From 6db6a0598d9f4d5be26ac4137d0037238f573db6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Thu, 27 Aug 2026 14:33:02 +0200 Subject: [PATCH] Reconcile this repo's Flux entrypoints instead of applying them by hand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit dev/ declares this repo's GitRepository, the Kustomization that deploys ./kong, and its ExternalSecrets — but nothing watched dev/, so those files were applied once by hand and never re-read. Editing them in git changed nothing until someone remembered to kubectl apply, which is what silently swallowed the CONTROL_PLANE_REF_NAME rollout: correct in git for hours while the cluster still held the old value. Add the bootstrap Kustomization that watches ./dev and, living in ./dev, manages itself. This is what `flux bootstrap` would have created; flux-operator installs the controllers and no root. It sits in the domain namespace rather than flux-system, because sourceRef resolves in the Kustomization's own namespace and because this is the team's to own. Needs one kubectl apply to exist. That is the last one this repo needs. Co-Authored-By: Claude Opus 5 --- dev/bootstrap-kustomization.yaml | 33 ++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 dev/bootstrap-kustomization.yaml diff --git a/dev/bootstrap-kustomization.yaml b/dev/bootstrap-kustomization.yaml new file mode 100644 index 0000000..dd6b3ce --- /dev/null +++ b/dev/bootstrap-kustomization.yaml @@ -0,0 +1,33 @@ +# The missing link. Everything else in dev/ — the GitRepository, the +# Kustomization that deploys ./kong, and the two ExternalSecrets — was applied +# once by hand and then never re-read, because nothing watched this directory. +# Editing flux-kustomization.yaml in git changed nothing in the cluster until +# someone remembered to kubectl apply it. That is what silently swallowed the +# CONTROL_PLANE_REF_NAME rollout: the value was correct in git for hours while +# the cluster still held the old one. +# +# This object watches ./dev, so those files reconcile like any other manifest. +# It lives in ./dev itself, so it also manages itself — the arrangement +# `flux bootstrap` sets up, and which flux-operator does not create. +# +# It sits in the payments namespace, not flux-system: sourceRef resolves in the +# Kustomization's own namespace, and this is the team's to own. +# +# Apply once with kubectl. That is the last manual apply this repo needs. +# +# Sharp edge: with prune enabled, deleting flux-kustomization.yaml from git +# deletes the Kustomization it defines, and that Kustomization's own prune then +# removes the Kong configuration it manages. Correct GitOps behaviour, but the +# blast radius of removing one file is two levels deep. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: payments-api-dev-bootstrap + namespace: payments +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: payments-api-dev + path: ./dev + prune: true