Add Kustomizations for Flux CD support

README.md

@@ -62,6 +62,8 @@ The chart is `deploy/helm/squirrelbot`. It runs one replica with the Recreate st
 
 Supply secrets with `--set`, a private values file, or `existingSecret`. The secret keys are `DATABASE_URL`, `DISCORD_TOKEN`, `DISCORD_CLIENT_ID`, `DISCORD_CLIENT_SECRET`, and `SESSION_SECRET`.
 
+`deploy/flux/squirrelbot-kustomization.yaml` is a Flux Kustomization for the published chart. It reconciles `deploy/flux/squirrelbot`. Create a Secret named `squirrelbot` in the `squirrelbot` namespace before the first reconcile, with those keys. Point `sourceRef` at your Flux GitRepository when it is not named `flux-system`. Pin `version` in the HelmRelease to stop automatic upgrades.
+
 ```sh
 helm upgrade --install squirrelbot deploy/helm/squirrelbot \
   --set publicUrl=https://mod.example.com \

deploy/flux/squirrelbot-kustomization.yaml

@@ -0,0 +1,17 @@
+# Flux Kustomization for the published SquirrelBot chart.
+# Copy this into the cluster directory that Flux already reconciles, and point
+# sourceRef at that GitRepository. The default name flux-system matches flux bootstrap.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: squirrelbot
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./deploy/flux/squirrelbot
+  prune: true
+  wait: true
+  timeout: 5m

deploy/flux/squirrelbot/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml

deploy/flux/squirrelbot/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: squirrelbot

deploy/flux/squirrelbot/release.yaml

@@ -0,0 +1,28 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: squirrelbot
+  namespace: squirrelbot
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: squirrelbot
+      version: ">=0.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: squirrelbot
+        namespace: flux-system
+      interval: 10m
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    publicUrl: https://mod.example.com
+    existingSecret: squirrelbot
+    # A private image needs a pull secret in this namespace.
+    # imagePullSecrets:
+    #   - name: ghcr

deploy/flux/squirrelbot/repository.yaml

@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: squirrelbot
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 30m
+  url: oci://ghcr.io/boxingoctopuscreative/charts
+  # A private chart needs a docker-registry Secret in flux-system.
+  # secretRef:
+  #   name: ghcr

deploy/helm/squirrelbot/templates/deployment.yaml

@@ -20,6 +20,10 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name }}
     spec:
       serviceAccountName: {{ include "squirrelbot.fullname" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       securityContext:
         runAsNonRoot: true
         runAsUser: 65532

deploy/helm/squirrelbot/values.yaml

@@ -6,6 +6,8 @@ image:
   tag: ""
   pullPolicy: IfNotPresent
 
+imagePullSecrets: []
+
 # The Discord gateway allows one session per bot token. The Deployment
 # hardcodes replicas to 1 and uses Recreate. Do not scale this chart.