From bc6f92e145da404adb3436ed92a993a9f7a8b793 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Wed, 19 Aug 2026 16:56:23 +0200 Subject: [PATCH] flux: re-order certificates for right dependencies --- .../certificates.yaml | 0 .../caddy-certificates/kustomization.yaml | 4 ++++ .../infrastructure/caddy/kustomization.yaml | 1 - .../mail/stalwart/kustomization.yaml | 1 - .../certificate.yaml | 0 .../stalwart-certificates/kustomization.yaml | 4 ++++ kubernetes/kustomization.yaml | 12 +++++------ .../system/flux/caddy-certificates.yaml | 21 +++++++++++++++++++ kubernetes/system/flux/kustomization.yaml | 2 ++ .../system/flux/stalwart-certificates.yaml | 21 +++++++++++++++++++ 10 files changed, 58 insertions(+), 8 deletions(-) rename kubernetes/infrastructure/{caddy => caddy-certificates}/certificates.yaml (100%) create mode 100644 kubernetes/infrastructure/caddy-certificates/kustomization.yaml rename kubernetes/infrastructure/{mail/stalwart => stalwart-certificates}/certificate.yaml (100%) create mode 100644 kubernetes/infrastructure/stalwart-certificates/kustomization.yaml create mode 100644 kubernetes/system/flux/caddy-certificates.yaml create mode 100644 kubernetes/system/flux/stalwart-certificates.yaml diff --git a/kubernetes/infrastructure/caddy/certificates.yaml b/kubernetes/infrastructure/caddy-certificates/certificates.yaml similarity index 100% rename from kubernetes/infrastructure/caddy/certificates.yaml rename to kubernetes/infrastructure/caddy-certificates/certificates.yaml diff --git a/kubernetes/infrastructure/caddy-certificates/kustomization.yaml b/kubernetes/infrastructure/caddy-certificates/kustomization.yaml new file mode 100644 index 0000000..7340f8f --- /dev/null +++ b/kubernetes/infrastructure/caddy-certificates/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - certificates.yaml diff --git a/kubernetes/infrastructure/caddy/kustomization.yaml b/kubernetes/infrastructure/caddy/kustomization.yaml index 7fe53d7..661e3ac 100644 --- a/kubernetes/infrastructure/caddy/kustomization.yaml +++ b/kubernetes/infrastructure/caddy/kustomization.yaml @@ -5,7 +5,6 @@ resources: - namespace.yaml - repository.yaml - release.yaml - - certificates.yaml - caddyfile.yaml secretGenerator: - name: caddy-values diff --git a/kubernetes/infrastructure/mail/stalwart/kustomization.yaml b/kubernetes/infrastructure/mail/stalwart/kustomization.yaml index 9648dce..4e90e65 100644 --- a/kubernetes/infrastructure/mail/stalwart/kustomization.yaml +++ b/kubernetes/infrastructure/mail/stalwart/kustomization.yaml @@ -4,7 +4,6 @@ namespace: stalwart resources: - namespace.yaml - repository.yaml - - certificate.yaml - recovery-admin-secret.yaml - release.yaml secretGenerator: diff --git a/kubernetes/infrastructure/mail/stalwart/certificate.yaml b/kubernetes/infrastructure/stalwart-certificates/certificate.yaml similarity index 100% rename from kubernetes/infrastructure/mail/stalwart/certificate.yaml rename to kubernetes/infrastructure/stalwart-certificates/certificate.yaml diff --git a/kubernetes/infrastructure/stalwart-certificates/kustomization.yaml b/kubernetes/infrastructure/stalwart-certificates/kustomization.yaml new file mode 100644 index 0000000..1615af2 --- /dev/null +++ b/kubernetes/infrastructure/stalwart-certificates/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - certificate.yaml diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml index dc155a8..879e5cd 100644 --- a/kubernetes/kustomization.yaml +++ b/kubernetes/kustomization.yaml @@ -1,7 +1,10 @@ # Root Kustomization for Flux -# Explicitly lists all components to exclude: -# - cert-manager: managed by separate Flux Kustomization (CRD dependency) -# - cert-manager-issuer: managed by separate Flux Kustomization (depends on cert-manager) +# Components managed by separate Flux Kustomizations (CRD dependency ordering): +# - cert-manager: managed by Flux Kustomization (CRDs must be installed first) +# - cert-manager-webhook-ovh: managed by Flux Kustomization (depends on cert-manager) +# - cert-manager-issuer: managed by Flux Kustomization (depends on cert-manager + webhook) +# - caddy-certificates: managed by Flux Kustomization (Certificate CRDs need cert-manager) +# - stalwart-certificates: managed by Flux Kustomization (Certificate CRDs need cert-manager) apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: @@ -18,9 +21,6 @@ resources: - infrastructure/observability - infrastructure/traefik - infrastructure/caddy - - infrastructure/cert-manager - - infrastructure/cert-manager-issuer - - infrastructure/cert-manager-webhook-ovh - infrastructure/network/blocky # Dev (developer platform) - dev/gitea diff --git a/kubernetes/system/flux/caddy-certificates.yaml b/kubernetes/system/flux/caddy-certificates.yaml new file mode 100644 index 0000000..f935c97 --- /dev/null +++ b/kubernetes/system/flux/caddy-certificates.yaml @@ -0,0 +1,21 @@ +# Flux Kustomization for Caddy TLS certificates +# Depends on cert-manager-issuer (CRDs + ClusterIssuer) and homeprod (caddy namespace) +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: caddy-certificates + namespace: flux-system +spec: + interval: 10m + prune: true + sourceRef: + kind: GitRepository + name: homeprod + path: ./kubernetes/infrastructure/caddy-certificates + dependsOn: + - name: homeprod + - name: cert-manager-issuer + decryption: + provider: sops + secretRef: + name: flux-sops diff --git a/kubernetes/system/flux/kustomization.yaml b/kubernetes/system/flux/kustomization.yaml index 5fee85f..6d6fe27 100644 --- a/kubernetes/system/flux/kustomization.yaml +++ b/kubernetes/system/flux/kustomization.yaml @@ -7,3 +7,5 @@ resources: - cert-manager.yaml - cert-manager-webhook-ovh.yaml - cert-manager-issuer.yaml + - caddy-certificates.yaml + - stalwart-certificates.yaml diff --git a/kubernetes/system/flux/stalwart-certificates.yaml b/kubernetes/system/flux/stalwart-certificates.yaml new file mode 100644 index 0000000..c94766e --- /dev/null +++ b/kubernetes/system/flux/stalwart-certificates.yaml @@ -0,0 +1,21 @@ +# Flux Kustomization for Stalwart mail TLS certificate +# Depends on cert-manager-issuer (CRDs + ClusterIssuer) and homeprod (stalwart namespace) +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: stalwart-certificates + namespace: flux-system +spec: + interval: 10m + prune: true + sourceRef: + kind: GitRepository + name: homeprod + path: ./kubernetes/infrastructure/stalwart-certificates + dependsOn: + - name: homeprod + - name: cert-manager-issuer + decryption: + provider: sops + secretRef: + name: flux-sops