8781aa3bc4
The cloud-init template selected a per-FQDN GitRepository tree
(`!/clusters/${sovereign_fqdn}`) and pointed both bootstrap-kit
and infrastructure-config Flux Kustomizations at
`./clusters/${sovereign_fqdn}/{bootstrap-kit,infrastructure}` —
directories the wizard never commits before provisioning. Every
fresh Sovereign stalled Phase-1 with `kustomization path not found:
.../clusters/<fqdn>/bootstrap-kit: no such file or directory`
(live evidence on otech.omani.works deployment ce476aaf80731a46).
Canonical fix:
- GitRepository.spec.ignore selects the shared `_template` tree
(`!/clusters/_template`).
- Both Kustomizations point at `./clusters/_template/bootstrap-kit`
and `./clusters/_template/infrastructure`.
- Flux postBuild.substitute.SOVEREIGN_FQDN: ${sovereign_fqdn}
interpolates the Sovereign's FQDN into the rendered manifests
(envsubst replaces `${SOVEREIGN_FQDN}` in label values, ingress
hostnames, HelmRelease values).
- clusters/_template/bootstrap-kit/*.yaml + kustomization.yaml
switch their bare `SOVEREIGN_FQDN_PLACEHOLDER` markers to
`${SOVEREIGN_FQDN}` so Flux's envsubst-based substitute can
actually replace them.
Locked by 5 unit tests in
products/catalyst/bootstrap/api/internal/provisioner/cloudinit_path_test.go
that read the template and assert: GitRepository ignore selects
_template, both Kustomization paths point at _template subdirs,
both carry the postBuild.substitute hook, and no operative YAML
line carries `clusters/${sovereign_fqdn}`.
Closes #218
Co-authored-by: hatiyildiz <269457768+hatiyildiz@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
1.7 KiB
YAML
65 lines
1.7 KiB
YAML
# bp-cert-manager — Catalyst bootstrap-kit Blueprint. TLS for everything below — Lets Encrypt issuer with Dynadot DNS-01 (omani.works pool) or HTTP-01 (BYO domains).
|
|
#
|
|
# Wrapper chart: platform/cert-manager/chart/
|
|
# Catalyst-curated values: platform/cert-manager/chart/values.yaml
|
|
# Reconciled by: Flux on the new Sovereign's k3s control plane.
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: cert-manager
|
|
labels:
|
|
catalyst.openova.io/sovereign: ${SOVEREIGN_FQDN}
|
|
---
|
|
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: bp-cert-manager
|
|
namespace: flux-system
|
|
spec:
|
|
type: oci
|
|
interval: 15m
|
|
url: oci://ghcr.io/openova-io
|
|
secretRef:
|
|
name: ghcr-pull
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: bp-cert-manager
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 15m
|
|
releaseName: cert-manager
|
|
targetNamespace: cert-manager
|
|
dependsOn:
|
|
- name: bp-cilium
|
|
chart:
|
|
spec:
|
|
chart: bp-cert-manager
|
|
version: 1.1.1
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: bp-cert-manager
|
|
namespace: flux-system
|
|
# Event-driven install: cert-manager installs CRDs + 3 deployments
|
|
# (controller, webhook, cainjector). Webhook readiness depends on the
|
|
# cainjector mutating the Secret — multi-minute path on cold start.
|
|
# Helm install completes when manifests apply; subsequent dependsOn
|
|
# checks Ready=True independently. Replaces PR #221 spec.timeout: 15m.
|
|
install:
|
|
disableWait: true
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
disableWait: true
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
cert-manager:
|
|
prometheus:
|
|
enabled: false
|
|
servicemonitor:
|
|
enabled: false
|