Welcome to your ${REPO_NAME} tenant

This is a GitOps tenant repository for the kvant OpenShift platform. Flux watches this git repository and continuously reconciles the Kubernetes manifests in it into your namespace(s). One repo can serve several namespaces (e.g. dev / staging / prod) — see "Multiple environments" below.

Repository layout

├── kustomization.yaml   # entry point: lists the Flux Kustomizations below
├── config/ks.yaml       # namespace baseline config (limit ranges, ...)
├── repos/               # HelmRepository sources usable by your apps
│   └── helm/bjw-s.yaml  # example: bjw-s app-template chart repo
├── echo-server/         # example app — replace with your own
│   ├── ks.yaml          # Flux Kustomization (incl. variable substitution)
│   └── app/             # plain manifests, shared by all namespaces
└── vars/                # per-namespace values & secrets
    └── <namespace>/     # folder name must match the namespace exactly
        ├── .sops.yaml           # recipients for SOPS-encrypted secrets
        └── <app>-settings.yaml  # values that change between namespaces

The bootstrap creates a root Flux Kustomization (tenant-apps) in each of your namespaces, pointing at this repo. It automatically injects the technical service account, the target namespace, SOPS decryption and the platform tenant-settings ConfigMap (with variables like the namespace name, public domain, technical account) into every Kustomization you define here.

Per-namespace values (no overlays)

Any value that differs between namespaces becomes a variable in the manifests, filled in from a ConfigMap in vars/<namespace>/ at deploy time — see echo-server/ for a working example:

1. The manifests under <app>/app/ use the variables with a built-in default (replicas: ${ECHO_SERVER_REPLICAS:=2}), so the app deploys even before any settings exist for a namespace. There is exactly one copy of each manifest — no base//overlays/ tree.
2. vars/<namespace>/<app>-settings.yaml overrides the defaults for one app (quote numbers, e.g. "3" — substitution is textual).
3. The app's Flux Kustomization references that ConfigMap via postBuild.substituteFrom with optional: true (a missing ConfigMap means "just use the defaults", not a failure) and carries the label substitution.flux.use.json/enabled: "true" (without the label the bootstrap replaces your substituteFrom with the platform tenant-settings ConfigMap instead of appending to it).

Adding a new namespace to this repo = copy a vars/<namespace>/ folder, name it after the new namespace, adjust the values. Nothing else to change. (And thanks to the defaults, even that step is optional.)

Secrets

Secrets live next to the settings in vars/<namespace>/ and must be SOPS-encrypted with the namespace's .sops.yaml creation rules (never commit plaintext). Details: wiki — Environments.

Useful links

• Get me to my namespace
• WIKI

Tenants on Phoeniqs IaaS are created in the Phoeniqs Portal — see the IaaS Quickstart Guide for the howto (Resource Group → Capacity Pool → resources → Namespace).

Command cheatsheet

# all your tenant resources from flux' perspective
flux get all -n <namespace>

# all your tenant resources from openshift's perspective
oc get all -n <namespace>