes.io/instance: flux-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  ports:
+  - port: 8080
+    targetPort: http-metrics
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: flux-operator
+    app.kubernetes.io/instance: flux-operator
+
--- HelmRelease: flux-system/flux-operator Deployment: flux-system/flux-operator

+++ HelmRelease: flux-system/flux-operator Deployment: flux-system/flux-operator

@@ -0,0 +1,89 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: flux-operator
+  namespace: flux-system
+  labels:
+    app.kubernetes.io/name: flux-operator
+    app.kubernetes.io/instance: flux-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: flux-operator
+      app.kubernetes.io/instance: flux-operator
+  template:
+    metadata:
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: '8080'
+        prometheus.io/path: /metrics
+      labels:
+        app.kubernetes.io/name: flux-operator
+        app.kubernetes.io/instance: flux-operator
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      serviceAccountName: flux-operator
+      containers:
+      - name: manager
+        args:
+        - --log-level=info
+        env:
+        - name: RUNTIME_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          seccompProfile:
+            type: RuntimeDefault
+        image: ghcr.io/controlplaneio-fluxcd/flux-operator:v0.12.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: http-metrics
+          containerPort: 8080
+          protocol: TCP
+        - name: http
+          containerPort: 8081
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 1Gi
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        volumeMounts:
+        - name: temp
+          mountPath: /tmp
+      volumes:
+      - name: temp
+        emptyDir: {}
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/os
+                operator: In
+                values:
+                - linux
+
--- HelmRelease: flux-system/flux-operator ServiceMonitor: flux-system/flux-operator

+++ HelmRelease: flux-system/flux-operator ServiceMonitor: flux-system/flux-operator

@@ -0,0 +1,24 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: flux-operator
+  namespace: flux-system
+  labels:
+    app.kubernetes.io/name: flux-operator
+    app.kubernetes.io/instance: flux-operator
+    app.kubernetes.io/managed-by: Helm
+spec:
+  namespaceSelector:
+    matchNames:
+    - flux-system
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: flux-operator
+      app.kubernetes.io/instance: flux-operator
+  endpoints:
+  - targetPort: 8080
+    path: /metrics
+    interval: 60s
+    scrapeTimeout: 30s
+

[buroa]

🐽 operator

[onedr0p]

Watchout Steven Ray Vaughan