# GitOps — ground segment (Flux)

Flux reconciles **long-lived ground configuration** from this repository. It does
not run on drones and does not replace the fleet release manifest — those are
different lifecycles by design ([11 — CI/CD](../../docs/11-cicd-delivery.md)).

## Boundary: Terraform vs Flux vs fleet manifest

| Layer | Tool | Owns |
| --- | --- | --- |
| Cluster + first boot | **Terraform** ([`../terraform/`](../terraform/)) | Namespaces, PVCs, Deployments, CronJobs, NodePorts — the shape of the simulation |
| Ongoing ground config | **Flux** (this directory) | Policy labels, dashboard bundles, offload knobs — things that change without reprovisioning PVCs |
| Drones | **Fleet release manifest** | Compose bundle digests, model weights, peer registry — atomic, dock-only delivery |

Drones are **outside GitOps**: there is no reconciler in flight. A dock applies
the pinned manifest once; mid-mission drift is impossible because the update
endpoint does not exist in the radio profile.

## Layout

```
infra/gitops/
  flux/           Flux GitRepository + Kustomization CRs (install into flux-system)
  ground/         Kustomize overlay reconciled into the ground namespace
```

## Bootstrap on the k3d simulation cluster

`infra/ansible/sim-cluster.yml` installs Flux controllers and applies the CRs
below. After the first `git push`, Flux polls `origin` and reconciles
`infra/gitops/ground/` into the `ground` namespace.

```bash
# Manual bootstrap (if you skipped Ansible):
flux install --namespace=flux-system
kubectl apply -k infra/gitops/flux
```

To reconcile immediately without waiting for the poll interval:

```bash
flux reconcile source git swarm-house -n flux-system
flux reconcile kustomization ground-segment -n flux-system
```

## What Flux manages here (example)

The [`ground/`](ground/) overlay currently carries a **GitOps-managed ConfigMap**
that tags the warehouse segment with fleet policy metadata. In production this
pattern extends to Grafana dashboard bundles, Prometheus rule files, and
offload-schedule ConfigMaps — all versioned in git, all auditable, none of
them requiring a `terraform apply` to tweak a label.