🔀GitOps & Platform Engineering

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: payments-api
  namespace: flux-system
spec:
  interval: 5m0s      # Reconcile every 5 minutes
  path: ./kubernetes/apps/payments-api/overlays/prod
  prune: true         # Delete resources removed from Git
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  healthChecks:       # Wait for resources to be healthy
    - apiVersion: apps/v1
      kind: Deployment
      name: payments-api
      namespace: production
  timeout: 5m0s
  retryInterval: 2m0s
  # Dependencies: ensure namespace exists before app
  dependsOn:
    - name: namespaces
  postBuild:
    substitute:
      cluster_name: prod-eks-us-east-1
      environment: production
    substituteFrom:
      - kind: ConfigMap
        name: cluster-vars

# FluxCD Image Automation: auto-update image tags in Git
# New image pushed to ECR -> Flux detects -> updates values.yaml -> commits -> reconciles

apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
  name: payments-api
  namespace: flux-system
spec:
  image: 123456789.dkr.ecr.us-east-1.amazonaws.com/payments-api
  interval: 1m
  secretRef:
    name: ecr-credentials

---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: payments-api
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: payments-api
  policy:
    semver:
      range: '>=1.0.0'   # Only stable releases in prod

---
apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImageUpdateAutomation
metadata:
  name: flux-system
  namespace: flux-system
spec:
  interval: 30m
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        email: fluxbot@acme.com
        name: Flux Bot
      messageTemplate: |
        chore(image): update {{range .Updated.Images}}{{.}}{{end}}
    push:
      branch: main
  update:
    path: ./clusters/prod
    strategy: Setters  # Uses # {"$imagepolicy": "flux-system:payments-api"} markers

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: aws-secrets-manager
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: payments-db-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: payments-db-creds    # K8s Secret created here
    creationPolicy: Owner
    template:
      type: Opaque
      data:
        DB_HOST: "{{ .host }}"
        DB_PASSWORD: "{{ .password }}"
        DB_USER: "{{ .username }}"
  data:
    - secretKey: host
      remoteRef:
        key: prod/payments/database
        property: host
    - secretKey: password
      remoteRef:
        key: prod/payments/database
        property: password

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: payments-api-all-clusters
  namespace: argocd
spec:
  generators:
    # Cluster generator: creates one App per registered cluster
    - clusters:
        selector:
          matchLabels:
            env: production
        values:
          revision: main
  template:
    metadata:
      name: 'payments-api-{{name}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/acme-corp/fleet-infra
        targetRevision: '{{values.revision}}'
        path: 'apps/payments-api/overlays/{{metadata.labels.region}}'
      destination:
        server: '{{server}}'
        namespace: production
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true
          - ServerSideApply=true