diff --git a/template/tasks/addons/csi_driver_nfs.yaml b/template/tasks/addons/csi_driver_nfs.yaml new file mode 100644 index 00000000..ebd21ac8 --- /dev/null +++ b/template/tasks/addons/csi_driver_nfs.yaml @@ -0,0 +1,63 @@ +--- +- name: Set addon facts + ansible.builtin.set_fact: + addon_name: csi-driver-nfs + addon_namespace: kube-system + +- name: Ensure directories exist for {{ addon_namespace }}/{{ addon_name }} + when: item.state == 'directory' + ansible.builtin.file: + path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path }}" + state: directory + mode: "0755" + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + +- name: Template unencrypted files for {{ addon_namespace }}/{{ addon_name }} + when: item.state == 'file' and 'sops' not in item.path + ansible.builtin.template: + src: "{{ item.src }}" + dest: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" + mode: "0755" + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + +# https://github.com/ansible-collections/community.sops/issues/153 +- name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }} + block: + - name: Rename Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml" + dest: "{{ repository_path }}/.sops.yaml.orig" + mode: "0755" + - name: Remove Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml" + state: absent + - name: Template encrypted files + when: item.state == 'file' and 'sops' in item.path + community.sops.sops_encrypt: + path: "{{ repository_path }}/kubernetes/apps/{{ addon_namespace }}/{{ addon_name }}/{{ item.path | replace('.j2', '') }}" + encrypted_regex: ^(data|stringData)$ + age: ["{{ bootstrap_age_public_key }}"] + content_yaml: "{{ lookup('ansible.builtin.template', item.src) | from_yaml }}" + mode: "0755" + force: true + with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"] + - name: Restore Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml.orig" + dest: "{{ repository_path }}/.sops.yaml" + mode: "0755" + - name: Remove backed up Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml.orig" + state: absent + rescue: + - name: Restore Sops configuration file + ansible.builtin.copy: + src: "{{ repository_path }}/.sops.yaml.orig" + dest: "{{ repository_path }}/.sops.yaml" + mode: "0755" + - name: Remove backed up Sops configuration file + ansible.builtin.file: + path: "{{ repository_path }}/.sops.yaml.orig" + state: absent diff --git a/template/tasks/addons/main.yaml b/template/tasks/addons/main.yaml index 94ac18f6..cb5eae8f 100644 --- a/template/tasks/addons/main.yaml +++ b/template/tasks/addons/main.yaml @@ -1,21 +1,25 @@ --- +- name: Process addon csi-driver-nfs + when: csi_driver_nfs.enabled | default(false) + ansible.builtin.include_tasks: csi_driver_nfs.yaml + - name: Process addon hajimari - when: hajimari.enabled | default (false) + when: hajimari.enabled | default(false) ansible.builtin.include_tasks: hajimari.yaml - name: Process addon grafana - when: grafana.enabled | default (false) + when: grafana.enabled | default(false) ansible.builtin.include_tasks: grafana.yaml - name: Process addon kubernetes-dashboard - when: kubernetes_dashboard.enabled | default (false) + when: kubernetes_dashboard.enabled | default(false) ansible.builtin.include_tasks: kubernetes_dashboard.yaml - name: Process addon kube-prometheus-stack - when: kube_prometheus_stack.enabled | default (false) + when: kube_prometheus_stack.enabled | default(false) ansible.builtin.include_tasks: kube_prometheus_stack.yaml - name: Process addon weave-gitops - when: weave_gitops.enabled | default (false) + when: weave_gitops.enabled | default(false) ansible.builtin.include_tasks: weave_gitops.yaml diff --git a/template/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 b/template/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 new file mode 100644 index 00000000..19627f8c --- /dev/null +++ b/template/templates/addons/csi-driver-nfs/app/helmrelease.yaml.j2 @@ -0,0 +1,30 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: csi-driver-nfs + namespace: kube-system +spec: + interval: 30m + chart: + spec: + chart: csi-driver-nfs + version: v4.4.0 + sourceRef: + kind: HelmRepository + name: csi-driver-nfs + namespace: flux-system + maxHistory: 2 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + externalSnapshotter: + enabled: false diff --git a/template/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 b/template/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 new file mode 100644 index 00000000..53906e15 --- /dev/null +++ b/template/templates/addons/csi-driver-nfs/app/kustomization.yaml.j2 @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kube-system +resources: + - ./helmrelease.yaml + - ./storageclass.yaml diff --git a/template/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 b/template/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 new file mode 100644 index 00000000..d62dc847 --- /dev/null +++ b/template/templates/addons/csi-driver-nfs/app/storageclass.yaml.j2 @@ -0,0 +1,15 @@ +#jinja2: trim_blocks: True, lstrip_blocks: True +{% for item in csi_driver_nfs.storage_class %} +--- +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: {{ item.name }} +provisioner: nfs.csi.k8s.io +parameters: + server: {{ item.server }} + share: {{ item.share }} +reclaimPolicy: Delete +volumeBindingMode: Immediate +mountOptions: ["hard", "noatime"] +{% endfor %} diff --git a/template/templates/addons/csi-driver-nfs/ks.yaml.j2 b/template/templates/addons/csi-driver-nfs/ks.yaml.j2 new file mode 100644 index 00000000..18e933c0 --- /dev/null +++ b/template/templates/addons/csi-driver-nfs/ks.yaml.j2 @@ -0,0 +1,16 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cluster-apps-csi-driver-nfs + namespace: flux-system +spec: + path: ./kubernetes/apps/kube-system/csi-driver-nfs/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m diff --git a/template/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 b/template/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 index 860ff1b8..6b9dc1e7 100644 --- a/template/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 +++ b/template/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 @@ -1,3 +1,4 @@ +#jinja2: trim_blocks: True, lstrip_blocks: True --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization @@ -8,3 +9,6 @@ resources: - ./local-path-provisioner/ks.yaml - ./metrics-server/ks.yaml - ./reloader/ks.yaml + {% if csi_driver_nfs.enabled | default(false) %} + - ./csi-driver-nfs/ks.yaml + {% endif %} diff --git a/template/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 b/template/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 new file mode 100644 index 00000000..b48140d7 --- /dev/null +++ b/template/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 @@ -0,0 +1,9 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1beta2 +kind: HelmRepository +metadata: + name: csi-driver-nfs + namespace: flux-system +spec: + interval: 1h + url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts diff --git a/template/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 b/template/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 index b3e64b6f..64a99c3f 100644 --- a/template/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 +++ b/template/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 @@ -6,6 +6,7 @@ resources: - ./bjw-s.yaml - ./cilium.yaml - ./coredns.yaml + - ./csi-driver-nfs.yaml - ./external-dns.yaml - ./grafana.yaml - ./hajimari.yaml diff --git a/template/vars/addons.sample.yaml b/template/vars/addons.sample.yaml index 666bf21d..fd161890 100644 --- a/template/vars/addons.sample.yaml +++ b/template/vars/addons.sample.yaml @@ -10,7 +10,7 @@ hajimari: # https://github.com/grafana/grafana grafana: enabled: false - # password: + # password: # admin password # https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack kube_prometheus_stack: @@ -23,4 +23,12 @@ kubernetes_dashboard: # https://github.com/weaveworks/weave-gitops weave_gitops: enabled: false - # password: + # password: # admin password + +# https://github.com/kubernetes-csi/csi-driver-nfs +csi_driver_nfs: + enabled: false + # storage_class: + # - name: # name of the storage class (lower-kebab-case) + # server: # dns name or ip address of nfs server + # share: # exported share (path)