Infrastructure

Core cluster services that apps depend on. These are installed before any apps via Flux dependsOn ordering.

Dependency Chain

MetalLB Install ──▶ MetalLB Config ──▶ Traefik Install ──▶ Routes
                                                              │
Cert-Manager Install ──▶ Cert-Manager Issuer                  │
                                                              │
                                              Apps depend on ─┘

Components

Directory	What it does
`metallb-install/`	Installs MetalLB via Helm — gives LoadBalancer services real LAN IPs
`metallb-config/`	Configures the IP address pool and L2 advertisement
`traefik-install/`	Installs Traefik via Helm — reverse proxy and ingress controller
`cert-manager-install/`	Installs cert-manager via Helm — automates TLS certificate provisioning
`cert-manager-issuer/`	Configures Let's Encrypt ClusterIssuer with DNS-01 challenge
`routes/`	Traefik IngressRoutes — one file per app defining how traffic reaches it

How Helm Releases Work Here

Each Helm-based service follows the same pattern:

HelmRelease (helmrelease.yaml) — Points to a chart and version from a HelmRepository defined in bootstrap/repositories/
ConfigMap override (*-override.yaml) — Contains chart values as a YAML string under data.values.yaml. Referenced via valuesFrom in the HelmRelease.

This pattern keeps chart values separate from the release definition, making them easier to review and modify.

Adding a New Infrastructure Service

Create a HelmRepository in bootstrap/repositories/ (if the chart source is new)
Create a directory under infrastructure/ (e.g. infrastructure/my-service-install/)
Add a helmrelease.yaml and optionally a ConfigMap override
Create a Flux Kustomization in bootstrap/kustomization/infrastructure/ pointing to your new directory
Set dependsOn appropriately (most infra services should depend on MetalLB being configured)
Commit and push — Flux handles the rest

Adding SOPS Secret Encryption

The cert-manager-issuer/secret.yaml file currently contains a plain-text secret. To encrypt it:

Install age and generate a key pair
Create a .sops.yaml at the repo root with creation rules for your paths
Encrypt secret files: sops --encrypt --in-place infrastructure/cert-manager-issuer/secret.yaml
Add spec.decryption to the relevant Flux Kustomizations in bootstrap/kustomization/
Create a sops-age Secret in flux-system namespace with your age private key

See the Flux SOPS guide for full instructions.

2.7 KiB Raw Permalink Blame History