{"id":19818719,"url":"https://github.com/sloppycoder/k3s-fluxcd-vinolab","last_synced_at":"2025-09-25T22:58:52.880Z","repository":{"id":172424469,"uuid":"649276961","full_name":"sloppycoder/k3s-fluxcd-vinolab","owner":"sloppycoder","description":null,"archived":false,"fork":false,"pushed_at":"2025-07-05T08:18:43.000Z","size":571,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-05T08:32:44.708Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sloppycoder.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-06-04T11:00:38.000Z","updated_at":"2025-07-05T08:18:32.000Z","dependencies_parsed_at":"2024-06-16T18:35:23.494Z","dependency_job_id":"4c1d2043-9e55-4761-93a1-9c7e99354b80","html_url":"https://github.com/sloppycoder/k3s-fluxcd-vinolab","commit_stats":null,"previous_names":["sloppycoder/k3s-fluxcd-vinolab"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/sloppycoder/k3s-fluxcd-vinolab","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sloppycoder%2Fk3s-fluxcd-vinolab","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sloppycoder%2Fk3s-fluxcd-vinolab/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sloppycoder%2Fk3s-fluxcd-vinolab/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sloppycoder%2Fk3s-fluxcd-vinolab/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sloppycoder","download_url":"https://codeload.github.com/sloppycoder/k3s-fluxcd-vinolab/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sloppycoder%2Fk3s-fluxcd-vinolab/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":276994540,"owners_count":25741828,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-25T02:00:09.612Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T10:16:40.428Z","updated_at":"2025-09-25T22:58:52.874Z","avatar_url":"https://github.com/sloppycoder.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# GitOps setup with FluxCD for K3S Kuberentes clusgter\n\nThis repo contains the [FluxCD](https://fluxcd.io) setup for my homelab K3S cluster with 6 Raspberry Pi CM4. See [this repo](https://github.com/sloppycoder/k3s-ansible) for hardware details.\n\n## Design principles for GitOps\n\nIn a large organiztion it is common to have an infra team who is in charge is shared infrastructure components, e.g. Kubernetes clsuters, databases, Redis cache and other compoents; while application teams are respsonbile for deployment of the applcaiton components on top of shared infrastructure mangaed by the infrastructre team.\n\nWith this use case in mind, here are the design decisions for this FluxCD setup:\n\n* This repo is intended to be used for multiple Kuberentes clusters that share a common underlying infrastructure, e.g. K3S, EKS, etc\n* Shared components, e.g. storage, monitoring, external secret operator are manged in this repo.\n* Each Kuberentes cluster can be shared by multiple application teams.\n* Each application team mangages their own GitOps repo that is external to this repo.\n* Each application environment, e.g. App1 DEV, App2 SIT, are deployed into its own namespace in a Kuberntes cluster. By default the communicatoin between application namespaces are blocked, to provide proper isolation between envrionments.\n\n### Directory structure\n\n#### [prep](prep)\n\nsteps to be peform manually prior to bootstrap FluxCD.\n\n#### [infra/controllers](infra/controllers)\n\nKustomization directory strcture that creates CRDs\n\n* ```base```  contains the common components\n* ```optional``` contains the optional components\n* ```clusters``` contains the overlay for each cluster under management. each cluster will incldue all components in ```base``` and select components in ```optional```. see [super6 cluster](infra/controllers/clusters/super6/kustomization.yaml) as an example\n\n#### [infra/configs](infra/configs)\n\nInfra configurations that depends on CRD in the ```controllers``` direcrory. The directory structure is similiar to ```controllers``` directory.\nThe ```namespaces``` diretory cotnains individual namespaces that will be created and their associated configuration, including networkpolicy that blocks communication between namespaces except for ones that runs shared components, e.g. infra. see [an example network policy](infra/configs/namespaces/test/network-policy.yaml) here.\n\nThe ```clusters``` contains configs for each cluster, each cluster will include configs in ```base``` directory, selected components from ```optional``` directory and selected namespaces that the cluster should host, see [an example cluster config](infra/configs/clusters/super6/kustomization.yaml) here.\n\n### Components\n\nThe following components are managed by FluxCD:\n\n* [external-secrets](https://external-secrets.io/) for syncing secrets from external source (e.g. GCP) to the cluster\n* [Longhorn](https://longhorn.io) for persistent storage\n* [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner) for using NFS based persistent volumes.\n* [cert-manager](https://cert-manager.io/) setup to works with [Let's Encrpt](https://letsencrypt.org/)\n* [nats streaming](https://nats.io/) light-weigh high performance streaming\n* [CloudNativePG PostgreSQL operator](https://cloudnative-pg.io/) for setting up HA PostgreSQL database instances\n* [New Relic](https://newrelic.com) for infra monitoring, mainly for simpler pricing model on data upload, unlike Datadog's convulated licensing model.\n\n## Boostrap FluxCD in a cluster\n\nFollow the steps in [prep](prep). This creates a secret that contains the credential to access GCP Secret Manager, where we'll sync secrets to the cluster using [external-secret](https://external-secrets.io/). Using external secret in order to avoid the hassle of setup SOPS and managing keys locally.\n\nDownload Flux CLI by following the [officail documentation](https://fluxcd.io/flux/cmd/), then\n\n```shell\nexport GITHUB_TOKEN=ghp_pat\nflux bootstrap github   \\\n     --components-extra=image-reflector-controller,image-automation-controller \\\n     --owner=sloppycoder \\\n     --repository=k3s-fluxcd-vinolab \\\n     --branch=main \\\n     --read-write-key \\\n     --path=clusters/super6\n\n```\n\n## Upgrade FluxCD\n\n```shell\n\n# checkout this repo\n\nflux install \\\n--components-extra image-reflector-controller,image-automation-controller \\\n--export \u003e clusters/super6/flux-system/gotk-components.yaml\n\ngit commit -m \"Upgrade to flux version 2.x.x\"\ngit push\n\n```\n\n## Upgrade components\n\nCheckout this repo, update various varion numbers, commit and push. FluxCD will upgrade components according. Follow [this step](https://longhorn.io/docs/1.9.0/deploy/upgrade/upgrade-engine/) after a version upgrade for Longhorn.\n\n## Common Maintanence Commands\n\n1. force external secret sync\n```shell\nkubectl annotate es \u003cname\u003e -n \u003cns\u003e force-sync=$(date +%s) --overwrite\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsloppycoder%2Fk3s-fluxcd-vinolab","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsloppycoder%2Fk3s-fluxcd-vinolab","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsloppycoder%2Fk3s-fluxcd-vinolab/lists"}