Weather App Kubernetes GitOps

Scope

The current Kubernetes implementation validates Weather App manifests, Helm packaging, GitOps reconciliation, NetworkPolicies, Kyverno and monitoring. Minikube is used as a validation cluster, not as the homelab production cluster.

GitOps Flow

flowchart LR
  repo[weather-app repository] --> source[GitOps source]
  source --> infra[Infrastructure reconciliation]
  infra --> policies[Policy reconciliation]
  policies --> app[Weather App Helm release]

  infra --> traefik[Traefik]
  infra --> kyverno[Kyverno]
  infra --> monitoring[kube-prometheus-stack]
  policies --> netpol[NetworkPolicies]
  policies --> rbac[RBAC]
  app --> workloads[Frontend, backend and WAF]

Platform Boundaries

Component	Validation Iteration	Platform Direction
Cluster	Minikube	Substrate-agnostic Kubernetes platform
GitOps controller	Flux	Argo CD App of Apps
Secrets	Sealed Secrets and SOPS	OpenBao through External Secrets
Policy engine	Kyverno	Kyverno with signed image enforcement
Ingress	Traefik with Ingress	Traefik or Gateway API decided by ADR
Observability	Prometheus and Grafana	Prometheus, Grafana, Loki and OpenSearch
Image automation	Flux Image Automation	Argo CD Image Updater or CI promotion

Security Verification

NetworkPolicies

The backend is reachable from the frontend proxy path and blocked from unauthorized pods, including unrelated namespaces and WAF pods.

Kyverno

Policies validate or enforce non-root execution, required labels and health probes for application workloads.

RBAC

Application administrators and viewers receive different permissions. Cross-namespace access is validated with kubectl auth can-i.

Monitoring

Prometheus scrapes application and platform metrics. Grafana visualizes health, latency and deployment timing.

Validation Commands

flux get kustomizations -A
flux get helmreleases -A
kubectl get pods -n weather-app
kubectl get networkpolicy -n weather-app
kubectl auth can-i create pods -n weather-app --as=weather-admin
kubectl auth can-i create pods -n weather-app --as=weather-viewer

Migration Rules

Do not present Minikube as the production cluster.
Keep the Weather App Helm chart deployable by values so GitOps controllers can consume it.
Preserve network-policy tests when moving from the validation cluster to the platform cluster.
Replace bootstrap secrets with OpenBao-backed External Secrets when the platform is ready.
Keep Flux-specific automation documented until the Argo CD equivalent is implemented and tested.