From 581b2fdfb3062a60a9cd4a50d8fbefffc77af5a9 Mon Sep 17 00:00:00 2001
From: Ryan Draga <ryan.draga@boxingoctop.us>
Date: Sat, 31 Oct 2026 23:07:38 -0400
Subject: [PATCH] Add Kustomizations for Flux CD support

---
 README.md                                     |  2 ++
 deploy/flux/squirrelbot-kustomization.yaml    | 17 +++++++++++
 deploy/flux/squirrelbot/kustomization.yaml    |  6 ++++
 deploy/flux/squirrelbot/namespace.yaml        |  4 +++
 deploy/flux/squirrelbot/release.yaml          | 28 +++++++++++++++++++
 deploy/flux/squirrelbot/repository.yaml       | 12 ++++++++
 .../squirrelbot/templates/deployment.yaml     |  4 +++
 deploy/helm/squirrelbot/values.yaml           |  2 ++
 8 files changed, 75 insertions(+)
 create mode 100644 deploy/flux/squirrelbot-kustomization.yaml
 create mode 100644 deploy/flux/squirrelbot/kustomization.yaml
 create mode 100644 deploy/flux/squirrelbot/namespace.yaml
 create mode 100644 deploy/flux/squirrelbot/release.yaml
 create mode 100644 deploy/flux/squirrelbot/repository.yaml

diff --git a/README.md b/README.md
index 5ad6854..903e87d 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,8 @@ The chart is `deploy/helm/squirrelbot`. It runs one replica with the Recreate st
 
 Supply secrets with `--set`, a private values file, or `existingSecret`. The secret keys are `DATABASE_URL`, `DISCORD_TOKEN`, `DISCORD_CLIENT_ID`, `DISCORD_CLIENT_SECRET`, and `SESSION_SECRET`.
 
+`deploy/flux/squirrelbot-kustomization.yaml` is a Flux Kustomization for the published chart. It reconciles `deploy/flux/squirrelbot`. Create a Secret named `squirrelbot` in the `squirrelbot` namespace before the first reconcile, with those keys. Point `sourceRef` at your Flux GitRepository when it is not named `flux-system`. Pin `version` in the HelmRelease to stop automatic upgrades.
+
 ```sh
 helm upgrade --install squirrelbot deploy/helm/squirrelbot \
   --set publicUrl=https://mod.example.com \
diff --git a/deploy/flux/squirrelbot-kustomization.yaml b/deploy/flux/squirrelbot-kustomization.yaml
new file mode 100644
index 0000000..eca621e
--- /dev/null
+++ b/deploy/flux/squirrelbot-kustomization.yaml
@@ -0,0 +1,17 @@
+# Flux Kustomization for the published SquirrelBot chart.
+# Copy this into the cluster directory that Flux already reconciles, and point
+# sourceRef at that GitRepository. The default name flux-system matches flux bootstrap.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: squirrelbot
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./deploy/flux/squirrelbot
+  prune: true
+  wait: true
+  timeout: 5m
diff --git a/deploy/flux/squirrelbot/kustomization.yaml b/deploy/flux/squirrelbot/kustomization.yaml
new file mode 100644
index 0000000..70525aa
--- /dev/null
+++ b/deploy/flux/squirrelbot/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
diff --git a/deploy/flux/squirrelbot/namespace.yaml b/deploy/flux/squirrelbot/namespace.yaml
new file mode 100644
index 0000000..2905928
--- /dev/null
+++ b/deploy/flux/squirrelbot/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: squirrelbot
diff --git a/deploy/flux/squirrelbot/release.yaml b/deploy/flux/squirrelbot/release.yaml
new file mode 100644
index 0000000..ef98c62
--- /dev/null
+++ b/deploy/flux/squirrelbot/release.yaml
@@ -0,0 +1,28 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: squirrelbot
+  namespace: squirrelbot
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: squirrelbot
+      version: ">=0.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: squirrelbot
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    publicUrl: https://mod.example.com
+    existingSecret: squirrelbot
+    # A private image needs a pull secret in this namespace.
+    # imagePullSecrets:
+    #   - name: ghcr
diff --git a/deploy/flux/squirrelbot/repository.yaml b/deploy/flux/squirrelbot/repository.yaml
new file mode 100644
index 0000000..53a2584
--- /dev/null
+++ b/deploy/flux/squirrelbot/repository.yaml
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: squirrelbot
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 30m
+  url: oci://ghcr.io/boxingoctopuscreative/charts
+  # A private chart needs a docker-registry Secret in flux-system.
+  # secretRef:
+  #   name: ghcr
diff --git a/deploy/helm/squirrelbot/templates/deployment.yaml b/deploy/helm/squirrelbot/templates/deployment.yaml
index e53fe9f..8d27cfd 100644
--- a/deploy/helm/squirrelbot/templates/deployment.yaml
+++ b/deploy/helm/squirrelbot/templates/deployment.yaml
@@ -20,6 +20,10 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
     spec:
       serviceAccountName: {{ include "squirrelbot.fullname" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       securityContext:
         runAsNonRoot: true
         runAsUser: 65532
diff --git a/deploy/helm/squirrelbot/values.yaml b/deploy/helm/squirrelbot/values.yaml
index 3f4039f..6cd8074 100644
--- a/deploy/helm/squirrelbot/values.yaml
+++ b/deploy/helm/squirrelbot/values.yaml
@@ -6,6 +6,8 @@ image:
   tag: ""
   pullPolicy: IfNotPresent
 
+imagePullSecrets: []
+
 # The Discord gateway allows one session per bot token. The Deployment
 # hardcodes replicas to 1 and uses Recreate. Do not scale this chart.