+5 -4

AGENTS.md

Reviewed

··· 63 63 defines the Flux Kustomization DAG; `flux/*/*.yaml` hold HelmReleases; 64 64 `flux/secrets/*.sops.yaml` are first-class Kubernetes Secrets decrypted by 65 65 Flux. `charts/<name>/` are in-tree charts with **explicit manifests, no 66 66 - shared helpers** (see `k8s/charts/README.md`). `values/global.yaml` holds 67 67 - shared non-secret image pins + constants, mirrored into the Flux 68 68 - `cute-haus-global` ConfigMap. 66 66 + shared helpers** (see `k8s/charts/README.md`). 67 67 + `flux/sources/global.values.yaml` holds shared non-secret image pins + 68 68 + constants; kustomize generates the `cute-haus-global` ConfigMap from it 69 69 + (`configMapGenerator` in `flux/sources/kustomization.yaml`). 69 70 - `secrets/` — SOPS, multi-recipient age. `.sops.yaml` is generated; never 70 71 hand-edit either. 71 72 - `keys/` — `aly_<host>.pub` (user key) + `root_<host>.pub` (host key) age ··· 90 91 - **Every deployed chart must sha256-pin its container images** 91 92 (`image: repo:tag@sha256:...` or `image: {repository, tag: ...@sha256:...}`), 92 93 enforced by `check-pinned-images.ts`. Shared images (alpine, rclone) live 93 93 - in `k8s/values/global.yaml`. Renovate keeps digests fresh (skips 94 94 + in `k8s/flux/sources/global.values.yaml`. Renovate keeps digests fresh (skips 94 95 `tranquil`, which is on private atcr.io — use `just bump-tranquil`). 95 96 - **forward-auth OIDC slugs** must be `forward-auth-<app>` and match a key in 96 97 the plaintext `apps:` map in `k8s/flux/apps/releases.yaml` (enforced by

-19

k8s/flux/sources/global-configmap.yaml

Reviewed

··· 1 1 - apiVersion: v1 2 2 - kind: ConfigMap 3 3 - metadata: 4 4 - name: cute-haus-global 5 5 - annotations: 6 6 - cute.haus/secret-policy: non-secret-values-only 7 7 - data: 8 8 - values.yaml: | 9 9 - # Shared operational constants and OCI image pins. Secret-like values must 10 10 - # live in k8s/flux/secrets/*.sops.yaml, not this ConfigMap. 11 11 - global: 12 12 - images: 13 13 - alpine: docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b 14 14 - rclone: rclone/rclone:1.74@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb 15 15 - 16 16 - failover: 17 17 - # Fast eviction when a node goes NotReady/Unreachable. Mirrors the 18 18 - # app-pod toleration so CNPG and stateful workloads fail over quickly. 19 19 - fastTolerationSeconds: 60

+8 -1

k8s/flux/sources/kustomization.yaml

Reviewed

··· 2 2 kind: Kustomization 3 3 namespace: flux-system 4 4 resources: 5 5 - - global-configmap.yaml 6 5 - helmrepositories.yaml 6 6 + configMapGenerator: 7 7 + - name: cute-haus-global 8 8 + files: 9 9 + - values.yaml=global.values.yaml 10 10 + options: 11 11 + disableNameSuffixHash: true 12 12 + annotations: 13 13 + cute.haus/secret-policy: non-secret-values-only

-16

k8s/values/README.md

Reviewed

··· 1 1 - # 📋 values/ 2 2 - 3 3 - Shared non-secret Helm values. 4 4 - 5 5 - ``` 6 6 - values/ 7 7 - └── global.yaml # image pins and operational constants mirrored into Flux 8 8 - ``` 9 9 - 10 10 - Secret values are first-class SOPS-encrypted Kubernetes Secret manifests under 11 11 - [`../flux/secrets`](../flux/secrets). Do not put secret-like values here. 12 12 - 13 13 - The chart's own `values.yaml` (under `charts/<name>/values.yaml`) holds 14 14 - the in-tree, non-secret defaults. This dir holds only shared non-secret values. 15 15 - 16 16 - See [`../charts/README.md`](../charts/README.md) for the full secret flow.

k8s/values/global.yaml k8s/flux/sources/global.values.yaml

Reviewed

+3 -4

renovate.json

Reviewed

··· 9 9 "enabled": true 10 10 }, 11 11 12 12 - "helmrelease": { 12 12 + "flux": { 13 13 "managerFilePatterns": ["/^k8s/flux/.*\\.ya?ml$/"] 14 14 }, 15 15 ··· 36 36 "datasourceTemplate": "docker" 37 37 }, 38 38 { 39 39 - "description": "Shared image pins in values/global.yaml and the Flux ConfigMap mirror", 39 39 + "description": "Shared image pins in the global values file (the cute-haus-global ConfigMap is generated from it)", 40 40 "customType": "regex", 41 41 "managerFilePatterns": [ 42 42 - "/^k8s/values/global\\.ya?ml$/", 43 43 - "/^k8s/flux/sources/global-configmap\\.ya?ml$/" 42 42 + "/^k8s/flux/sources/global\\.values\\.ya?ml$/" 44 43 ], 45 44 "matchStrings": [ 46 45 "\\s+\\w+:\\s+(?<depName>[^:\\s]+(?:/[^:\\s]+)*):(?<currentValue>[^@\\s]+)@(?<currentDigest>sha256:[a-f0-9]{64})"