From fc53e16dd49c8c87ab5c9524a698662d28409918 Mon Sep 17 00:00:00 2001 From: swaphb Date: Sat, 15 Aug 2026 13:17:46 -0400 Subject: [PATCH] organize deployment configuration --- README.md | 16 ++++++++++++++++ {argocd => deployments/argocd}/README.md | 6 +++--- {argocd => deployments/argocd}/app-of-apps.yaml | 2 +- {argocd => deployments/argocd}/apps/falco.yaml | 4 ++-- {argocd => deployments/argocd}/apps/kyverno.yaml | 2 -- .../argocd}/apps/policies.yaml | 0 .../argocd}/apps/test-workloads.yaml | 0 .../argocd}/optional-apps/cilium.yaml | 3 +-- .../cilium}/cilium-values.yaml | 0 .../falco}/falco-operator-values.yaml | 2 +- .../operator-resources/container-plugin.yaml | 0 .../falco}/operator-resources/custom-rules.yaml | 0 .../operator-resources/custom-rulesfile.yaml | 0 .../falco}/operator-resources/falco-config.yaml | 0 .../operator-resources/falco-instance.yaml | 0 .../falco}/operator-resources/kustomization.yaml | 0 .../falco}/operator-resources/namespace.yaml | 0 local-quickstart/cilium.md | 4 ++-- 18 files changed, 26 insertions(+), 13 deletions(-) rename {argocd => deployments/argocd}/README.md (86%) rename {argocd => deployments/argocd}/app-of-apps.yaml (94%) rename {argocd => deployments/argocd}/apps/falco.yaml (88%) rename {argocd => deployments/argocd}/apps/kyverno.yaml (83%) rename {argocd => deployments/argocd}/apps/policies.yaml (100%) rename {argocd => deployments/argocd}/apps/test-workloads.yaml (100%) rename {argocd => deployments/argocd}/optional-apps/cilium.yaml (91%) rename {cilium => deployments/cilium}/cilium-values.yaml (100%) rename {falco => deployments/falco}/falco-operator-values.yaml (88%) rename {falco => deployments/falco}/operator-resources/container-plugin.yaml (100%) rename {falco => deployments/falco}/operator-resources/custom-rules.yaml (100%) rename {falco => deployments/falco}/operator-resources/custom-rulesfile.yaml (100%) rename {falco => deployments/falco}/operator-resources/falco-config.yaml (100%) rename {falco => deployments/falco}/operator-resources/falco-instance.yaml (100%) rename {falco => deployments/falco}/operator-resources/kustomization.yaml (100%) rename {falco => deployments/falco}/operator-resources/namespace.yaml (100%) diff --git a/README.md b/README.md index 2dafe4a..0bf4b29 100644 --- a/README.md +++ b/README.md @@ -5,6 +5,22 @@ fast reproducible demo, optional Flatcar plus Terraform and Ansible for a cloud K3s host, Cilium eBPF networking, CIS Benchmark checks in CI, Kyverno admission policies, and Falco runtime detection. +## Repository layout + +Deployment and GitOps configuration is grouped under `deployments/`: + +```text +deployments/ +├── argocd/ # app-of-apps and child Application definitions +├── cilium/ # Cilium Helm values for the optional kube-proxy-free path +└── falco/ # Falco Operator values and custom resource definitions +``` + +The platform payloads remain separate from their deployment definitions. Kyverno +policies live under `policies/`, runtime demonstration workloads live under +`test-workloads/`, and cluster provisioning code remains under `terraform/`, +`ansible/`, and `local-quickstart/`. + ## Phase 1: provision a local cluster The primary quick-start path requires Docker, k3d, and kubectl: diff --git a/argocd/README.md b/deployments/argocd/README.md similarity index 86% rename from argocd/README.md rename to deployments/argocd/README.md index 70da6f5..13ae81d 100644 --- a/argocd/README.md +++ b/deployments/argocd/README.md @@ -2,7 +2,7 @@ ArgoCD is installed once into the local cluster; everything after that is declared through the root Application. The root uses the app-of-apps pattern: -it watches `argocd/apps/`, and each child Application owns one platform or +it watches `deployments/argocd/apps/`, and each child Application owns one platform or workload boundary. ## Bootstrap @@ -16,7 +16,7 @@ workload boundary. kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f - kubectl apply --server-side --force-conflicts -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml kubectl -n argocd rollout status deployment/argocd-server --timeout=180s -kubectl apply -f argocd/app-of-apps.yaml +kubectl apply -f deployments/argocd/app-of-apps.yaml kubectl get applications -n argocd -w ``` @@ -37,5 +37,5 @@ should replace this with SSO/RBAC and remove the bootstrap credential. For a kube-proxy-free Cilium cluster, install Cilium before ArgoCD using the profile in `local-quickstart/cilium.md` or the Flatcar cloud bootstrap. The -Cilium Application is stored under `argocd/optional-apps/` and is not watched +Cilium Application is stored under `deployments/argocd/optional-apps/` and is not watched by the default root app until the cluster is ready for it. diff --git a/argocd/app-of-apps.yaml b/deployments/argocd/app-of-apps.yaml similarity index 94% rename from argocd/app-of-apps.yaml rename to deployments/argocd/app-of-apps.yaml index 3809716..04a7b74 100644 --- a/argocd/app-of-apps.yaml +++ b/deployments/argocd/app-of-apps.yaml @@ -11,7 +11,7 @@ spec: # Replace the owner after publishing this repository. repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git targetRevision: main - path: argocd/apps + path: deployments/argocd/apps destination: server: https://kubernetes.default.svc namespace: argocd diff --git a/argocd/apps/falco.yaml b/deployments/argocd/apps/falco.yaml similarity index 88% rename from argocd/apps/falco.yaml rename to deployments/argocd/apps/falco.yaml index e42ec5b..b2e12ab 100644 --- a/argocd/apps/falco.yaml +++ b/deployments/argocd/apps/falco.yaml @@ -14,13 +14,13 @@ spec: targetRevision: 0.3.1 helm: valueFiles: - - $values/falco/falco-operator-values.yaml + - $values/deployments/falco/falco-operator-values.yaml - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git targetRevision: main ref: values - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git targetRevision: main - path: falco/operator-resources + path: deployments/falco/operator-resources destination: server: https://kubernetes.default.svc namespace: falco-operator diff --git a/argocd/apps/kyverno.yaml b/deployments/argocd/apps/kyverno.yaml similarity index 83% rename from argocd/apps/kyverno.yaml rename to deployments/argocd/apps/kyverno.yaml index 7421fbd..61b0f62 100644 --- a/argocd/apps/kyverno.yaml +++ b/deployments/argocd/apps/kyverno.yaml @@ -10,8 +10,6 @@ spec: source: repoURL: https://kyverno.github.io/kyverno/ chart: kyverno - # Chart 3.8.2 removes the deprecated bitnami/kubectl hook image used by - # the older chart and deploys Kyverno app version 1.18.2. targetRevision: 3.8.2 helm: values: | diff --git a/argocd/apps/policies.yaml b/deployments/argocd/apps/policies.yaml similarity index 100% rename from argocd/apps/policies.yaml rename to deployments/argocd/apps/policies.yaml diff --git a/argocd/apps/test-workloads.yaml b/deployments/argocd/apps/test-workloads.yaml similarity index 100% rename from argocd/apps/test-workloads.yaml rename to deployments/argocd/apps/test-workloads.yaml diff --git a/argocd/optional-apps/cilium.yaml b/deployments/argocd/optional-apps/cilium.yaml similarity index 91% rename from argocd/optional-apps/cilium.yaml rename to deployments/argocd/optional-apps/cilium.yaml index e0314c2..516a3d7 100644 --- a/argocd/optional-apps/cilium.yaml +++ b/deployments/argocd/optional-apps/cilium.yaml @@ -13,7 +13,7 @@ spec: targetRevision: 1.20.0 helm: valueFiles: - - $values/cilium/cilium-values.yaml + - $values/deployments/cilium/cilium-values.yaml - repoURL: https://git.swaphb.com/swaphb/kubernetes-security-baseline-lab.git targetRevision: main ref: values @@ -22,4 +22,3 @@ spec: namespace: kube-system # Apply this Application manually only after bootstrapping a kube-proxy-free # cluster and replacing the API endpoint placeholder. - diff --git a/cilium/cilium-values.yaml b/deployments/cilium/cilium-values.yaml similarity index 100% rename from cilium/cilium-values.yaml rename to deployments/cilium/cilium-values.yaml diff --git a/falco/falco-operator-values.yaml b/deployments/falco/falco-operator-values.yaml similarity index 88% rename from falco/falco-operator-values.yaml rename to deployments/falco/falco-operator-values.yaml index 3c8f3d9..bc46039 100644 --- a/falco/falco-operator-values.yaml +++ b/deployments/falco/falco-operator-values.yaml @@ -1,5 +1,5 @@ # Falco Operator settings. Falco instances and their artifacts are managed by -# the CRs under falco/operator-resources. +# the CRs under deployments/falco/operator-resources. replicaCount: 1 # Keep ArgoCD tracking labels on the operator itself, not on resources created diff --git a/falco/operator-resources/container-plugin.yaml b/deployments/falco/operator-resources/container-plugin.yaml similarity index 100% rename from falco/operator-resources/container-plugin.yaml rename to deployments/falco/operator-resources/container-plugin.yaml diff --git a/falco/operator-resources/custom-rules.yaml b/deployments/falco/operator-resources/custom-rules.yaml similarity index 100% rename from falco/operator-resources/custom-rules.yaml rename to deployments/falco/operator-resources/custom-rules.yaml diff --git a/falco/operator-resources/custom-rulesfile.yaml b/deployments/falco/operator-resources/custom-rulesfile.yaml similarity index 100% rename from falco/operator-resources/custom-rulesfile.yaml rename to deployments/falco/operator-resources/custom-rulesfile.yaml diff --git a/falco/operator-resources/falco-config.yaml b/deployments/falco/operator-resources/falco-config.yaml similarity index 100% rename from falco/operator-resources/falco-config.yaml rename to deployments/falco/operator-resources/falco-config.yaml diff --git a/falco/operator-resources/falco-instance.yaml b/deployments/falco/operator-resources/falco-instance.yaml similarity index 100% rename from falco/operator-resources/falco-instance.yaml rename to deployments/falco/operator-resources/falco-instance.yaml diff --git a/falco/operator-resources/kustomization.yaml b/deployments/falco/operator-resources/kustomization.yaml similarity index 100% rename from falco/operator-resources/kustomization.yaml rename to deployments/falco/operator-resources/kustomization.yaml diff --git a/falco/operator-resources/namespace.yaml b/deployments/falco/operator-resources/namespace.yaml similarity index 100% rename from falco/operator-resources/namespace.yaml rename to deployments/falco/operator-resources/namespace.yaml diff --git a/local-quickstart/cilium.md b/local-quickstart/cilium.md index bc8244c..224b514 100644 --- a/local-quickstart/cilium.md +++ b/local-quickstart/cilium.md @@ -16,7 +16,7 @@ Kubernetes service VIP because kube-proxy is disabled during bootstrap. ```bash kubectl config current-context kubectl get nodes -o wide -cp cilium/cilium-values.yaml /tmp/cilium-values.yaml +cp deployments/cilium/cilium-values.yaml /tmp/cilium-values.yaml # Replace REPLACE_WITH_API_SERVER_DNS_OR_PRIVATE_IP with the reachable API endpoint. helm repo add cilium https://helm.cilium.io/ helm repo update @@ -29,7 +29,7 @@ kubectl -n kube-system get pods -l k8s-app=cilium ``` Install ArgoCD only after Cilium is Ready. Apply -`argocd/optional-apps/cilium.yaml` manually after the endpoint is configured; +`deployments/argocd/optional-apps/cilium.yaml` manually after the endpoint is configured; it is intentionally outside the root app-of-apps watched directory until the cluster has been bootstrapped without kube-proxy.