infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat!: add mandatory cloudflare tunnel support (#716)

Browse Source 
Co-authored-by: Devin Buhl <onedr0p@users.noreply.github.com>
This commit is contained in:
Steven KreitzerandDevin Buhl authored and GitHub committed 2023-05-04 19:39:22 -04:00
1 parent b917eccb76
commit 145f575fbb
34 files changed
+525 -568
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

kubernetes/apps/networking/cloudflare-ddns/app/cloudflare-ddns.sh
-39
View File
@@ -1,39 +0,0 @@
#!/usr/bin/env bash
set -o nounset
set -o errexit
current_ipv4="$(curl -s https://ipv4.icanhazip.com/)"
zone_id=$(curl -s -X GET \
"https://api.cloudflare.com/client/v4/zones?name=${CLOUDFLARE_RECORD_NAME#*.}&status=active" \
-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
-H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
-H "Content-Type: application/json" \
| jq --raw-output ".result[0] | .id"
)
record_ipv4=$(curl -s -X GET \
"https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records?name=${CLOUDFLARE_RECORD_NAME}&type=A" \
-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
-H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
-H "Content-Type: application/json" \
)
old_ip4=$(echo "$record_ipv4" | jq --raw-output '.result[0] | .content')
if [[ "${current_ipv4}" == "${old_ip4}" ]]; then
printf "%s - IP Address '%s' has not changed" "$(date -u)" "${current_ipv4}"
exit 0
fi
record_ipv4_identifier="$(echo "$record_ipv4" | jq --raw-output '.result[0] | .id')"
update_ipv4=$(curl -s -X PUT \
"https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${record_ipv4_identifier}" \
-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
-H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
-H "Content-Type: application/json" \
--data "{\"id\":\"${zone_id}\",\"type\":\"A\",\"proxied\":true,\"name\":\"${CLOUDFLARE_RECORD_NAME}\",\"content\":\"${current_ipv4}\"}" \
)
if [[ "$(echo "$update_ipv4" | jq --raw-output '.success')" == "true" ]]; then
printf "%s - Success - IP Address '%s' has been updated" "$(date -u)" "${current_ipv4}"
exit 0
else
printf "%s - Yikes - Updating IP Address '%s' has failed" "$(date -u)" "${current_ipv4}"
exit 1
fi
kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml
-53
View File
@@ -1,53 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cloudflare-ddns
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: app-template
version: 1.4.0
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
controller:
type: cronjob
cronjob:
concurrencyPolicy: Forbid
schedule: "@hourly"
restartPolicy: OnFailure
image:
repository: ghcr.io/onedr0p/kubernetes-kubectl
tag: 1.27.1@sha256:2067b52145cdcb99b1db4e92fa114babc0a8a91e08711cbe1aae05ba5a277dd9
command: ["/bin/bash", "/app/cloudflare-ddns.sh"]
envFrom:
- secretRef:
name: cloudflare-ddns-secret
service:
main:
enabled: false
persistence:
config:
enabled: true
type: configMap
name: cloudflare-ddns-configmap
subPath: cloudflare-ddns.sh
mountPath: /app/cloudflare-ddns.sh
defaultMode: 0775
readOnly: true
kubernetes/apps/networking/cloudflared/app/configs/config.yaml
+18
View File
@@ -0,0 +1,18 @@
---
# The `ingress` block tells cloudflared which local service to route incoming
# requests to. For more about ingress rules, see
# https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/ingress
#
# Remember, these rules route traffic from cloudflared to a local service. To route traffic
# from the internet to cloudflared, run `cloudflared tunnel route dns <tunnel> <hostname>`.
# E.g. `cloudflared tunnel route dns example-tunnel tunnel.example.com`.
ingress:
- hostname: "${SECRET_DOMAIN}"
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
originRequest:
originServerName: "ipv4.${SECRET_DOMAIN}"
- hostname: "*.${SECRET_DOMAIN}"
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
originRequest:
originServerName: "ipv4.${SECRET_DOMAIN}"
- service: http_status:404
kubernetes/apps/networking/cloudflared/app/dnsendpoint.yaml
+13
View File
@@ -0,0 +1,13 @@
---
apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
name: cloudflared
namespace: networking
annotations:
external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOAMIN}"
spec:
endpoints:
- dnsName: "ipv4.${SECRET_DOAMIN}"
recordType: CNAME
targets: ["${SECRET_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"]
kubernetes/apps/networking/cloudflared/app/helmrelease.yaml
+102
View File
@@ -0,0 +1,102 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: &app cloudflared
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: app-template
version: 1.4.0
sourceRef:
kind: HelmRepository
name: bjw-s-charts
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
controller:
replicas: 1
strategy: RollingUpdate
annotations:
reloader.stakater.com/auto: "true"
image:
repository: docker.io/cloudflare/cloudflared
tag: 2023.5.0
env:
NO_AUTOUPDATE: "true"
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
TUNNEL_METRICS: 0.0.0.0:8080
TUNNEL_TRANSPORT_PROTOCOL: auto
TUNNEL_ID:
valueFrom:
secretKeyRef:
name: cloudflared-secret
key: TUNNEL_ID
args:
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- "$(TUNNEL_ID)"
service:
main:
ports:
http:
port: 8080
serviceMonitor:
main:
enabled: true
endpoints:
- port: http
scheme: http
path: /metrics
interval: 1m
scrapeTimeout: 30s
probes:
liveness: &probes
enabled: true
custom: true
spec:
httpGet:
path: /ready
port: http
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
readiness: *probes
startup:
enabled: false
persistence:
config:
enabled: true
type: configMap
name: cloudflared-configmap
subPath: config.yaml
mountPath: /etc/cloudflared/config/config.yaml
readOnly: true
creds:
enabled: true
type: secret
name: cloudflared-secret
subPath: credentials.json
mountPath: /etc/cloudflared/creds/credentials.json
readOnly: true
resources:
requests:
cpu: 5m
memory: 10Mi
limits:
memory: 256Mi
kubernetes/apps/networking/cloudflare-ddns/app/kustomization.yaml → kubernetes/apps/networking/cloudflared/app/kustomization.yaml
+3 -4
View File
@@ -3,13 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./dnsendpoint.yaml
- ./secret.sops.yaml
- ./helmrelease.yaml
configMapGenerator:
- name: cloudflare-ddns-configmap
- name: cloudflared-configmap
files:
- ./cloudflare-ddns.sh
- ./configs/config.yaml
generatorOptions:
disableNameSuffixHash: true
annotations:
kustomize.toolkit.fluxcd.io/substitute: disabled
kubernetes/apps/networking/cloudflare-ddns/ks.yaml → kubernetes/apps/networking/cloudflared/ks.yaml
+7 -4
View File
@@ -2,10 +2,12 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-cloudflare-ddns
name: cluster-apps-cloudflared
namespace: flux-system
spec:
path: ./kubernetes/apps/networking/cloudflare-ddns/app
dependsOn:
- name: cluster-apps-ingress-nginx
path: ./kubernetes/apps/networking/cloudflared/app
prune: true
sourceRef:
kind: GitRepository
@@ -13,7 +15,8 @@ spec:
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: cloudflare-ddns
name: cloudflared
namespace: networking
interval: 30m
timeout: 5m
retryInterval: 1m
timeout: 3m
kubernetes/apps/networking/external-dns/app/dnsendpoint-crd.yaml
+93
View File
@@ -0,0 +1,93 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.5.0
api-approved.kubernetes.io: "https://github.com/kubernetes-sigs/external-dns/pull/2007"
creationTimestamp: null
name: dnsendpoints.externaldns.k8s.io
spec:
group: externaldns.k8s.io
names:
kind: DNSEndpoint
listKind: DNSEndpointList
plural: dnsendpoints
singular: dnsendpoint
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: DNSEndpointSpec defines the desired state of DNSEndpoint
properties:
endpoints:
items:
description: Endpoint is a high-level way of a connection between a service and an IP
properties:
dnsName:
description: The hostname of the DNS record
type: string
labels:
additionalProperties:
type: string
description: Labels stores labels defined for the Endpoint
type: object
providerSpecific:
description: ProviderSpecific stores provider specific config
items:
description: ProviderSpecificProperty holds the name and value of a configuration which is specific to individual DNS providers
properties:
name:
type: string
value:
type: string
type: object
type: array
recordTTL:
description: TTL for the record
format: int64
type: integer
recordType:
description: RecordType type of record, e.g. CNAME, A, SRV, TXT etc
type: string
setIdentifier:
description: Identifier to distinguish multiple records with the same name and type (e.g. Route53 records with routing policies other than 'simple')
type: string
targets:
description: The targets the DNS record points to
items:
type: string
type: array
type: object
type: array
type: object
status:
description: DNSEndpointStatus defines the observed state of DNSEndpoint
properties:
observedGeneration:
description: The generation observed by the external-dns controller.
format: int64
type: integer
type: object
type: object
served: true
storage: true
subresources:
status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
kubernetes/apps/networking/external-dns/app/helmrelease.yaml
+6 -5
View File
@@ -2,7 +2,7 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: external-dns
name: &app external-dns
namespace: networking
spec:
interval: 15m
@@ -26,8 +26,7 @@ spec:
uninstall:
keepHistory: false
values:
interval: 2m
# logLevel: debug
fullnameOverride: *app
provider: cloudflare
env:
- name: CF_API_EMAIL
@@ -41,10 +40,12 @@ spec:
name: external-dns-secret
key: api-key
extraArgs:
- --cloudflare-proxied
- --annotation-filter=external-dns.alpha.kubernetes.io/target
- --cloudflare-proxied
- --crd-source-apiversion=externaldns.k8s.io/v1alpha1
- --crd-source-kind=DNSEndpoint
policy: sync
sources: ["ingress"]
sources: ["crd", "ingress"]
txtPrefix: k8s.
txtOwnerId: default
domainFilters: ["${SECRET_DOMAIN}"]
kubernetes/apps/networking/external-dns/app/kustomization.yaml
+1
View File
@@ -3,5 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./dnsendpoint-crd.yaml
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/networking/ingress-nginx/app/cloudflare-networks.txt
-1
View File
@@ -1 +0,0 @@
173.245.48.0/20\,103.21.244.0/22\,103.22.200.0/22\,103.31.4.0/22\,141.101.64.0/18\,108.162.192.0/18\,190.93.240.0/20\,188.114.96.0/20\,197.234.240.0/22\,198.41.128.0/17\,162.158.0.0/15\,104.16.0.0/13\,104.24.0.0/14\,172.64.0.0/13\,131.0.72.0/22\,2400:cb00::/32\,2606:4700::/32\,2803:f800::/32\,2405:b500::/32\,2405:8100::/32\,2a06:98c0::/29\,2c0f:f248::/32
kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
+10 -26
View File
@@ -32,7 +32,8 @@ spec:
value: "${TIMEZONE}"
service:
annotations:
metallb.universe.tf/loadBalancerIPs: "${METALLB_INGRESS_ADDR}"
external-dns.alpha.kubernetes.io/hostname: "ipv4.${SECRET_DOMAIN}"
loadBalancerIP: "${METALLB_INGRESS_ADDR}"
externalTrafficPolicy: Local
publishService:
enabled: true
@@ -44,28 +45,20 @@ spec:
client-body-timeout: 120
custom-http-errors: 400,401,403,404,500,502,503,504
enable-brotli: "true"
forwarded-for-header: "CF-Connecting-IP"
hsts-max-age: "31449600"
keep-alive: 120
keep-alive-requests: 10000
proxy-body-size: "100M"
ssl-protocols: "TLSv1.3 TLSv1.2"
use-forwarded-headers: "true"
log-format-escape-json: "true"
log-format-upstream: >-
{"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr",
"x_forwarded_for": "$proxy_add_x_forwarded_for", "request_id": "$req_id",
"remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time,
"status": $status, "vhost": "$host", "request_proto": "$server_protocol",
"path": "$uri", "request_query": "$args", "request_length": $request_length,
"duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer",
"http_user_agent": "$http_user_agent"}
metrics:
enabled: false
enabled: true
serviceMonitor:
enabled: true
namespace: networking
namespaceSelector:
any: true
extraArgs:
default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
podAnnotations:
configmap.reloader.stakater.com/reload: cloudflare-networks
resources:
requests:
cpu: 10m
@@ -78,14 +71,5 @@ spec:
repository: ghcr.io/tarampampam/error-pages
tag: 2.24.0
extraEnvs:
- name: TEMPLATE_NAME
value: lost-in-space
- name: SHOW_DETAILS
value: "false"
valuesFrom:
# Cloudflare Networks
# https://www.cloudflare.com/ips/
- targetPath: controller.config.proxy-real-ip-cidr
kind: ConfigMap
name: cloudflare-networks
valuesKey: cloudflare-networks.txt
- { name: TEMPLATE_NAME, value: lost-in-space }
- { name: SHOW_DETAILS, value: "false" }
kubernetes/apps/networking/ingress-nginx/app/kustomization.yaml
-6
View File
@@ -4,9 +4,3 @@ kind: Kustomization
namespace: networking
resources:
- ./helmrelease.yaml
configMapGenerator:
- name: cloudflare-networks
files:
- ./cloudflare-networks.txt
generatorOptions:
disableNameSuffixHash: true
kubernetes/apps/networking/kustomization.yaml
-1
View File
@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cloudflare-ddns/ks.yaml
- ./external-dns/ks.yaml
- ./ingress-nginx/ks.yaml
- ./k8s-gateway/ks.yaml