GitOps với Flux: Hạ tầng khai báo và CD cho Kubernetes

                  Git Repository (GitHub / GitLab)
                                │
                                ▼ (Pulls Git commit / tag / branch)
                     [ source-controller ]
                                │
         ┌──────────────────────┴──────────────────────┐
         ▼ (Raw manifests & Kustomize)                 ▼ (Helm Charts)
[ kustomize-controller ]                      [ helm-controller ]
         │                                             │
         ▼ (Applies with Prune & Health Checks)        ▼ (Executes Helm engine)
   Kubernetes API                                Kubernetes API
         ▲                                             ▲
         └──────────────────────┬──────────────────────┘
                                │ (Watches OCI Registry & commits new tags to Git)
                 [ image-automation-controller ]

fleet-infra/
├── clusters/
│   ├── staging/
│   │   ├── flux-system/        # Bootstrap manifests
│   │   ├── infrastructure.yaml # Reconciles /infrastructure/staging
│   │   └── apps.yaml           # Reconciles /apps/staging
│   └── production/
│       ├── flux-system/
│       ├── infrastructure.yaml
│       └── apps.yaml
├── infrastructure/
│   ├── base/
│   │   ├── ingress-nginx/
│   │   └── cert-manager/
│   └── staging/
│       └── kustomization.yaml
└── apps/
    ├── base/
    │   └── payments-api/
    └── staging/
        ├── kustomization.yaml
        └── patch-replicas.yaml

# clusters/staging/fleet-source.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: fleet-infra
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/my-org/fleet-infra.git
  ref:
    branch: main
  secretRef:
    name: github-deploy-token
  ignore: |
    # Exclude non-manifest directories from checksums
    /*
    !/apps
    !/infrastructure

# clusters/staging/apps.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: staging-apps
  namespace: flux-system
spec:
  interval: 5m
  path: ./apps/staging
  prune: true               # Automatically deletes removed k8s resources
  wait: true                # Blocks until all Pods pass readiness probes
  timeout: 3m
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  dependsOn:
    - name: staging-infrastructure  # Ensures ingress/CRDs exist before apps deploy
  postBuild:
    substitute:
      ENVIRONMENT: "staging"
      CLUSTER_DOMAIN: "stage.internal.net"

# infrastructure/base/ingress-nginx/helm-release.yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: ingress-nginx
  namespace: flux-system
spec:
  interval: 2h
  url: https://kubernetes.github.io/ingress-nginx
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: ingress-nginx
  namespace: ingress-nginx
spec:
  interval: 15m
  chart:
    spec:
      chart: ingress-nginx
      version: "4.11.x"
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  driftDetection:
    mode: enabled          # Automatically reverts manual edits back to chart values
  values:
    controller:
      replicaCount: 3
      resources:
        requests:
          cpu: 100m
          memory: 128Mi

# Generate age private key for the cluster
age-keygen -o age.agekey

# Create in-cluster secret with the private key
kubectl create secret generic sops-age \
  --namespace=flux-system \
  --from-file=age.agekey

# Encrypt local Kubernetes secret
sops --encrypt --age $(cat age.agekey | grep public | cut -d: -f2 | xargs) \
  --encrypted-regex '^(data|stringData)$' \
  secret.yaml > apps/staging/secret.enc.yaml

# In apps/staging/kustomization.yaml or root Kustomization CRD
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: staging-secrets
  namespace: flux-system
spec:
  interval: 10m
  path: ./apps/staging
  prune: true
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  decryption:
    provider: sops
    secretRef:
      name: sops-age        # Matches private key stored in flux-system

# apps/base/payments-api/image-policy.yaml
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageRepository
metadata:
  name: payments-api
  namespace: flux-system
spec:
  image: ghcr.io/my-org/payments-api
  interval: 1m
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata:
  name: payments-api
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: payments-api
  policy:
    semver:
      range: '^1.x'        # Auto-promotes minor and patch versions
---
apiVersion: image.toolkit.fluxcd.io/v1beta1
kind: ImageUpdateAutomation
metadata:
  name: flux-system
  namespace: flux-system
spec:
  interval: 1m
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        email: fluxcdbot@users.noreply.github.com
        name: fluxcdbot
      messageTemplate: 'chore(cd): update payments-api to {{range .Updated.Images}}{{println .}}{{end}}'
    push:
      branch: main
  update:
    path: ./apps/staging
    strategy: Setters

spec:
  template:
    spec:
      containers:
        - name: api
          image: ghcr.io/my-org/payments-api:1.4.2 # {"$imagepolicy": "flux-system:payments-api"}