feat(fluxcd): retire the hand-rolled flux-tenants shard

The installer no longer ships the hand-rolled tenant helm-controller
shard: flux-shard-operator provisions operator-managed shard
Deployments cloned from flux-aio at runtime instead, and deletes a
running flux-tenants Deployment only after the legacy tenants bucket
drains. flux-aio itself stays unchanged and keeps owning everything
without a shard key; the Makefile lines that synced the image/version
into the removed manifest go away with it.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>

internal/fluxinstall/manifests/fluxcd-tenants.yaml

@@ -1,102 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/name: flux-tenants
-    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.8.0
-    sharding.fluxcd.io/role: shard
-  name: flux-tenants
-  namespace: cozy-fluxcd
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: flux-tenants
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
-        prometheus.io/scrape: "true"
-      labels:
-        app.kubernetes.io/name: flux-tenants
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: kubernetes.io/os
-                    operator: In
-                    values:
-                      - linux
-      containers:
-        - args:
-            - --watch-all-namespaces
-            - --log-level=info
-            - --log-encoding=json
-            - --enable-leader-election=false
-            - --metrics-addr=:9795
-            - --health-addr=:9796
-            - --watch-label-selector=sharding.fluxcd.io/key=tenants
-            - --concurrent=5
-            - --requeue-dependency=30s
-            - --feature-gates=ExternalArtifact=true
-          env:
-            - name: RUNTIME_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: GOMEMLIMIT
-              valueFrom:
-                resourceFieldRef:
-                  resource: limits.memory
-            - name: TUF_ROOT
-              value: /tmp/.sigstore
-          image: "ghcr.io/fluxcd/helm-controller:v1.5.0"
-          imagePullPolicy: IfNotPresent
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: healthz
-          name: helm-controller
-          ports:
-            - containerPort: 9795
-              name: http-prom
-              protocol: TCP
-            - containerPort: 9796
-              name: healthz
-              protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: healthz
-          resources:
-            limits:
-              memory: 1Gi
-            requests:
-              cpu: 100m
-              memory: 64Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp
-      priorityClassName: system-cluster-critical
-      securityContext:
-        fsGroup: 1337
-      serviceAccountName: flux
-      terminationGracePeriodSeconds: 60
-      volumes:
-        - emptyDir: {}
-          name: tmp

packages/core/flux-aio/Makefile

@@ -21,5 +21,3 @@ update:
 		-e '/timoni/d' \
 		-e 's|\.cluster\.local\.,||g' -e 's|\.cluster\.local\,||g' -e 's|\.cluster\.local\.||g' \
 		-e 's|--storage-adv-addr=source-watcher.$$(RUNTIME_NAMESPACE).svc|--storage-adv-addr=flux.$$(RUNTIME_NAMESPACE).svc|'
-	yq eval '.spec.template.spec.containers[0].image = "'"$$(yq eval 'select(.kind == "Deployment" and .metadata.name == "flux") | .spec.template.spec.containers[] | select(.name == "helm-controller").image' $(MANIFESTS_DIR)/fluxcd.yaml)"'"' -i $(MANIFESTS_DIR)/fluxcd-tenants.yaml
-	yq eval '.metadata.labels."app.kubernetes.io/version" = "'"$$(yq eval 'select(.kind == "Deployment" and .metadata.name == "flux") | .metadata.labels."app.kubernetes.io/version"' $(MANIFESTS_DIR)/fluxcd.yaml)"'"' -i $(MANIFESTS_DIR)/fluxcd-tenants.yaml