Move NGINX cluster Flux manifests into a dedicated top-level directory

README.md

@@ -17,6 +17,7 @@ fleet-gitops/
 ├── applications/                    # Application resources synced to the hub cluster
 │   ├── kustomize-nginx/             # NGINX app using Flux CD + Kustomize
 │   └── simple-guestbook/            # Guestbook app using Argo CD
+├── kustomize-nginx-cluster/         # Flux manifests applied on member clusters for NGINX
 ├── rollout/                         # Hub-level bootstrap manifests
 │   ├── kustomize-nginx/             # Flux GitRepository & Kustomization for NGINX
 │   └── guestbook/                   # Argo CD AppProject & Application for Guestbook
@@ -39,6 +40,7 @@ Deploys an NGINX application across multiple clusters using Flux CD for GitOps r
 
 - **Hub bootstrap:** [`rollout/kustomize-nginx/`](rollout/kustomize-nginx/)
 - **Application resources:** [`applications/kustomize-nginx/`](applications/kustomize-nginx/)
+- **Member-cluster Flux resources:** [`kustomize-nginx-cluster/`](kustomize-nginx-cluster/)
 - **Detailed guide:** [`rollout/kustomize-nginx/README.md`](rollout/kustomize-nginx/README.md)
 
 ### Guestbook via Argo CD

kustomize-nginx-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+resources:
+  - namespace.yaml
+  - rbac.yaml
+  - git-repository.yaml
+  - kustomization-nginx-application.yaml

kustomize-nginx-cluster/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nginx-demo

kustomize-nginx-cluster/rbac.yaml

@@ -0,0 +1,26 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: flux-permissions
+  namespace: nginx-demo
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments", "replicasets"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: [""]
+  resources: ["pods", "configmaps", "secrets", "services", "serviceaccounts"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: flux-permissions
+  namespace: nginx-demo
+subjects:
+- kind: ServiceAccount
+  name: flux-applier
+  namespace: flux-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: flux-permissions