GitOps with Flux is highlighted; its page is below.

GitOps with Flux

Nothing in the cluster is changed by hand. Flux watches a Git repository and applies it in three stages: controllers, then their configuration, then the applications.

Layout#

The amber arrows are dependencies: each stage starts only when the one before is healthy.

infrastructure/controllers: MetalLB, cert-manager, the Gateway API definitions and Traefik.
infrastructure/configs: the address pool, the certificate authority, the gateway and storage.
apps: the SIEM, and certificates for devices outside the cluster.

Each stage waits for the previous one to be healthy, so a fresh cluster comes up in the right order by itself.

Secrets#

Passwords and keys are committed encrypted with SOPS and an age key. Flux holds the private key inside the cluster and decrypts while applying, so the repository can be private without being trusted.

In the configuration#

clusters/homelab/infrastructure.yaml

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: infra-configs
  namespace: flux-system
spec:
  dependsOn:
    - name: infra-controllers
  path: ./infrastructure/configs
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  decryption:
    provider: sops
    secretRef:
      name: sops-age