I give up. I'll manage the CRDs.

PoshCode · Oct 2, 2023 · 4767fc8 · 4767fc8
1 parent b5d1438
commit 4767fc8
Show file tree

Hide file tree

Showing 14 changed files with 4,506 additions and 12 deletions.
diff --git a/clusters/poshcode/apps.yaml b/clusters/poshcode/apps.yaml
@@ -8,7 +8,7 @@ spec:
   retryInterval: 10m
   timeout: 5m
   dependsOn:
-    - name: services
+    - name: issuers
   sourceRef:
     kind: GitRepository
     name: bootstrap

diff --git a/clusters/poshcode/sources.yaml → clusters/poshcode/crds.yaml b/clusters/poshcode/sources.yaml → clusters/poshcode/crds.yaml
@@ -1,16 +1,16 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
-  name: sources
+  name: crds
   namespace: flux-system
 spec:
-  interval: 1h
+  interval: 10h
   retryInterval: 10m
   timeout: 5m
   sourceRef:
     kind: GitRepository
     name: bootstrap
-  path: ./system/sources
+  path: ./system/crds
   prune: true
   wait: true
   commonMetadata:

diff --git a/clusters/poshcode/issuers.yaml b/clusters/poshcode/issuers.yaml
@@ -4,7 +4,7 @@ metadata:
   name: issuers
   namespace: flux-system
 spec:
-  interval: 30m
+  interval: 1h
   retryInterval: 10m
   timeout: 5m
   dependsOn:
@@ -17,4 +17,4 @@ spec:
   wait: true
   commonMetadata:
     annotations:
-      poshcode.org/tenant: sre-team
+      poshcode.org/tenant: sre-team
diff --git a/clusters/poshcode/services.yaml b/clusters/poshcode/services.yaml
@@ -8,7 +8,7 @@ spec:
   retryInterval: 10m
   timeout: 5m
   dependsOn:
-    - name: sources
+    - name: crds
   sourceRef:
     kind: GitRepository
     name: bootstrap

diff --git a/system/crds/cert-manager-v1.13.1.crds.yaml b/system/crds/cert-manager-v1.13.1.crds.yaml
diff --git a/system/crds/kustomization.yaml b/system/crds/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+  - cert-manager-v1.13.1.crds.yaml
diff --git a/system/issuers/README.md b/system/issuers/README.md
@@ -0,0 +1,5 @@
+This cert-manager deployment is a mess. You have to do three steps in order, BEFORE you install anything that needs certs?
+
+1. Run the CRDS separately (because HELM doesn't support CRD upgrades))
+2. Run the HELM chart
+3. Install these ClusterIssuers (which depend on the webdeploy-hook in the chart)
diff --git a/system/issuers/kustomization.yaml b/system/issuers/kustomization.yaml
@@ -1,3 +1,3 @@
 resources:
   - letsencrypt-production.yaml
-  - letsencrypt-staging.yaml
+  - letsencrypt-staging.yaml
diff --git a/system/services/cert-manager/README.md b/system/services/cert-manager/README.md
@@ -0,0 +1,6 @@
+[Cert Manager](https://cert-manager.io/docs/installation/helm/)
+
+DATE: 2023-10-01
+CHART VERSIOn: 1.13.1
+
+TO UPGRADE CHECK: To make sure we use [the latest CRDs](https://cert-manager.io/docs/installation/helm/#option-1-installing-crds-with-kubectl), because we're installing them separately, ahead of time.
diff --git a/system/services/cert-manager/cert-manager-v1.13.1-values.yaml b/system/services/cert-manager/cert-manager-v1.13.1-values.yaml
@@ -50,7 +50,7 @@ global:
     # renewal of a leadership.
     # retryPeriod: 15s
 
-installCRDs: true
+installCRDs: false
 
 replicaCount: 1
 

diff --git a/system/services/cert-manager/release.yaml b/system/services/cert-manager/release.yaml
@@ -18,9 +18,11 @@ spec:
         namespace: flux-system
       interval: 12h
   install:
+    crds: Skip
     remediation:
       retries: 2
   upgrade:
+    crds: Skip
     remediation:
       retries: 5
       remediateLastFailure: true

diff --git a/system/sources/kustomization.yaml b/system/sources/kustomization.yaml
diff --git a/system/sources/helmrepository.yaml → zisabled/helmrepository.yaml b/system/sources/helmrepository.yaml → zisabled/helmrepository.yaml
diff --git a/system/sources/monitor.yaml → zisabled/monitor.yaml b/system/sources/monitor.yaml → zisabled/monitor.yaml