initial commit

.gitignore

@@ -0,0 +1,11 @@
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+.ignored
+.gitea/*
+
+# Local plaintext twins for sync-managed secrets. Keep these untracked.
+*secret*.yaml
+!*sealed?secret.yaml

README.md

@@ -0,0 +1,74 @@
+# ${REPO_NAME}
+
+Kubernetes deployment source-of-truth repository for `${REPO_NAME}`.
+
+This template is intended for applications deployed with ArgoCD through an
+`ApplicationSet`. It uses a `base/` plus `overlays/` layout, stores runtime
+secrets as SOPS-encrypted manifests, and includes Gitea workflows for manifest
+validation and dormant-transition PR creation.
+
+## Layout
+
+```text
+.
+├── .gitea/
+│   ├── template
+│   └── workflows/
+│       ├── dormant-pr.yaml
+│       └── validate.yaml
+├── bootstrap/
+│   ├── applicationset.yaml
+│   └── config.yaml
+├── manifest/
+│   ├── base/
+│   │   ├── kustomization.yaml
+│   │   ├── runtime/
+│   │   │   ├── deployment.yaml
+│   │   │   ├── kustomization.yaml
+│   │   │   └── service.yaml
+│   │   └── state/
+│   │       ├── kustomization.yaml
+│   │       └── persistentvolumeclaim.yaml
+│   ├── components/
+│   │   └── example-component/
+│   └── overlays/
+│       ├── dormant/
+│       │   └── kustomization.yaml
+│       └── production/
+│           ├── ingressroute.yaml
+│           ├── kustomization.yaml
+│           └── storage/
+│               └── persistentvolume-nfs.yaml
+├── DORMANT_IMPLEMENTATION_REPORT.md
+├── OPERATIONS.md
+└── scripts/
+```
+
+## Active and dormant overlays
+
+- Active `production` includes runtime resources plus retained state.
+- Dormant includes only retained state so Argo CD removes runtime workloads but keeps app data.
+- The `bootstrap/applicationset.yaml` `overlay` field is the control point for switching between active and dormant desired state.
+
+## First edits
+
+Update these files before the first deployment:
+
+1. `manifest/base/runtime/deployment.yaml`
+   Set the container image, ports, probes, resource requests, and required environment variables.
+2. `manifest/overlays/production/ingressroute.yaml`
+   Set the real hostname, entry point names, and middleware references if used.
+3. `manifest/base/state/persistentvolumeclaim.yaml`
+   Set the requested size, access mode, and storage class for the environment.
+4. `.sops.yaml`
+   Replace the sample age recipient with the public key that ArgoCD should use for decryption.
+5. `manifest/overlays/production/secret.secret.yaml`
+   Re-encrypt the placeholder secret values with your own data.
+
+## Dormant PR flow
+
+Push a protected tag in the form `dormant/<repo-name>/production`.
+
+The Gitea workflow creates a short-lived branch, changes the ApplicationSet overlay target to `manifest/overlays/dormant`, and opens a pull request against `main`. Merge approval is the dormancy gate. Reactivation is a normal PR that switches `overlay` back to `production`.
+
+See `OPERATIONS.md` for storage prerequisites and required Gitea protections.

manifest/base/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - runtime
+  - state

manifest/base/runtime/daemonset-kube-flannel-ds.yaml

@@ -0,0 +1,116 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    app: flannel
+    k8s-app: flannel
+    tier: node
+  name: kube-flannel-ds
+  namespace: kube-flannel
+spec:
+  selector:
+    matchLabels:
+      app: flannel
+      k8s-app: flannel
+  template:
+    metadata:
+      labels:
+        app: flannel
+        k8s-app: flannel
+        tier: node
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/os
+                operator: In
+                values:
+                - linux
+      containers:
+      - args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        command:
+        - /opt/bin/flanneld
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: EVENT_QUEUE_DEPTH
+          value: "5000"
+        - name: CONT_WHEN_CACHE_NOT_READY
+          value: "false"
+        image: ghcr.io/flannel-io/flannel:v0.28.7
+        name: kube-flannel
+        resources:
+          requests:
+            cpu: 100m
+            memory: 50Mi
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - NET_RAW
+          privileged: false
+        volumeMounts:
+        - mountPath: /run/flannel
+          name: run
+        - mountPath: /etc/kube-flannel/
+          name: flannel-cfg
+        - mountPath: /run/xtables.lock
+          name: xtables-lock
+      hostNetwork: true
+      initContainers:
+      - args:
+        - -f
+        - /flannel
+        - /opt/cni/bin/flannel
+        command:
+        - cp
+        image: ghcr.io/flannel-io/flannel-cni-plugin:v1.9.1-flannel2
+        name: install-cni-plugin
+        volumeMounts:
+        - mountPath: /opt/cni/bin
+          name: cni-plugin
+      - args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        command:
+        - cp
+        image: ghcr.io/flannel-io/flannel:v0.28.7
+        name: install-cni
+        volumeMounts:
+        - mountPath: /etc/cni/net.d
+          name: cni
+        - mountPath: /etc/kube-flannel/
+          name: flannel-cfg
+      priorityClassName: system-node-critical
+      serviceAccountName: flannel
+      tolerations:
+      - effect: NoSchedule
+        operator: Exists
+      volumes:
+      - hostPath:
+          path: /run/flannel
+        name: run
+      - hostPath:
+          path: /opt/cni/bin
+        name: cni-plugin
+      - hostPath:
+          path: /etc/cni/net.d
+        name: cni
+      - configMap:
+          name: kube-flannel-cfg
+        name: flannel-cfg
+      - hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate
+        name: xtables-lock

manifest/base/runtime/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kube-flannel
+
+resources:
+  - daemonset-kube-flannel-ds.yaml

manifest/base/state/clusterrole-flannel.yaml

@@ -0,0 +1,27 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: flannel
+  name: flannel
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes/status
+  verbs:
+  - patch

manifest/base/state/clusterrolebinding-flannel.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    k8s-app: flannel
+  name: flannel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flannel
+subjects:
+- kind: ServiceAccount
+  name: flannel
+  namespace: kube-flannel

manifest/base/state/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kube-flannel
+
+resources:
+  - serviceaccount-flannel.yaml
+  - namespace-kube-flannel.yaml
+  - clusterrolebinding-flannel.yaml
+  - clusterrole-flannel.yaml
+

manifest/base/state/namespace-kube-flannel.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    k8s-app: flannel
+    pod-security.kubernetes.io/enforce: privileged
+  name: kube-flannel

manifest/base/state/serviceaccount-flannel.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: flannel
+  name: flannel
+  namespace: kube-flannel

manifest/components/example-component/example-kustomization.yaml

@@ -0,0 +1,7 @@
+# +argocd:skip-file-rendering
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+configMapGenerator:
+- files:
+  - example-test.env

manifest/components/example-component/example-test.env

@@ -0,0 +1,3 @@
+  # +argocd:skip-file-rendering
+
+  test=works

manifest/overlays/dormant/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kube-flannel
+
+resources:
+  - ../../base/state
+
+commonLabels:
+  app.kubernetes.io/part-of: flannel
+  app.kubernetes.io/environment: dormant

manifest/overlays/production/configmap-kube-flannel-cfg.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+data:
+  cni-conf.json: |
+    {
+      "name": "cbr0",
+      "cniVersion": "0.3.1",
+      "plugins": [
+        {
+          "type": "flannel",
+          "delegate": {
+            "hairpinMode": true,
+            "isDefaultGateway": true
+          }
+        },
+        {
+          "type": "portmap",
+          "capabilities": {
+            "portMappings": true
+          }
+        }
+      ]
+    }
+  net-conf.json: |
+    {
+      "Network": "172.25.0.0/16",
+      "EnableNFTables": false,
+      "Backend": {
+        "Type": "vxlan"
+      }
+    }
+kind: ConfigMap
+metadata:
+  labels:
+    app: flannel
+    k8s-app: flannel
+    tier: node
+  name: kube-flannel-cfg
+  namespace: kube-flannel

manifest/overlays/production/ingressroute.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: flannel
+  labels:
+    app.kubernetes.io/name: flannel
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`flannel.olb42.com`)
+      services:
+        - name: app
+          port: 80
+  secretName: olb42-wildcard-tls

manifest/overlays/production/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kube-flannel
+
+resources:
+  - ../../base/runtime
+  - ../../base/state
+  - configmap-kube-flannel-cfg.yaml
+  # - ingressroute.yaml
+
+
+commonLabels:
+  app.kubernetes.io/part-of: flannel
+  app.kubernetes.io/environment: production

manifest/overlays/production/storage/persistentvolume-nfs.yaml

@@ -0,0 +1,32 @@
+# Optional static PV example for NFS-backed storage.
+# This file is not referenced from kustomization.yaml by default because the
+# default storage flow uses dynamic provisioning via the Longhorn PVC.
+#
+# To use this file:
+#   1. Add storage/persistentvolume-nfs.yaml to resources in this overlay.
+#   2. Update persistentvolumeclaim.yaml to set:
+#        storageClassName: nfs-shared
+#        volumeName: app-data
+#        accessModes: [ReadWriteMany]
+#   3. Replace the placeholder NFS server and export path below.
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: app-data
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: app-data
+    namespace: flannel
+  storageClassName: nfs-shared
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: nfs.example.internal
+    path: /exports/app-data