Kustomization

Justfile

@@ -20,10 +20,6 @@ go-run-migrate cmd="up":
     DB_PORT={{db_port}} DB_HOST={{db_host}} SERVER_PORT={{server_port}} \
     go run ./cmd/migrate {{cmd}}
 
-# Run go generate for all packages
-go-gen:
-    go generate ./...
-
 # Run docker compose build
 build:
     @docker compose build
@@ -47,6 +43,10 @@ lint:
 test:
     go test -v -race ./...
 
+# Run go generate for all packages
+gen:
+    go generate ./...
+
 # Generate openapi v3 specification using swag v2
 gen-openapi:
     swag init -g cmd/app/main.go -o . -ot yaml --v3.1 --parseDependency && mv swagger.yaml openapi-v3.yml

README.md

@@ -32,6 +32,7 @@ $ just
     down                    # Run docker compose down
     lint                    # Run lints using gofumpt, go vet, staticcheck and govulncheck
     test                    # Run tests
+    gen                     # Run go generate for all packages
     gen-openapi             # Generate openapi v3 specification using swag v2
     gen-gorm-repos          # Generate gorm repositories using gorm cli
 ```
@@ -145,3 +146,32 @@ app-1  | {"level":"info","request_id":"d5mqjmhqvtmc73foh3dg","received_time":"20
 │
 └── pkg (middleware, logger, validator, ctxutil, paramsutil, errors)
 ```
+
+ArgoCD and `kustomization` based cloud native IaC & GitOps setup.
+
+```shell
+└── k8s
+    │
+    ├── bootstrap
+    │   ├── argocd
+    │   └── argocd-config
+    │       ├── applications
+    │       ├── clusters
+    │       └── projects
+    │
+    ├── platform
+    │   ├── cloudnative-pg
+    │   ├── gateway-api
+    │   ├── istio-ambient
+    │   └── metrics-server
+    │
+    ├── components
+    │   └── myapp-db
+    └── services
+        ├── base
+        │   └── myapp
+        └── overlays
+            ├── dev
+            ├── prod
+            └── stage
+```

k8s/bootstrap/argocd-config/applications/kustomization.yaml

@@ -3,7 +3,8 @@ kind: Kustomization
 
 resources:
   - platform-apps.yaml
+  - platform-cloudnative-pg.yaml
   - myapp-apps.yaml
 
 commonAnnotations:
-  argocd.argoproj.io/sync-wave: "2"
+  argocd.argoproj.io/sync-wave: '2'

k8s/bootstrap/argocd-config/applications/myapp-apps.yaml

@@ -1,29 +1,28 @@
 apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
+
 metadata:
   name: myapp
   namespace: argocd
+
 spec:
   generators:
     - list:
         elements:
           - env: dev
             cluster: hub-sg-01
-          - env: stage
-            cluster: hub-sg-01
-          - env: prod
-            cluster: hub-sg-01
+            server: https://kubernetes.default.svc
   template:
     metadata:
       name: '{{env}}-myapp'
       annotations:
-        argocd.argoproj.io/sync-wave: "5"
+        argocd.argoproj.io/sync-wave: '5'
     spec:
       project: myapp
       source:
-        repoURL: "https://github.com/learning-cloud-native-go/myapp.git"
+        repoURL: https://github.com/learning-cloud-native-go/myapp.git
         targetRevision: HEAD
-        path: k8s/services/overlays/{{env}}/myapp
+        path: 'k8s/services/overlays/{{env}}/myapp'
       destination:
         name: '{{cluster}}'
         namespace: '{{env}}-myapp'
@@ -32,4 +31,5 @@ spec:
           prune: true
           selfHeal: true
         syncOptions:
-          - CreateNamespace=true
+          - CreateNamespace=true
+          - ServerSideApply=true

k8s/bootstrap/argocd-config/applications/platform-apps.yaml

@@ -1,42 +1,42 @@
 apiVersion: argoproj.io/v1alpha1
 kind: ApplicationSet
+
 metadata:
   name: platform-apps
   namespace: argocd
+
 spec:
   generators:
-    - matrix:
-        generators:
-          - list:
-              elements:
-                - cluster: hub-sg-01
-                  url: https://kubernetes.default.svc
-          - git:
-              repoURL: "https://github.com/learning-cloud-native-go/myapp.git"
-              revision: HEAD
-              directories:
-                - path: k8s/platform/metrics-server
-                - path: k8s/platform/gateway-api
-                - path: k8s/platform/istio-ambient
+    - list:
+        elements:
+          - cluster: hub-sg-01
+            path: k8s/platform/metrics-server
+            targetNamespace: kube-system
+          - cluster: hub-sg-01
+            path: k8s/platform/gateway-api
+            targetNamespace: kube-system
+          - cluster: hub-sg-01
+            path: k8s/platform/istio-ambient
+            targetNamespace: istio-system
   template:
     metadata:
       name: '{{cluster}}-{{path.basename}}'
     spec:
       project: platform
       source:
-        repoURL: "https://github.com/learning-cloud-native-go/myapp.git"
+        repoURL: https://github.com/learning-cloud-native-go/myapp.git
         targetRevision: HEAD
         path: '{{path}}'
         kustomize:
           commonLabels:
             managed-by: argocd-appset
       destination:
         name: '{{cluster}}'
-        namespace: '{{if eq .path.basename "istio-ambient"}}istio-system{{else}}kube-system{{end}}'
+        namespace: '{{targetNamespace}}'
       syncPolicy:
         automated:
           prune: true
           selfHeal: true
         syncOptions:
           - CreateNamespace=true
-          - ServerSideApply=true
+          - ServerSideApply=true

k8s/bootstrap/argocd-config/applications/platform-cloudnative-pg.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+
+metadata:
+  name: platform-operators
+  namespace: argocd
+
+spec:
+  generators:
+    - list:
+        elements:
+          - cluster: hub-sg-01
+  template:
+    metadata:
+      name: '{{cluster}}-cloudnative-pg'
+    spec:
+      project: platform
+      source:
+        repoURL: https://github.com/learning-cloud-native-go/myapp.git
+        targetRevision: HEAD
+        path: k8s/platform/cloudnative-pg
+        kustomize:
+          commonLabels:
+            managed-by: argocd-platform
+      destination:
+        name: '{{cluster}}'
+        namespace: cnpg-system
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - ServerSideApply=true
+          - Force=true
+          - CreateNamespace=true

k8s/bootstrap/argocd-config/clusters/hub-sg-01.yaml

@@ -1,12 +1,14 @@
 apiVersion: v1
 kind: Secret
+
 metadata:
   name: hub-sg-01
   namespace: argocd
   labels:
     argocd.argoproj.io/secret-type: cluster
+
 type: Opaque
 stringData:
-  name: "hub-sg-01"
-  server: "https://kubernetes.default.svc"
-  config: '{"tlsClientConfig":{"insecure":true}}'
+  name: 'hub-sg-01'
+  server: 'https://kubernetes.default.svc'
+  config: '{"tlsClientConfig":{"insecure":true}}'

k8s/bootstrap/argocd-config/clusters/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - hub-sg-01.yaml
+  - hub-sg-01.yaml

k8s/bootstrap/argocd-config/kustomization.yaml

@@ -7,4 +7,4 @@ resources:
   - applications/
 
 commonAnnotations:
-  argocd.argoproj.io/sync-wave: "2"
+  argocd.argoproj.io/sync-wave: '2'

k8s/bootstrap/argocd-config/projects/kustomization.yaml

@@ -6,4 +6,4 @@ resources:
   - myapp.yaml
 
 commonAnnotations:
-  argocd.argoproj.io/sync-wave: "1"
+  argocd.argoproj.io/sync-wave: '1'

k8s/bootstrap/argocd-config/projects/myapp.yaml

@@ -1,15 +1,57 @@
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
+
 metadata:
   name: myapp
   namespace: argocd
+
 spec:
-  description: "Governance for myapp services"
+  description: Governance for myapp services
   sourceRepos:
-    - "https://github.com/learning-cloud-native-go/myapp.git"
+    - https://github.com/learning-cloud-native-go/myapp.git
   destinations:
-    - namespace: 'myapp-*'
+    - namespace: '*-myapp'
       server: https://kubernetes.default.svc
+
   clusterResourceWhitelist:
     - group: ''
-      kind: Namespace
+      kind: Namespace
+
+  namespaceResourceWhitelist:
+    - group: ''
+      kind: ConfigMap
+    - group: ''
+      kind: Secret
+    - group: ''
+      kind: Service
+    - group: apps
+      kind: Deployment
+    - group: batch
+      kind: Job
+    - group: postgresql.cnpg.io
+      kind: Cluster
+
+  roles:
+    - name: platform-admin
+      description: Platform Team; Full lifecycle management of myapp project and apps
+      policies:
+        - p, proj:myapp:platform-admin, applications, *, myapp/*, allow
+      groups:
+        - platform-team
+
+    - name: myapp-lead
+      description: Team Lead; Sync and modify myapp apps (without delete)
+      policies:
+        - p, proj:myapp:myapp-lead, applications, get, myapp/*, allow
+        - p, proj:myapp:myapp-lead, applications, sync, myapp/*, allow
+        - p, proj:myapp:myapp-lead, applications, update, myapp/*, allow
+      groups:
+        - myapp-team-leads
+
+    - name: myapp-dev
+      description: Dev; Read state and logs of myapp apps
+      policies:
+        - p, proj:myapp:myapp-dev, applications, get, myapp/*, allow
+        - p, proj:myapp:myapp-dev, logs, get, myapp/*, allow
+      groups:
+        - myapp-team-devs

k8s/bootstrap/argocd-config/projects/platform.yaml

@@ -1,26 +1,32 @@
 apiVersion: argoproj.io/v1alpha1
 kind: AppProject
+
 metadata:
   name: platform
   namespace: argocd
-spec:
-  description: "Governance for Cluster Infrastructure"
 
+spec:
+  description: Governance for Cluster Infrastructure
   sourceRepos:
-    - "https://github.com/learning-cloud-native-go/myapp.git"
+    - https://github.com/learning-cloud-native-go/myapp.git
 
   destinations:
-    - namespace: 'istio-system'
-      server: https://kubernetes.default.svc
-    - namespace: 'kube-system'
-      server: https://kubernetes.default.svc
+    - name: hub-sg-01
+      namespace: kube-system
+    - name: hub-sg-01
+      namespace: istio-system
+    - name: hub-sg-01
+      namespace: cnpg-system
+    - name: hub-sg-01
+      namespace: default
 
-  # Allow creation of Cluster-wide resources
   clusterResourceWhitelist:
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
     - group: '*'
       kind: '*'
 
   # Allow any namespaced resource within the allowed destinations
   namespaceResourceWhitelist:
     - group: '*'
-      kind: '*'
+      kind: '*'

k8s/bootstrap/argocd/kustomization.yaml

@@ -10,8 +10,8 @@ secretGenerator:
   - name: argocd-secret
     behavior: merge
     literals:
-      - admin.password="$2y$10$pE/ig.utdh6NtQazu0BV7.inP8OhnBoPldZQO.suoXUaNJw479Gw."
-      - admin.passwordMtime="2026-01-22T00:00:00Z"
+      - admin.password='$2y$10$pE/ig.utdh6NtQazu0BV7.inP8OhnBoPldZQO.suoXUaNJw479Gw.'
+      - admin.passwordMtime='2026-01-22T00:00:00Z'
 
 commonAnnotations:
-  argocd.argoproj.io/sync-wave: "1"
+  argocd.argoproj.io/sync-wave: '1'

k8s/bootstrap/argocd/namespace.yaml

@@ -1,4 +1,5 @@
 apiVersion: v1
 kind: Namespace
+
 metadata:
-  name: argocd
+  name: argocd

k8s/bootstrap/kustomization.yaml

@@ -3,4 +3,4 @@ kind: Kustomization
 
 resources:
   - argocd/
-  - argocd-config/
+  - argocd-config/

k8s/components/myapp-db/cluster.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+
+metadata:
+  name: myapp-db
+
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.1
+  instances: 3
+  storage:
+    size: 1Gi