feat(infra): add stakater reloader

[imgios]

his PR deploys the Stakater Reloader Controller to automate rolling upgrades of cluster pods if changes are made to the ConfigMaps or Secrets. Further changes are required per application to enable the Reloader to monitor their resources.

[sysadmin-cosplayer]

--- kubernetes/infrastructure Kustomization: flux-system/infrastructure Namespace: flux-system/reloader

+++ kubernetes/infrastructure Kustomization: flux-system/infrastructure Namespace: flux-system/reloader

@@ -0,0 +1,9 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: infrastructure
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: reloader
+
--- kubernetes/infrastructure Kustomization: flux-system/infrastructure Kustomization: reloader/reloader

+++ kubernetes/infrastructure Kustomization: flux-system/infrastructure Kustomization: reloader/reloader

@@ -0,0 +1,28 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: infrastructure
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: reloader
+  namespace: reloader
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: reloader
+  healthChecks:
+  - apiVersion: helm.toolkit.fluxcd.io/v2
+    kind: HelmRelease
+    name: reloader
+    namespace: reloader
+  interval: 10m0s
+  path: ./kubernetes/infrastructure/reloader/app/deployment
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: reloader
+  timeout: 5m0s
+
--- kubernetes/infrastructure/reloader/app/deployment Kustomization: reloader/reloader OCIRepository: reloader/reloader

+++ kubernetes/infrastructure/reloader/app/deployment Kustomization: reloader/reloader OCIRepository: reloader/reloader

@@ -0,0 +1,19 @@

+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  labels:
+    app.kubernetes.io/name: reloader
+    kustomize.toolkit.fluxcd.io/name: reloader
+    kustomize.toolkit.fluxcd.io/namespace: reloader
+  name: reloader
+  namespace: reloader
+spec:
+  interval: 15m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 2.2.5
+  url: oci://ghcr.io/stakater/charts/reloader
+
--- kubernetes/infrastructure/reloader/app/deployment Kustomization: reloader/reloader HelmRelease: reloader/reloader

+++ kubernetes/infrastructure/reloader/app/deployment Kustomization: reloader/reloader HelmRelease: reloader/reloader

@@ -0,0 +1,23 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: reloader
+    kustomize.toolkit.fluxcd.io/name: reloader
+    kustomize.toolkit.fluxcd.io/namespace: reloader
+  name: reloader
+  namespace: reloader
+spec:
+  chartRef:
+    kind: OCIRepository
+    name: reloader
+  interval: 1h
+  values:
+    fullnameOverride: reloader
+    reloader:
+      deployment:
+        replicas: 1
+      enableHA: false
+      readOnlyRootFileSystem: true
+

[sysadmin-cosplayer]

--- HelmRelease: reloader/reloader ServiceAccount: reloader/reloader

+++ HelmRelease: reloader/reloader ServiceAccount: reloader/reloader

@@ -0,0 +1,17 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    meta.helm.sh/release-namespace: reloader
+    meta.helm.sh/release-name: reloader
+  labels:
+    app: reloader
+    release: reloader
+    app.kubernetes.io/name: reloader
+    app.kubernetes.io/instance: reloader
+    heritage: Helm
+    app.kubernetes.io/managed-by: Helm
+  name: reloader
+  namespace: reloader
+
--- HelmRelease: reloader/reloader ClusterRole: reloader/reloader-role

+++ HelmRelease: reloader/reloader ClusterRole: reloader/reloader-role

@@ -0,0 +1,60 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    meta.helm.sh/release-namespace: reloader
+    meta.helm.sh/release-name: reloader
+  labels:
+    app: reloader
+    release: reloader
+    app.kubernetes.io/name: reloader
+    app.kubernetes.io/instance: reloader
+    heritage: Helm
+    app.kubernetes.io/managed-by: Helm
+  name: reloader-role
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  - configmaps
+  verbs:
+  - list
+  - get
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - daemonsets
+  - statefulsets
+  verbs:
+  - list
+  - get
+  - update
+  - patch
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  verbs:
+  - list
+  - get
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - list
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+
--- HelmRelease: reloader/reloader ClusterRoleBinding: reloader/reloader-role-binding

+++ HelmRelease: reloader/reloader ClusterRoleBinding: reloader/reloader-role-binding

@@ -0,0 +1,24 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations:
+    meta.helm.sh/release-namespace: reloader
+    meta.helm.sh/release-name: reloader
+  labels:
+    app: reloader
+    release: reloader
+    app.kubernetes.io/name: reloader
+    app.kubernetes.io/instance: reloader
+    heritage: Helm
+    app.kubernetes.io/managed-by: Helm
+  name: reloader-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: reloader-role
+subjects:
+- kind: ServiceAccount
+  name: reloader
+  namespace: reloader
+
--- HelmRelease: reloader/reloader Role: reloader/reloader-metadata-role

+++ HelmRelease: reloader/reloader Role: reloader/reloader-metadata-role

@@ -0,0 +1,28 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations:
+    meta.helm.sh/release-namespace: reloader
+    meta.helm.sh/release-name: reloader
+  labels:
+    app: reloader
+    release: reloader
+    app.kubernetes.io/name: reloader
+    app.kubernetes.io/instance: reloader
+    heritage: Helm
+    app.kubernetes.io/managed-by: Helm
+  name: reloader-metadata-role
+  namespace: reloader
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - list
+  - get
+  - watch
+  - create
+  - update
+
--- HelmRelease: reloader/reloader RoleBinding: reloader/reloader-metadata-role-binding

+++ HelmRelease: reloader/reloader RoleBinding: reloader/reloader-metadata-role-binding

@@ -0,0 +1,25 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    meta.helm.sh/release-namespace: reloader
+    meta.helm.sh/release-name: reloader
+  labels:
+    app: reloader
+    release: reloader
+    app.kubernetes.io/name: reloader
+    app.kubernetes.io/instance: reloader
+    heritage: Helm
+    app.kubernetes.io/managed-by: Helm
+  name: reloader-metadata-role-binding
+  namespace: reloader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: reloader-metadata-role
+subjects:
+- kind: ServiceAccount
+  name: reloader
+  namespace: reloader
+
--- HelmRelease: reloader/reloader Deployment: reloader/reloader

+++ HelmRelease: reloader/reloader Deployment: reloader/reloader

@@ -0,0 +1,98 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-namespace: reloader
+    meta.helm.sh/release-name: reloader
+  labels:
+    app: reloader
+    release: reloader
+    app.kubernetes.io/name: reloader
+    app.kubernetes.io/instance: reloader
+    heritage: Helm
+    app.kubernetes.io/managed-by: Helm
+    group: com.stakater.platform
+    provider: stakater
+    version: v1.4.10
+  name: reloader
+  namespace: reloader
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: reloader
+      release: reloader
+  template:
+    metadata:
+      labels:
+        app: reloader
+        release: reloader
+        app.kubernetes.io/name: reloader
+        app.kubernetes.io/instance: reloader
+        heritage: Helm
+        app.kubernetes.io/managed-by: Helm
+        group: com.stakater.platform
+        provider: stakater
+        version: v1.4.10
+    spec:
+      containers:
+      - image: ghcr.io/stakater/reloader:v1.4.10
+        imagePullPolicy: IfNotPresent
+        name: reloader
+        env:
+        - name: GOMAXPROCS
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: '1'
+        - name: GOMEMLIMIT
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.memory
+              divisor: '1'
+        - name: RELOADER_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: RELOADER_DEPLOYMENT_NAME
+          value: reloader
+        ports:
+        - name: http
+          containerPort: 9090
+        livenessProbe:
+          httpGet:
+            path: /live
+            port: http
+          timeoutSeconds: 5
+          failureThreshold: 5
+          periodSeconds: 10
+          successThreshold: 1
+          initialDelaySeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: http
+          timeoutSeconds: 5
+          failureThreshold: 5
+          periodSeconds: 10
+          successThreshold: 1
+          initialDelaySeconds: 10
+        securityContext:
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /tmp/
+          name: tmp-volume
+        args:
+        - --log-level=info
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: reloader
+      volumes:
+      - emptyDir: {}
+        name: tmp-volume
+