Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
k8s/infra-crds: move to flux
Aly Raffauf
(Jul 1, 2026, 3:20 PM EDT)
a1cc82ec
4c8bbaf6
+77
-27
+31
-2
.sops.yaml
+31
-2
.sops.yaml
···
1
1
# Auto-generated by `just sops-rekey` from keys/*.pub.
2
-
# Every recipient can decrypt every secret. To add or remove a
3
-
# machine, add or remove its .pub file and re-run `just sops-rekey`.
2
+
# User and host keys decrypt legacy secrets/*.yaml. Flux keys decrypt
3
+
# only k8s/flux/secrets/*.sops.yaml.
4
4
keys:
5
5
# === user keys (aly@<host>) ===
6
6
- &user_aly_eterna age1g79dfm0p44q5yxzhwd9syg965lupdu3n5lgyltdannmul5v5v5aszzz3gs
···
26
26
- &host_slateport age1ephzrpgftmvq4cul9766q2r3mss38xu6un74ryfmw0729afysghsh0a3qg
27
27
- &host_snowpoint age1stsuakfyj3gkee4sm328ky2crmymyuzwjjmxrpvnm754sdt2zvnshf68jx
28
28
- &host_sootopolis age1s7ecrfntus8rvyprzhffjpqk2tmrc259knf9xqajlrqvewfp8d6svwp9pp
29
+
# === flux keys ===
30
+
- &flux_k8s age1yq47x0cyf95jg372v84ttptgnppsrfmxshsua6p58ecmgzxc5c0s5stfth
29
31
30
32
creation_rules:
33
+
- path_regex: ^k8s/flux/secrets/.*\.sops\.ya?ml$
34
+
key_groups:
35
+
- age:
36
+
- *user_aly_eterna
37
+
- *user_aly_fallarbor
38
+
- *user_aly_fortree
39
+
- *user_aly_jubilife
40
+
- *user_aly_pacifidlog
41
+
- *user_aly_petalburg
42
+
- *user_aly_rustboro
43
+
- *user_aly_slateport
44
+
- *user_aly_snowpoint
45
+
- *user_aly_sootopolis
46
+
- *host_celestic
47
+
- *host_eterna
48
+
- *host_fallarbor
49
+
- *host_fortree
50
+
- *host_jubilife
51
+
- *host_pacifidlog
52
+
- *host_pastoria
53
+
- *host_petalburg
54
+
- *host_rustboro
55
+
- *host_slateport
56
+
- *host_snowpoint
57
+
- *host_sootopolis
58
+
- *flux_k8s
59
+
31
60
- path_regex: ^secrets/.*\.ya?ml$
32
61
key_groups:
33
62
- age:
+23
k8s/flux/infra-crds/cert-manager.yaml
+23
k8s/flux/infra-crds/cert-manager.yaml
···
1
+
apiVersion: helm.toolkit.fluxcd.io/v2
2
+
kind: HelmRelease
3
+
metadata:
4
+
name: cert-manager
5
+
namespace: flux-system
6
+
spec:
7
+
interval: 15m
8
+
releaseName: cert-manager
9
+
targetNamespace: cert-manager
10
+
install:
11
+
createNamespace: true
12
+
chart:
13
+
spec:
14
+
chart: cert-manager
15
+
interval: 15m
16
+
sourceRef:
17
+
kind: HelmRepository
18
+
name: jetstack
19
+
namespace: flux-system
20
+
version: v1.20.3
21
+
values:
22
+
crds:
23
+
enabled: true
+20
k8s/flux/infra-crds/cnpg.yaml
+20
k8s/flux/infra-crds/cnpg.yaml
···
1
+
apiVersion: helm.toolkit.fluxcd.io/v2
2
+
kind: HelmRelease
3
+
metadata:
4
+
name: cnpg
5
+
namespace: flux-system
6
+
spec:
7
+
interval: 15m
8
+
releaseName: cnpg
9
+
targetNamespace: cnpg-system
10
+
install:
11
+
createNamespace: true
12
+
chart:
13
+
spec:
14
+
chart: cloudnative-pg
15
+
interval: 15m
16
+
sourceRef:
17
+
kind: HelmRepository
18
+
name: cnpg
19
+
namespace: flux-system
20
+
version: 0.29.0
+2
-1
k8s/flux/infra-crds/kustomization.yaml
+2
-1
k8s/flux/infra-crds/kustomization.yaml
-9
k8s/flux/infra-crds/placeholder.yaml
-9
k8s/flux/infra-crds/placeholder.yaml
-15
k8s/helmfile.yaml
-15
k8s/helmfile.yaml
···
124
124
ingress:
125
125
enabled: false
126
126
127
-
- name: cnpg
128
-
namespace: cnpg-system
129
-
createNamespace: true
130
-
chart: cnpg/cloudnative-pg
131
-
version: 0.29.0
132
-
133
-
- name: cert-manager
134
-
namespace: cert-manager
135
-
createNamespace: true
136
-
chart: jetstack/cert-manager
137
-
version: v1.20.3
138
-
values:
139
-
- crds:
140
-
enabled: true
141
-
142
127
- name: cert-manager-issuers
143
128
namespace: cert-manager
144
129
chart: ./charts/cert-manager-issuers
+1
keys/flux_k8s.pub
+1
keys/flux_k8s.pub
···
1
+
age1yq47x0cyf95jg372v84ttptgnppsrfmxshsua6p58ecmgzxc5c0s5stfth