### Bootstrap Production Cluster using Makefile

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command bootstraps the production cluster. No specific setup is detailed in the snippet, but it follows a similar pattern to staging cluster bootstrapping.

```shell
# Bootstrap production cluster (prod-eu)
make bootstrap-production
```

--------------------------------

### FluxInstance Configuration Example

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Example of a FluxInstance configuration that points to an OCI Artifact for cluster synchronization. Staging clusters sync from 'latest', production from 'latest-stable'.

```yaml
apiVersion: flux.controlplane.io/v1beta1
kind: FluxInstance
metadata:
  name: flux-system
  namespace: flux-system
spec:
  interval: 1m
  force_requeue: true
  oci:
    image: oci://ghcr.io/controlplaneio-fluxcd/d2-fleet
    tag: latest
  # For production clusters, use:
  # tag: latest-stable
```

--------------------------------

### Bootstrap Staging Cluster using Makefile

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command bootstraps the staging cluster by installing the Flux Operator, creating a Docker registry secret, applying the FluxInstance, and waiting for Flux to become ready. It assumes a KinD cluster or a cluster set as the current kubectl context.

```shell
# Bootstrap staging cluster (KinD or any cluster set as current kubectl context)
make bootstrap-staging
# 1. helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
#      --namespace flux-system --create-namespace \
#      -f clusters/staging/flux-system/flux-operator-values.yaml --wait
# 2. kubectl -n flux-system create secret docker-registry ghcr-auth \
#      --docker-server=ghcr.io --docker-username=flux --docker-password=$GITHUB_TOKEN
# 3. kubectl apply -f clusters/staging/flux-system/flux-instance.yaml
# 4. kubectl -n flux-system wait fluxinstance/flux --for=condition=Ready --timeout=5m
```

--------------------------------

### Flux CLI Command for Rolling Back

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Example Flux CLI command to roll back a production deployment to a specific OCI artifact version and update the 'latest-stable' tag.

```bash
# flux tag oci://ghcr.io/controlplaneio-fluxcd/d2-fleet:v1.2.3 --tag latest-stable
```

--------------------------------

### FluxCD ResourceSet for Infrastructure Components

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ResourceSet defines how infrastructure components are deployed. It mirrors the application deployment pattern but is intended for platform add-ons and typically receives cluster-admin RBAC. It enforces installation order via `dependsOn`.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: infra
  namespace: flux-system
spec:
  dependsOn:
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      name: infra-configs
      namespace: monitoring
      ready: true
      readyExpr: status.observedGeneration >= 0
  resources:
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: infra-controllers
        namespace: flux-system
      spec:
        interval: 5m
        sourceRef:
          kind: GitRepository
          name: fluxcd-source
        path: "./infrastructure/controllers"
        prune: true
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: infra-configs
        namespace: monitoring
      spec:
        interval: 5m
        dependsOn:
          - name: infra-controllers
        sourceRef:
          kind: GitRepository
          name: fluxcd-source
        path: "./infrastructure/configs"
        prune: true
```

--------------------------------

### Initialize and Apply Flux Terraform Module

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/terraform/README.md

Initialize Terraform and apply the configuration to deploy Flux. Ensure the GITHUB_TOKEN environment variable is set.

```shell
terraform init
terraform apply \
  -var oci_token="${GITHUB_TOKEN}" \
  -var cluster_name="staging" \
  -var cluster_region="eu-west-2"
```

--------------------------------

### Bootstrap Flux with Make

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Use this command to bootstrap Flux on a KinD cluster with staging configuration. Ensure your GitHub PAT is exported as an environment variable.

```shell
export GITHUB_TOKEN=<Flux Bot PAT>

make bootstrap-staging
```

--------------------------------

### Bootstrap Flux with Terraform

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Bootstrap Flux using Terraform by initializing the project and applying the configuration with cluster-specific variables. Requires Terraform or OpenTofu.

```shell
cd terraform
terraform init
terraform apply \
  -var oci_token="${GITHUB_TOKEN}" \
  -var cluster_name="staging" \
  -var cluster_region="eu-west-2"
```

--------------------------------

### Create Kubernetes Cluster with Kind

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/terraform/README.md

Use this command to create a Kubernetes cluster named 'flux-staging' for testing.

```shell
kind create cluster --name flux-staging
```

--------------------------------

### FluxInstance for Staging Cluster Bootstrap

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Configures Flux distribution, components, and OCI sync for a staging cluster. Includes Cosign verification for artifact integrity.

```yaml
# clusters/staging/flux-system/flux-instance.yaml
# Staging cluster: syncs from the `latest` OCI tag (main branch commits).
# Cosign verification enforces the artifact was published from push-artifact.yaml on refs/heads/main.
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
spec:
  distribution:
    version: "2.x"
    registry: "ghcr.io/fluxcd"
    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest"
  components:
    - source-controller
    - source-watcher
    - kustomize-controller
    - helm-controller
    - notification-controller
  cluster:
    type: kubernetes
    size: medium
    multitenant: true
    tenantDefaultServiceAccount: flux
    networkPolicy: true
    domain: "cluster.local"
  sync:
    kind: OCIRepository
    url: "oci://ghcr.io/controlplaneio-fluxcd/d2-fleet"
    ref: "latest"          # Use "latest-stable" for production clusters
    path: "clusters/staging"
    pullSecret: "ghcr-auth"
  kustomize:
    patches:
      - target:
          kind: OCIRepository
          name: flux-system
        patch: |
          - op: add
            path: /spec/verify
            value:
              provider: cosign
              matchOIDCIdentity:
              - issuer: ^https://token\.actions\.githubusercontent\.com$
                subject: ^https://github\.com/controlplaneio-fluxcd/d2-fleet/\.github/workflows/push-artifact\.yaml@refs/heads/main$

# Production variant (clusters/prod-eu/flux-instance.yaml):
# - ref: "latest-stable"
# - subject regex: refs/tags/v\d+\.\d+\.\d+$

```

--------------------------------

### Bootstrap Flux using Makefile

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This snippet shows a GitHub Actions workflow step to bootstrap Flux in a staging environment. It requires the GITHUB_TOKEN secret.

```yaml
- name: Bootstrap Flux
  run: make bootstrap-staging
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

--------------------------------

### Bootstrap Image Update Automation Cluster using Makefile

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command bootstraps the cluster for image update automation. It requires the GH_UPDATE_TOKEN environment variable to be set with repository write access.

```shell
# Bootstrap image update automation cluster (requires GH_UPDATE_TOKEN with repo write access)
export GH_UPDATE_TOKEN=<GitHub Token with repo write>
make bootstrap-update
```

--------------------------------

### GitHub Actions: End-to-End Staging Test Workflow

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Condensed configuration for an end-to-end staging test workflow. This workflow spins up KinD clusters, bootstraps Flux, and verifies critical resources reach a 'Ready' status.

```yaml
# .github/workflows/e2e-staging.yaml (condensed)
```

--------------------------------

### Verify Flux Components Running

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/terraform/README.md

Check if the Flux system pods are running in the 'flux-system' namespace after deployment.

```shell
kubectl -n flux-system get pods
```

--------------------------------

### Apply Terraform Bootstrap for Flux Operator

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command initializes Terraform and applies the bootstrap configuration for the Flux Operator. It requires OCI token, cluster name, and cluster region as variables. Ensure you are in the 'terraform' directory.

```shell
# Apply Terraform bootstrap — installs Flux Operator, applies FluxInstance, creates ghcr-auth secret
cd terraform
terraform init
terraform apply \
  -var oci_token="${GITHUB_TOKEN}" \
  -var cluster_name="staging" \
  -var cluster_region="eu-west-2"
```

--------------------------------

### Component Artifact Structure

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Illustrates the directory structure within a component's OCI artifact, including base manifests and environment-specific overlays for production and staging.

```text
.
├── base
│   ├── kustomization.yaml
│   └── helm-release.yaml
├── production
│   ├── kustomization.yaml
│   └── values-patch.yaml
└── staging
    ├── kustomization.yaml
    └── values-patch.yaml
```

--------------------------------

### Define Infra ResourceSet with Tenant Inputs

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ResourceSet defines infrastructure components for multiple tenants, using inputs to parameterize resources like ClusterRoleBindings and Kustomizations.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: infra
  namespace: flux-system
  annotations:
    fluxcd.controlplane.io/reconcileEvery: "5m"
spec:
  dependsOn:
    - apiVersion: fluxcd.controlplane.io/v1
      kind: ResourceSet
      name: policies
      namespace: flux-system
      ready: true
      readyExpr: status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'True')
  inputs:
    - tenant: "cert-manager"
      tag: "${ARTIFACT_TAG}"
      environment: "${ENVIRONMENT}"
      artifactSubjectWorkflow: "${ARTIFACT_SUBJECT_WORKFLOW}"
      artifactSubjectGitRef: "${ARTIFACT_SUBJECT_GIT_REF}"
    - tenant: "monitoring"
      tag: "${ARTIFACT_TAG}"
      environment: "${ENVIRONMENT}"
      artifactSubjectWorkflow: "${ARTIFACT_SUBJECT_WORKFLOW}"
      artifactSubjectGitRef: "${ARTIFACT_SUBJECT_GIT_REF}"
  resources:
    - apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        name: flux-infra-<< inputs.tenant >>
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: cluster-admin             # infra components need cluster-admin
      subjects:
        - kind: ServiceAccount
          name: flux
          namespace: << inputs.tenant >>
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: infra-controllers         # step 1: deploy CRDs and operators
        namespace: << inputs.tenant >>
      spec:
        path: "./controllers/<< inputs.environment >>"
        # ... (sourceRef, interval, postBuild as in apps pattern)
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: infra-configs             # step 2: deploy configs, depends on controllers
        namespace: << inputs.tenant >>
      spec:
        dependsOn:
          - name: infra-controllers
        path: "./configs/<< inputs.environment >>"
        # ...

```

--------------------------------

### Create KinD Cluster for Testing

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command creates a local KinD cluster named 'flux-staging' for testing purposes.

```shell
# Create a local KinD cluster for testing
kind create cluster --name flux-staging
```

--------------------------------

### FluxCD ResourceSet for Tenant Applications

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ResourceSet defines how applications are deployed for different tenants. It uses templating to substitute tenant-specific values and copies runtime information and authentication secrets. Ensure ARTIFACT_TAG, ENVIRONMENT, ARTIFACT_SUBJECT_WORKFLOW, and ARTIFACT_SUBJECT_GIT_REF are substituted at runtime.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: apps
  namespace: flux-system
  annotations:
    fluxcd.controlplane.io/reconcileEvery: "5m"
spec:
  dependsOn:
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      name: infra-configs
      namespace: monitoring
      ready: true
      readyExpr: status.observedGeneration >= 0
  inputs:
    - tenant: "frontend"
      tag: "${ARTIFACT_TAG}"           # substituted from flux-runtime-info
      environment: "${ENVIRONMENT}"
      artifactSubjectWorkflow: "${ARTIFACT_SUBJECT_WORKFLOW}"
      artifactSubjectGitRef: "${ARTIFACT_SUBJECT_GIT_REF}"
    - tenant: "backend"
      tag: "${ARTIFACT_TAG}"
      environment: "${ENVIRONMENT}"
      artifactSubjectWorkflow: "${ARTIFACT_SUBJECT_WORKFLOW}"
      artifactSubjectGitRef: "${ARTIFACT_SUBJECT_GIT_REF}"
  resources:
    - apiVersion: v1
      kind: Namespace
      metadata:
        name: << inputs.tenant >>     # << >> is ResourceSet template syntax
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        name: flux-runtime-info
        namespace: << inputs.tenant >>
        annotations:
          fluxcd.controlplane.io/copyFrom: "flux-system/flux-runtime-info"  # copies runtime info into tenant ns
        labels:
          reconcile.fluxcd.io/watch: Enabled
    - apiVersion: v1
      kind: Secret
      metadata:
        name: ghcr-auth
        namespace: << inputs.tenant >>
        annotations:
          fluxcd.controlplane.io/copyFrom: "flux-system/ghcr-auth"
      type: kubernetes.io/dockerconfigjson
    - apiVersion: source.toolkit.fluxcd.io/v1
      kind: OCIRepository
      metadata:
        name: apps
        namespace: << inputs.tenant >>
      spec:
        interval: 5m
        serviceAccountName: flux
        url: "oci://ghcr.io/controlplaneio-fluxcd/d2-apps/<< inputs.tenant >>"
        ref:
          tag: << inputs.tag >>
        verify:
          provider: cosign
          matchOIDCIdentity:
          - issuer: ^https://token\.actions\.githubusercontent\.com$
            subject: ^https://github\.com/controlplaneio-fluxcd/d2-apps/\.github/workflows/<< inputs.artifactSubjectWorkflow >>\.yaml@<< inputs.artifactSubjectGitRef >>$
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: apps
        namespace: << inputs.tenant >>
      spec:
        targetNamespace: << inputs.tenant >>
        serviceAccountName: flux
        interval: 30m
        retryInterval: 5m
        wait: true
        timeout: 5m
        sourceRef:
          kind: OCIRepository
          name: apps
        path: "./<< inputs.environment >>"   # resolves to ./staging or ./production
        prune: true
        postBuild:
          substituteFrom:
            - kind: ConfigMap
              name: flux-runtime-info
```

--------------------------------

### Push OCI Artifact using Makefile

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command pushes the current repository contents as an OCI artifact. Ensure the GITHUB_TOKEN environment variable is set with your Flux Bot PAT.

```shell
# Push current repository contents as an OCI artifact tagged :latest
export GITHUB_TOKEN=<Flux Bot PAT>
make push
# Runs: flux push artifact oci://ghcr.io/controlplaneio-fluxcd/d2-fleet:latest \
#   --path=./ --source=https://github.com/... --revision="main@sha1:abc1234"
```

--------------------------------

### Watch All Flux Resources Reconcile

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command provides a real-time view of all Flux resources reconciling across all namespaces.

```shell
# Watch all Flux resources reconcile across all namespaces
flux get all -A
```

--------------------------------

### Tagging OCI Artifacts with Flux CLI

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Demonstrates how to use the Flux CLI to update the 'latest-stable' tag for an OCI artifact, useful for rolling back components in production.

```bash
flux tag oci://ghcr.io/controlplaneio-fluxcd/d2-apps/frontend:v1.2.3 --tag latest-stable
```

--------------------------------

### Verify Flux Pods Running

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command checks if the Flux pods are running in the 'flux-system' namespace.

```shell
# Verify Flux pods are running
kubectl -n flux-system get pods
```

--------------------------------

### FluxInstance for Image Update Automation Cluster

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Deploys Flux components for image reflection and automation on a dedicated cluster. This cluster watches OCI registries and commits updated image tags.

```yaml
# clusters/update/flux-system/flux-instance.yaml
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
spec:
  distribution:
    version: "2.x"
    registry: "ghcr.io/fluxcd"
  components:
    - source-controller
    - kustomize-controller
    - image-reflector-controller       # watches container registries for new tags
    - image-automation-controller      # commits updated tags back to Git
  cluster:
    type: kubernetes
    size: medium
    multitenant: true
    tenantDefaultServiceAccount: flux
    networkPolicy: true
    domain: "cluster.local"
  sync:
    kind: OCIRepository
    url: "oci://ghcr.io/controlplaneio-fluxcd/d2-fleet"
    ref: "latest"
    path: "clusters/update"
    pullSecret: "ghcr-auth"
  kustomize:
    patches:
      - target:
          kind: OCIRepository
          name: flux-system
        patch: |
          - op: add
            path: /spec/verify
            value:
              provider: cosign
              matchOIDCIdentity:
              - issuer: ^https://token\.actions\.githubusercontent\.com$
                subject: ^https://github\.com/controlplaneio-fluxcd/d2-fleet/\.github/workflows/push-artifact\.yaml@refs/heads/main$

```

--------------------------------

### Flux Runtime Info ConfigMap

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ConfigMap provides per-cluster runtime variables like artifact tags, environment, and cluster metadata. It's intended for use with `postBuild.substituteFrom` in Flux resources.

```yaml
# clusters/staging/flux-system/runtime-info.yaml
# SSA merge strategy allows Terraform to add extra fields (e.g. CLUSTER_REGION)
# without conflicting with Git-managed fields.
apiVersion: v1
kind: ConfigMap
metadata:
  name: flux-runtime-info
  namespace: flux-system
  labels:
    toolkit.fluxcd.io/runtime: "true"
    reconcile.fluxcd.io/watch: Enabled
  annotations:
    kustomize.toolkit.fluxcd.io/ssa: "Merge"
data:
  ARTIFACT_TAG: latest                    # "latest" staging | "latest-stable" production
  ENVIRONMENT: staging                    # "staging" | "production"
  CLUSTER_NAME: staging-1
  CLUSTER_DOMAIN: preview1.example.com
  ARTIFACT_SUBJECT_WORKFLOW: push-artifact
  ARTIFACT_SUBJECT_GIT_REF: refs/heads/main   # "refs/tags/.*" in production

# Production cluster example (clusters/prod-eu/runtime-info.yaml):
# data:
#   ARTIFACT_TAG: latest-stable
#   ENVIRONMENT: production
#   CLUSTER_NAME: prod-eu-1
#   CLUSTER_DOMAIN: prodeu1.example.com
#   ARTIFACT_SUBJECT_WORKFLOW: release-artifact
#   ARTIFACT_SUBJECT_GIT_REF: refs/tags/.*

```

--------------------------------

### Verify Cluster Reconciliation with kubectl

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This snippet demonstrates a GitHub Actions workflow step to verify cluster reconciliation by waiting for specific Kubernetes resources to become ready. It iterates through a list of resources and uses `kubectl wait`.

```bash
resources=(
  Kustomization/flux-system/flux-system
  ResourceSet/flux-system/infra
  ResourceSet/flux-system/apps
  Kustomization/backend/apps
  Kustomization/frontend/apps
)
for resource in "${resources[@]}"; do
  kind=$(echo $resource | awk -F/ '{print $1}')
  namespace=$(echo $resource | awk -F/ '{print $2}')
  name=$(echo $resource | awk -F/ '{print $3}')
  kubectl -n $namespace wait $kind/$name --for=condition=ready --timeout=5m
done
```

--------------------------------

### Add Component to GitHub Actions Workflow

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Modify the `.github/workflows/push-artifact.yaml` in the `d2-infra` repository to include a new component for OCI Artifact publishing.

```yaml
      ...
      matrix:
        component:
          - cert-manager
          - monitoring
```

--------------------------------

### Local Manifest Validation Script

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Shell script to perform manifest validation locally. Requires yq, kustomize, kubeconform, and curl. Can validate specific directories and exclude others.

```bash
# Run the same validation locally:
# Prerequisites: yq >= 4.50, kustomize >= 5.8, kubeconform >= 0.7, curl
./scripts/validate.sh

# Validate a specific directory, excluding terraform:
./scripts/validate.sh --dir clusters/staging --exclude terraform

# The script:
# 1. Downloads CRD schemas from flux-operator and flux2 releases to /tmp/flux-crd-schemas/ 
# 2. Validates YAML syntax of all *.yaml files
# 3. Validates each manifest against Flux/Kubernetes schemas (skips Secrets for SOPS compatibility)
# 4. Builds each kustomization.yaml overlay and validates the rendered output
```

--------------------------------

### Inspect FluxReport for Sync Status

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This command retrieves the FluxReport in YAML format to inspect detailed synchronization status. The output excerpt shows the applied revision and source details.

```shell
# Inspect FluxReport for detailed sync status
kubectl -n flux-system get fluxreport/flux -o yaml
# Expected output excerpt:
spec:
  sync:
    id: kustomization/flux-system
    path: clusters/staging
    ready: true
    source: oci://ghcr.io/controlplaneio-fluxcd/d2-fleet
    status: 'Applied revision: latest@sha256:b66a51......'
```

--------------------------------

### Add Component Inputs to ResourceSet

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/README.md

Update the `inputs` section for the `infra` `ResourceSet` in the `d2-fleet` repository to include the new component's tenant, tag, and environment.

```yaml
  ...
  inputs:
    - tenant: "cert-manager"
      tag: "${ARTIFACT_TAG}"
      environment: "${ENVIRONMENT}"
    - tenant: "monitoring"
      tag: "${ARTIFACT_TAG}"
      environment: "${ENVIRONMENT}"
```

--------------------------------

### GitHub Actions: OCI Artifact Publishing Workflow

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Workflow to package, sign, and push OCI artifacts to GitHub Container Registry (GHCR). It handles tagging for main branch and release tags, and uses Cosign for signing.

```yaml
name: push-artifact
on:
  push:
    branches: ['main']
    tags: ['*']

jobs:
  flux-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write   # push to GHCR
      id-token: write   # Cosign keyless signing via OIDC
    steps:
      - uses: actions/checkout@v4
      - uses: controlplaneio-fluxcd/distribution/actions/setup@main   # installs flux CLI
      - uses: sigstore/cosign-installer@v4.1.1
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Prepare tags
        id: prep
        run: |
          TAG=latest
          VERSION="${{ github.ref_name }}-${GITHUB_SHA::8}"
          if [[ $GITHUB_REF == refs/tags/* ]]; then
            TAG=latest-stable            # production mutable pointer
            VERSION="${{ github.ref_name }}"   # immutable semver tag, e.g. v1.2.3
          fi
          echo "tag=${TAG}" >> $GITHUB_OUTPUT
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
      - name: Push artifact
        uses: controlplaneio-fluxcd/distribution/actions/push@main
        id: push
        with:
          repository: ghcr.io/${{ github.repository }}
          path: "./"
          diff-tag: ${{ steps.prep.outputs.tag }}     # latest or latest-stable
          tags: ${{ steps.prep.outputs.version }}      # e.g. main-abc1234 or v1.2.3
      - name: Sign artifact
        if: steps.push.outputs.pushed == 'true'
        run: cosign sign --yes $DIGEST_URL
        env:
          DIGEST_URL: ${{ steps.push.outputs.digest-url }}
```

--------------------------------

### GitHub Actions: Manifest Validation Workflow

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Workflow to validate manifests on pull requests and pushes to main. It uses yq, kubeconform, and kustomize actions to check YAML syntax, schema compliance, and rendered output.

```yaml
name: validate
on:
  pull_request:
  push:
    branches: ['main']

jobs:
  manifests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: fluxcd/pkg/actions/yq@main
      - uses: fluxcd/pkg/actions/kubeconform@main
      - uses: fluxcd/pkg/actions/kustomize@main
      - name: Validate manifests
        run: ./scripts/validate.sh
```

--------------------------------

### Define Image Update Automation ResourceSet

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ResourceSet configures FluxCD to automate image updates by scanning repositories and pushing changes to a dedicated branch. It requires a GitRepository source and defines the commit message template.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: image-update-automation
  namespace: flux-system
  annotations:
    fluxcd.controlplane.io/reconcileEvery: "5m"
spec:
  dependsOn:
    - apiVersion: apiextensions.k8s.io/v1
      kind: CustomResourceDefinition
      name: imageupdateautomations.image.toolkit.fluxcd.io
  inputs:
    - namespace: "apps"
      repository: "https://github.com/controlplaneio-fluxcd/d2-apps.git"
      pushBranch: "image-updates"
    - namespace: "infra"
      repository: "https://github.com/controlplaneio-fluxcd/d2-infra.git"
      pushBranch: "image-updates"
  resources:
    - apiVersion: image.toolkit.fluxcd.io/v1
      kind: ImageUpdateAutomation
      metadata:
        name: << inputs.namespace >>
        namespace: << inputs.namespace >>
      spec:
        interval: 30m
        sourceRef:
          kind: GitRepository
          name: << inputs.namespace >>
        git:
          checkout:
            ref:
              branch: main
          commit:
            author:
              email: controlplaneio-fluxcd-bot@users.noreply.github.com
              name: controlplaneio-fluxcd-bot
            messageTemplate: |
              Automated image update

              Files:
              {{ range $filename, $_ := .Changed.FileChanges -}}
              - {{ $filename }}
              {{ end -}}
              Objects:
              {{ range $resource, $changes := .Changed.Objects -}}
              - {{ $resource.Kind }} {{ $resource.Name }}
                Changes:
              {{- range $_, $change := $changes }}
                  - {{ $change.OldValue }} -> {{ $change.NewValue }}
              {{ end -}}
              {{ end -}}
          push:
            branch: << inputs.pushBranch >>    # pushes to "image-updates" branch
        update:
          path: "./components"
          strategy: Setters
```

--------------------------------

### Flux Operator Self-Managed Upgrade ResourceSet

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ResourceSet manages the Flux Operator's HelmRelease for self-upgrading via GitOps. It depends on the HelmRelease CRD and sources the chart from a Cosign-verified OCI repository.

```yaml
# clusters/staging/flux-system/flux-operator.yaml
apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: flux-operator
  namespace: flux-system
spec:
  dependsOn:
    - apiVersion: apiextensions.k8s.io/v1
      kind: CustomResourceDefinition
      name: helmreleases.helm.toolkit.fluxcd.io
  resources:
    - apiVersion: source.toolkit.fluxcd.io/v1
      kind: OCIRepository
      metadata:
        name: flux-operator
        namespace: flux-system
      spec:
        interval: 10m
        url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
        ref:
          semver: '*'
        verify:
          provider: cosign
          matchOIDCIdentity:
          - issuer: ^https://token\.actions\.githubusercontent\.com$
            subject: ^https://github\.com/controlplaneio-fluxcd/charts/\.github/workflows/release\.yml@refs/tags/v\d+\.\d+\.\d+$
    - apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
        name: flux-operator
        namespace: flux-system
      spec:
        interval: 30m
        releaseName: flux-operator
        serviceAccountName: flux-operator
        chartRef:
          kind: OCIRepository
          name: flux-operator
        install:
          strategy:
            name: RetryOnFailure
            retryInterval: 3m
        upgrade:
          force: true
          strategy:
            name: RetryOnFailure
            retryInterval: 3m
        valuesFrom:
          - kind: ConfigMap
            name: flux-operator-values
            valuesKey: values.yaml

```

--------------------------------

### Flux Operator Bootstrap Configuration

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

Terraform module configuration for bootstrapping the Flux operator. It defines gitops resources and managed secrets, including authentication for container registries.

```hcl
module "flux_operator_bootstrap" {
  source = "controlplaneio-fluxcd/flux-operator-bootstrap/kubernetes"

  revision = var.bootstrap_revision   # bump to re-trigger bootstrap

  gitops_resources = {
    instance_yaml = file("${path.root}/../clusters/${var.cluster_name}/flux-system/flux-instance.yaml")
    operator_chart = {
      values_yaml = file("${path.root}/../clusters/${var.cluster_name}/flux-system/flux-operator-values.yaml")
    }
  }

  managed_resources = {
    secrets_yaml = <<-YAML
      apiVersion: v1
      kind: Secret
      metadata:
        name: ghcr-auth
      type: kubernetes.io/dockerconfigjson
      stringData:
        .dockerconfigjson: '${replace(local.ghcr_auth_dockerconfigjson, "'", "''")}'
    YAML
    runtime_info = {
      data = {
        CLUSTER_REGION = var.cluster_region   # added via SSA, merges with Git-managed fields
      }
    }
  }
}
```

--------------------------------

### Check Flux Instance Sync Status

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/terraform/README.md

Monitor the overall sync status of the Flux instance across all namespaces.

```shell
flux get all -A
```

--------------------------------

### Define Policy ResourceSet for Source Allowlisting

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ResourceSet configures a ValidatingAdmissionPolicy to restrict Flux source creation to an allowlist of trusted registries. It includes a ConfigMap for the allowlist and the policy definitions.

```yaml
# tenants/policies.yaml
apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: policies
  namespace: flux-system
  annotations:
    fluxcd.controlplane.io/reconcileEvery: "5m"
spec:
  resources:
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        name: flux-allowlist
        namespace: flux-system
        labels:
          fluxcd.controlplane.io/role: "policy"
      data:
        sources: >-
          https://github.com/controlplaneio-fluxcd/
          oci://ghcr.io/controlplaneio-fluxcd/
          oci://ghcr.io/stefanprodan/charts/
          oci://registry-1.docker.io/bitnamicharts/
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingAdmissionPolicy
      metadata:
        name: "source.policy.fluxcd.controlplane.io"
      spec:
        failurePolicy: Fail
        matchConstraints:
          resourceRules:
            - apiGroups: ["source.toolkit.fluxcd.io"]
              apiVersions: ["*"]
              operations: ["CREATE", "UPDATE"]
              resources: ["gitrepositories", "ocirepositories", "helmrepositories"]
        matchConditions:
          - name: "exclude-source-controller-finalizer"
            expression: >
              request.userInfo.username != "system:serviceaccount:flux-system:source-controller"
        paramKind:
          apiVersion: v1
          kind: ConfigMap
        variables:
          - name: url
            expression: object.spec.url
          - name: sources
            expression: params.data.sources.split(' ')
        validations:
          - expression: >
              variables.sources.exists_one(prefix, variables.url.startsWith(prefix))
            messageExpression: >
              "Source " + variables.url + " is not allowed, must be one of " + variables.sources.join(", ")
            reason: Invalid
    - apiVersion: admissionregistration.k8s.io/v1
      kind: ValidatingAdmissionPolicyBinding
      metadata:
        name: flux-tenant-sources
      spec:
        policyName: "source.policy.fluxcd.controlplane.io"
        validationActions: ["Deny"]
        paramRef:
          name: flux-allowlist
          namespace: flux-system
          parameterNotFoundAction: "Deny"
        matchResources:
          namespaceSelector:
            matchExpressions:
              - key: toolkit.fluxcd.io/role
                operator: In
                values: [tenant]

```

--------------------------------

### Inspect Flux Report for Sync Status

Source: https://github.com/controlplaneio-fluxcd/d2-fleet/blob/main/terraform/README.md

Examine the Flux report in YAML format to confirm the sync status and applied revision.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: FluxReport
metadata:
  name: flux
  namespace: flux-system
spec:
  # Distribution status omitted for brevity
  sync:
    id: kustomization/flux-system
    path: clusters/staging
    ready: true
    source: oci://ghcr.io/controlplaneio-fluxcd/d2-fleet
    status: 'Applied revision: latest@sha256:b66a51......'
```

--------------------------------

### Flux Operator Helm Values ConfigMap

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This ConfigMap injects Flux Operator Helm chart values, enabling multi-tenancy and configuring the reporting interval. It is generated by Kustomize.

```yaml
# clusters/staging/flux-system/flux-operator-values.yaml (used as values.yaml)
multitenancy:
  enabled: true
  defaultServiceAccount: flux-operator
reporting:
  interval: 45s

# clusters/staging/flux-system/kustomization.yaml — how the ConfigMap is generated:
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - flux-instance.yaml
  - flux-operator.yaml
  - runtime-info.yaml
configMapGenerator:
  - name: flux-operator-values
    namespace: flux-system
    files:
      - values.yaml=flux-operator-values.yaml
generatorOptions:
  disableNameSuffixHash: true
  labels:
    reconcile.fluxcd.io/watch: Enabled

```

--------------------------------

### Flux Operator Bootstrap Module Configuration

Source: https://context7.com/controlplaneio-fluxcd/d2-fleet/llms.txt

This HCL block defines the configuration for the flux-operator-bootstrap Terraform module, specifying variables for OCI token, cluster name, and cluster region.

```hcl
variable "oci_token" {
  type    = string
  default = ""
}

variable "cluster_name" {
  type    = string
  default = ""
}

variable "cluster_region" {
  type    = string
  default = ""
}

module "flux-operator-bootstrap" {
  source = "oci://ghcr.io/controlplaneio-fluxcd/terraform/modules/flux-operator-bootstrap/kubernetes"

  cluster_name   = var.cluster_name
  cluster_region = var.cluster_region
  oci_token      = var.oci_token
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.