Skip to main content

Domain

The vanilla overlays use ${domain} for each hostname, for example keycloak.${domain}. Flux replaces ${domain} with the value from the cluster-vars ConfigMap. Flux does this with post-build substitution (postBuild.substituteFrom). You do not patch each hostname in your cluster overlay.

Set the domain​

Do these steps before the first reconcile:

  1. Copy docs/cluster-vars.example.yaml.
  2. Set domain to the base domain of the cluster.
  3. Apply the ConfigMap to the flux-system namespace.
  4. Make a wildcard DNS record *.<domain> that points to the IP address of the public gateway.
apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-vars
  namespace: flux-system
data:
  domain: example.org

If the ConfigMap does not exist, each Kustomization stops with a "ConfigMap not found" error.

Add postBuild to your cluster​

Each component Kustomization needs postBuild.substituteFrom. Add one patch to clusters/<cluster>/infrastructure/kustomization.yaml:

patches:
  - target:
      group: kustomize.toolkit.fluxcd.io
      kind: Kustomization
    patch: |
      - op: add
        path: /spec/postBuild
        value:
          substituteFrom:
            - kind: ConfigMap
              name: cluster-vars

clusters/vanilla in gitops-flux has this patch.

Turn on strict substitution​

Without strict mode, Flux replaces an unknown ${VAR} with an empty string and shows no error. Add --feature-gates=StrictPostBuildSubstitutions=true to the kustomize-controller args. Then the Kustomization stops with the error variable not set (strict mode).

Runtime variables​

Some values are for the container at runtime, for example ${S3_ACCESS_KEY_ID} in loki and mimir. Flux must not replace them. Use one of these methods:

  • Write the variable as $${S3_ACCESS_KEY_ID}. Flux removes one $.
  • Set the annotation kustomize.toolkit.fluxcd.io/substitute: disabled on the object. Flux does not substitute any value in that object. Loki and mimir use this method.

Do not write a default for a runtime variable, for example ${VAR:=x}. Flux uses the default, also in strict mode.

Check your overlays​

The script scripts/check-substitutions.sh in gitops-flux finds variables that Flux cannot replace. Run it in the CI of your provider repository.

For the full rules and the variable syntax, see clusters/vanilla/README.md.