apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kyverno
  namespace: kyverno
spec:
  interval: 1h
  chart:
    spec:
      chart: kyverno
      version: "3.3.x"
      sourceRef:
        kind: HelmRepository
        name: kyverno
        namespace: flux-system
  install:
    crds: CreateReplace
  valuesFrom:
    - kind: ConfigMap
      name: kyverno-values
    - kind: ConfigMap
      name: kyverno-values-env
      optional: true
  values:
    admissionController:
      replicas: 3

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: kyverno-policies
  namespace: flux-system
spec:
  interval: 10m
  dependsOn:
    - name: kyverno
  sourceRef:
    kind: OCIRepository
    name: d2-infra
  path: "./components/kyverno/policies"
  prune: true
  wait: true

apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: apps
  namespace: flux-system
spec:
  dependsOn:
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      name: infra-configs
      namespace: monitoring
      ready: true
  inputs:
    - tenant: "frontend"
      tag: "${ARTIFACT_TAG}"
      environment: "${ENVIRONMENT}"
  resources:
    - apiVersion: v1
      kind: Namespace
      metadata:
        name: "<< inputs.tenant >>"

apiVersion: kind.x-k8s.io/v1alpha4
kind: Cluster
name: platform-local
nodes:
  - role: control-plane
    kubeadmConfigPatches:
      - |
        kind: InitConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: "ingress-ready=true"
    extraPortMappings:
      - containerPort: 80
        hostPort: 8080
      - containerPort: 443
        hostPort: 8443

  - role: worker
  - role: worker

featureGates:
  ValidatingAdmissionPolicy: true

networking:
  podSubnet: "10.244.0.0/16"
  serviceSubnet: "10.96.0.0/16"

#!/usr/bin/env bash
set -euo pipefail

echo "==> Creating Kind cluster..."
kind create cluster --config=ci/kind-config.yaml --wait 60s

echo "==> Installing Flux Operator (via Helm)..."
helm repo add controlplane https://controlplaneio-fluxcd.github.io/charts
helm repo update

helm upgrade --install flux-operator controlplane/flux-operator \
  --namespace flux-system \
  --create-namespace \
  --wait

echo "==> Deploying platform chart (staging mode)..."
helm upgrade --install platform ./platform-chart \
  --namespace flux-system \
  --create-namespace \
  -f ./platform-chart/values.yaml \
  -f ./platform-chart/values-staging.yaml \
  --set global.environment=local \
  --set fluxOperator.instance.sync.kind=GitRepository \
  --set fluxOperator.instance.sync.url=https://github.com/your-org/fleet.git \
  --set policies.validationFailureAction=Audit \
  --wait --timeout=10m

echo "==> Waiting for Kyverno to be ready..."
kubectl wait --for=condition=Available \
  deployment/kyverno-admission-controller \
  -n kyverno --timeout=300s

echo "==> Checking FluxReport..."
kubectl get fluxreport -n flux-system -o yaml

echo "✅ Platform stack is ready!"

apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
spec:
  distribution:
    version: "2.x.x"
    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
  components:
    - source-controller
    - kustomize-controller
    - helm-controller
  cluster:
    type: kubernetes
    multitenant: true
  sync:
    kind: OCIRepository
    url: oci://ghcr.io/org/d2-fleet
    ref: latest-stable
    path: "./clusters/prod"
  commonMetadata:
    labels:
      managed-by: "flux-operator"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-tenant-label
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-labels
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "tenant label required"
        pattern:
          metadata:
            labels:
              app.kubernetes.io/part-of: "?*"

# Kustomization phải có SHA annotation — audit trail sau time-gate
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-deployment-sha
  annotations:
    policies.kyverno.io/category: Compliance
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: require-sha-annotation
      match:
        any:
          - resources:
              kinds: ["Kustomization"]
              namespaces: ["team-*"]
      validate:
        message: "Missing deployment SHA — was it deployed via time-gate?"
        pattern:
          metadata:
            annotations:
              deployment.company.com/sha: "?*"
              deployment.company.com/deployed-at: "?*"

name: flux-artifact-cd
on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize, labeled]

permissions:
  contents: read
  id-token: write
  packages: write

jobs:
  build-push-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push Flux OCI artifact (path = fleet manifests)
        run: |
          flux push artifact oci://ghcr.io/${{ github.repository_owner }}/fleet:${{ github.sha }} \
            --path=./clusters/staging \
            --source=${{ github.repository }} \
            --revision=${{ github.sha }}

      - name: Cosign sign (keyless)
        uses: sigstore/cosign-installer@v3
      - run: |
          DIGEST=$(crane digest ghcr.io/${{ github.repository_owner }}/fleet:${{ github.sha }})
          cosign sign --yes ghcr.io/${{ github.repository_owner }}/fleet@$DIGEST

helm upgrade --install platform ./platform-chart \
  -f values-production.yaml \
  --namespace flux-system --create-namespace

apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSetInputProvider
metadata:
  name: payments-app-main
  namespace: team-payments
  labels:
    app.kubernetes.io/name: payments-app
  annotations:
    fluxcd.controlplane.io/reconcileEvery: "10m"
    fluxcd.controlplane.io/reconcileTimeout: "1m"
spec:
  schedule:
    - cron: "0 9 * * 1-5"
      timeZone: "Asia/Ho_Chi_Minh"
      window: 8h
    - cron: "0 10 * * 6"
      timeZone: "Asia/Ho_Chi_Minh"
      window: 4h
  type: GitHubBranch
  url: https://github.com/your-org/payments-app
  secretRef:
    name: gh-app-auth
  filter:
    includeBranch: "^main$"
  defaultValues:
    env: production

apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSetInputProvider
metadata:
  name: payments-app-release
  namespace: team-payments
  labels:
    app.kubernetes.io/name: payments-app
spec:
  schedule:
    - cron: "0 22 * * 2,4"
      timeZone: "Asia/Ho_Chi_Minh"
      window: 4h
  type: GitHubTag
  url: https://github.com/your-org/payments-app
  secretRef:
    name: gh-app-auth
  filter:
    semver: ">=1.0.0"
    limit: 1

apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSetInputProvider
metadata:
  name: payments-chart-release
  namespace: team-payments
  labels:
    delivery-mode: oci-time-based
spec:
  schedule:
    - cron: "0 22 * * 2,4"
      timeZone: "Asia/Ho_Chi_Minh"
      window: 4h
  type: OCITag
  url: oci://ghcr.io/your-org/payments-chart
  secretRef:
    name: oci-auth
  filter:
    semver: ">=1.0.0"
    limit: 1

apiVersion: fluxcd.controlplane.io/v1
kind: ResourceSet
metadata:
  name: payments-app
  namespace: team-payments
spec:
  inputsFrom:
    - kind: ResourceSetInputProvider
      selector:
        matchLabels:
          app.kubernetes.io/name: payments-app
  resources:
    - apiVersion: source.toolkit.fluxcd.io/v1
      kind: GitRepository
      metadata:
        name: payments-app
        namespace: "<< inputs.provider.namespace >>"
      spec:
        interval: 12h
        url: https://github.com/your-org/payments-app
        ref:
          commit: "<< inputs.sha >>"
        secretRef:
          name: gh-app-auth
        sparseCheckout:
          - deploy
    - apiVersion: kustomize.toolkit.fluxcd.io/v1
      kind: Kustomization
      metadata:
        name: payments-app
        namespace: "<< inputs.provider.namespace >>"
      spec:
        interval: 30m
        retryInterval: 5m
        serviceAccountName: flux-payments
        prune: true
        wait: true
        timeout: 5m
        sourceRef:
          kind: GitRepository
          name: payments-app
        path: deploy/<< inputs.env >>
        commonMetadata:
          annotations:
            deployment.company.com/sha: "<< inputs.sha >>"
            deployment.company.com/branch: "<< inputs.branch >>"
            deployment.company.com/deployed-at: "<< inputs.provider.lastUpdated >>"