Add Flux GitOps for ff: app deployment and image automation

[rgardner4012]

Summary

Wires the ff app into Flux with full GitOps and image automation.

apps/ff/

Resource	Purpose
ExternalSecret deploy-key	SSH deploy key for private flockfeed repo (from OpenBAO ff/deploy-key)
ExternalSecret registry-auth	ghcr.io pull credentials (from OpenBAO ff/registry-auth)
GitRepository ff-main / ff-dev	Watch main and dev branches of flockfeed repo
ImageRepository ff	Scan ghcr.io/rgardner4012/flockfeed for new tags
ImagePolicy ff-dev	Select latest dev-YYYYMMDDHHmmss tag
ImagePolicy ff-production	Select latest main-YYYYMMDDHHmmss tag
ImageUpdateAutomation ff-dev	Commit updated tag to flockfeed dev branch
ImageUpdateAutomation ff-production	Commit updated tag to flockfeed main branch
Kustomization apps-ff-dev	Deploy k8s/overlays/dev, depends on infra-ff-postgres
Kustomization apps-ff-production	Deploy k8s/overlays/production, depends on infra-ff-postgres

Also adds wait: true to infra-ff-postgres so the app waits for the DB to be healthy on first deploy.

End-to-end flow

push to dev branch
  → CI builds ghcr.io/rgardner4012/flockfeed:dev-YYYYMMDDHHmmss
  → Flux ImagePolicy ff-dev selects new tag
  → ImageUpdateAutomation ff-dev commits updated tag to flockfeed dev branch
  → Kustomization apps-ff-dev reconciles → new pod deployed to ff-dev namespace

Bootstrap: populate secrets in OpenBAO before merging

1. SSH deploy key (ff/deploy-key) — needs write access to flockfeed repo for image automation commits:

ssh-keygen -t ed25519 -C "flux-homelab" -f /tmp/flux-ff-deploy-key
# Add /tmp/flux-ff-deploy-key.pub as a deploy key in flockfeed repo (Settings → Deploy keys, allow write access)
# Store in OpenBAO:
bao kv put secret/ff/deploy-key \
  identity=@/tmp/flux-ff-deploy-key \
  identity_pub=@/tmp/flux-ff-deploy-key.pub \
  known_hosts="$(ssh-keyscan github.com 2>/dev/null)"

2. Registry credentials (ff/registry-auth) — GitHub PAT with read:packages scope:

bao kv put secret/ff/registry-auth \
  username=rgardner4012 \
  password=<github-pat>

[Copilot]

Pull request overview

This PR implements comprehensive Flux GitOps with automated image updates for the "ff" (flockfeed) application across development and production environments. The setup enables automatic deployment when new container images are built and pushed to the registry.

Changes:

• Added Flux GitOps configuration for ff app with separate dev and production environments
• Configured image automation to automatically update manifests when new images are published
• Added wait: true to postgres Kustomization to ensure database readiness before app deployment

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
clusters/hlcl1/kustomization.yaml	Added apps/ff to cluster resources
clusters/hlcl1/infra/databases/postgres/ks-config.yaml	Added wait: true to ensure postgres is healthy before app deployment
clusters/hlcl1/apps/ff/kustomization.yaml	Main kustomization file listing all ff app Flux resources
clusters/hlcl1/apps/ff/externalsecret-deploy-key.yaml	SSH deploy key for flockfeed repo (enables write access for image automation)
clusters/hlcl1/apps/ff/externalsecret-registry-auth.yaml	Container registry authentication for ghcr.io
clusters/hlcl1/apps/ff/gitrepository-main.yaml	Watches main branch of flockfeed repository
clusters/hlcl1/apps/ff/gitrepository-dev.yaml	Watches dev branch of flockfeed repository
clusters/hlcl1/apps/ff/imagerepository.yaml	Scans ghcr.io/rgardner4012/flockfeed for new container images
clusters/hlcl1/apps/ff/imagepolicy-dev.yaml	Selects latest dev-YYYYMMDDHHmmss tagged images
clusters/hlcl1/apps/ff/imagepolicy-production.yaml	Selects latest main-YYYYMMDDHHmmss tagged images
clusters/hlcl1/apps/ff/imageupdateautomation-dev.yaml	Commits updated image tags to flockfeed dev branch
clusters/hlcl1/apps/ff/imageupdateautomation-production.yaml	Commits updated image tags to flockfeed main branch
clusters/hlcl1/apps/ff/ks-dev.yaml	Deploys ff app dev environment from k8s/overlays/dev path
clusters/hlcl1/apps/ff/ks-production.yaml	Deploys ff app production environment from k8s/overlays/production path

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.