diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 9fde0100..01665496 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -12,36 +12,25 @@ "dependencyDashboardTitle": "Renovate Dashboard 🤖", "suppressNotifications": ["prEditedNotification", "prIgnoreNotification"], "rebaseWhen": "conflicted", - "schedule": ["on saturday"], + "schedule": ["every weekend"], + "ignorePaths": ["**/*.sops.*"], "flux": { - "fileMatch": [ - "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$" - ] + "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"] }, "helm-values": { - "fileMatch": [ - "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$" - ] + "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"] }, "helmfile": { - "fileMatch": [ - "(^|/)helmfile\\.ya?ml(?:\\.j2)?$" - ] + "fileMatch": ["(^|/)helmfile\\.ya?ml(?:\\.j2)?$"] }, "kubernetes": { - "fileMatch": [ - "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$" - ] + "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"] }, "kustomize": { - "fileMatch": [ - "(^|/)kustomization\\.ya?ml(?:\\.j2)?$" - ] + "fileMatch": ["(^|/)kustomization\\.ya?ml(?:\\.j2)?$"] }, "pip_requirements": { - "fileMatch": [ - "(^|/)[\\w-]*requirements(-\\w+)?\\.(txt|pip)(?:\\.j2)?$" - ] + "fileMatch": ["(^|/)[\\w-]*requirements(-\\w+)?\\.(txt|pip)(?:\\.j2)?$"] }, // commit message topics "commitMessageTopic": "{{depName}}", @@ -62,7 +51,7 @@ { "description": ["Flux Group"], "groupName": "Flux", - "matchPackagePatterns": ["flux"], + "matchPackagePatterns": ["fluxcd"], "matchDatasources": ["docker", "github-tags"], "versioning": "semver", "group": { @@ -71,10 +60,13 @@ "separateMinorPatch": true }, { - "description": ["System Upgrade Controller Group"], - "groupName": "System Upgrade Controller", - "matchPackagePatterns": ["system-upgrade-controller"], - "matchDatasources": ["docker", "github-releases"], + "description": ["Talos Group"], + "groupName": "Talos", + "matchPackagePatterns": [ + "siderolabs/talosctl", + "siderolabs/installer" + ], + "matchDatasources": ["docker"], "group": { "commitMessageTopic": "{{{groupName}}} group" }, @@ -199,10 +191,7 @@ { "customType": "regex", "description": ["Process custom dependencies"], - "fileMatch": [ - "(^|/).taskfiles/.+\\.ya?ml$", - "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$" - ], + "fileMatch": ["(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"], "matchStrings": [ // # renovate: datasource=helm depName=cilium repository=https://helm.cilium.io // version: 1.15.1 diff --git a/.taskfiles/Sops/Taskfile.yaml b/.taskfiles/Sops/Taskfile.yaml index 8aacdd47..7880a005 100644 --- a/.taskfiles/Sops/Taskfile.yaml +++ b/.taskfiles/Sops/Taskfile.yaml @@ -2,9 +2,6 @@ # yaml-language-server: $schema=https://taskfile.dev/schema.json version: "3" -vars: - SOPS_CONFIG_FILE: "{{.ROOT_DIR}}/.sops.yaml" - tasks: age-keygen: @@ -13,7 +10,7 @@ tasks: status: ["test -f {{.AGE_FILE}}"] encrypt: - desc: Encrypt all Kubernetes SOPS secrets that are not already encrypted + desc: Encrypt all Kubernetes SOPS secrets cmds: - for: { var: file } task: .encrypt-file @@ -21,10 +18,7 @@ tasks: file: "{{.ITEM}}" vars: file: - sh: | - if [ -d "{{.KUBERNETES_DIR}}" ]; then - find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \; - fi + sh: find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \; .encrypt-file: internal: true diff --git a/.taskfiles/Talos/Taskfile.yaml b/.taskfiles/Talos/Taskfile.yaml index 8791c0af..07758c3a 100644 --- a/.taskfiles/Talos/Taskfile.yaml +++ b/.taskfiles/Talos/Taskfile.yaml @@ -6,6 +6,7 @@ vars: TALOS_DIR: "{{.KUBERNETES_DIR}}/bootstrap/talos" TALHELPER_SECRET_FILE: "{{.TALOS_DIR}}/talsecret.sops.yaml" TALHELPER_CONFIG_FILE: "{{.TALOS_DIR}}/talconfig.yaml" + HELMFILE_FILE: "{{.TALOS_DIR}}/helmfile.yaml" env: TALOSCONFIG: "{{.TALOS_DIR}}/clusterconfig/talosconfig" @@ -16,66 +17,45 @@ tasks: desc: Bootstrap the Talos cluster dir: "{{.TALOS_DIR}}" cmds: - - task: bootstrap-gensecret - - task: bootstrap-genconfig - - task: bootstrap-apply - - task: bootstrap-install - - task: fetch-kubeconfig - - task: bootstrap-apps - - talosctl health --server=false - - bootstrap-gensecret: - desc: Generate the Talos secrets - dir: "{{.TALOS_DIR}}" - cmds: - - talhelper gensecret > {{.TALHELPER_SECRET_FILE}} - - task: :sops:.encrypt-file - vars: - file: "{{.TALHELPER_SECRET_FILE}}" - status: ["test -f {{.TALHELPER_SECRET_FILE}}"] - preconditions: - - msg: Missing talhelper config file - sh: test -f {{.TALHELPER_CONFIG_FILE}} - - bootstrap-genconfig: - desc: Generate the Talos configs - dir: "{{.TALOS_DIR}}" - cmd: talhelper genconfig --secret-file {{.TALHELPER_SECRET_FILE}} - preconditions: - - msg: Missing talhelper config file - sh: test -f {{.TALHELPER_CONFIG_FILE}} - - msg: Missing talhelper secret file - sh: test -f {{.TALHELPER_SECRET_FILE}} - - bootstrap-apply: - desc: Apply the Talos configs to the nodes - dir: "{{.TALOS_DIR}}" - cmd: talhelper gencommand apply --extra-flags=--insecure | bash - preconditions: - - msg: Missing talhelper config file - sh: test -f {{.TALHELPER_CONFIG_FILE}} - - bootstrap-install: - desc: Install the Talos cluster - dir: "{{.TALOS_DIR}}" - cmds: - - echo "Installing Talos... ignore the errors and be patient" + - | + if [ ! -f "{{.TALHELPER_SECRET_FILE}}" ]; then + talhelper gensecret > {{.TALHELPER_SECRET_FILE}} + sops --encrypt --in-place {{.TALHELPER_SECRET_FILE}} + fi + - talhelper genconfig --secret-file {{.TALHELPER_SECRET_FILE}} + - talhelper gencommand apply --extra-flags=--insecure | bash - until talhelper gencommand bootstrap | bash; do sleep 10; done - - sleep 10 + - task: fetch-kubeconfig + - task: install-helm-apps + - talosctl health --server=false + preconditions: + - msg: Missing talhelper config file + sh: test -f {{.TALHELPER_CONFIG_FILE}} + - msg: Missing Sops config file + sh: test -f {{.SOPS_CONFIG_FILE}} + - msg: Missing Sops Age key file + sh: test -f {{.AGE_FILE}} + + fetch-kubeconfig: + desc: Fetch kubeconfig + dir: "{{.TALOS_DIR}}" + cmd: until talhelper gencommand kubeconfig --extra-flags "{{.ROOT_DIR}} --force" | bash; do sleep 10; done preconditions: - msg: Missing talhelper config file sh: test -f {{.TALHELPER_CONFIG_FILE}} - bootstrap-apps: + install-helm-apps: desc: Bootstrap core apps needed for Talos dir: "{{.TALOS_DIR}}" cmds: - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done - - helmfile --kubeconfig {{.KUBECONFIG_FILE}} --file helmfile.yaml apply --skip-diff-on-install --suppress-diff + - helmfile --kubeconfig {{.KUBECONFIG_FILE}} --file {{.HELMFILE_FILE}} apply --skip-diff-on-install --suppress-diff - until kubectl --kubeconfig {{.KUBECONFIG_FILE}} wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done preconditions: - msg: Missing kubeconfig sh: test -f {{.KUBECONFIG_FILE}} + - msg: Missing helmfile + sh: test -f {{.HELMFILE_FILE}} upgrade-talos: desc: Upgrade talos on a node @@ -95,13 +75,8 @@ tasks: - msg: Node not found sh: talosctl --nodes {{.node}} get machineconfig - fetch-kubeconfig: - desc: Generate talos kubeconfig - dir: "{{.TALOS_DIR}}" - cmd: until talhelper gencommand kubeconfig --extra-flags "{{.ROOT_DIR}} --force" | bash; do sleep 10; done - nuke: - desc: Resets nodes back to maintenance mode so you can re-deploy again straight after + desc: Resets nodes back to maintenance mode prompt: This will destroy your cluster and reset the nodes back to maintenance mode... continue? dir: "{{.TALOS_DIR}}" cmd: talhelper gencommand reset --extra-flags "--reboot {{- if eq .CLI_FORCE false }}--system-labels-to-wipe STATE --system-labels-to-wipe EPHEMERAL{{ end }} --graceful=false --wait=false" | bash diff --git a/Taskfile.yaml b/Taskfile.yaml index cecceffa..c812b9db 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -14,6 +14,7 @@ vars: KUBECONFIG_FILE: "{{.ROOT_DIR}}/kubeconfig" MAKEJINJA_CONFIG_FILE: "{{.ROOT_DIR}}/makejinja.toml" PIP_REQUIREMENTS_FILE: "{{.ROOT_DIR}}/requirements.txt" + SOPS_CONFIG_FILE: "{{.ROOT_DIR}}/.sops.yaml" # Binaries PYTHON_BIN: python3 @@ -24,23 +25,19 @@ env: VIRTUAL_ENV: "{{.ROOT_DIR}}/.venv" includes: - kubernetes: - aliases: ["k8s"] - taskfile: .taskfiles/Kubernetes/Taskfile.yaml - flux: .taskfiles/Flux/Taskfile.yaml - repository: - aliases: ["repo"] - taskfile: .taskfiles/Repository/Taskfile.yaml - talos: .taskfiles/Talos/Taskfile.yaml - sops: .taskfiles/Sops/Taskfile.yaml - workstation: .taskfiles/Workstation/Taskfile.yaml + kubernetes: .taskfiles/Kubernetes + flux: .taskfiles/Flux + repository: .taskfiles/Repository + talos: .taskfiles/Talos + sops: .taskfiles/Sops + workstation: .taskfiles/Workstation user: taskfile: .taskfiles/User optional: true tasks: - default: task -l + default: task --list init: desc: Initialize configuration files @@ -49,7 +46,8 @@ tasks: - cmd: echo === Configuration file copied === - cmd: echo Proceed with updating the configuration files... - cmd: echo {{.BOOTSTRAP_CONFIG_FILE}} - status: ["test -f {{.BOOTSTRAP_CONFIG_FILE}}"] + status: + - test -f {{.BOOTSTRAP_CONFIG_FILE}} silent: true configure: @@ -65,10 +63,14 @@ tasks: internal: true cmd: "{{.VIRTUAL_ENV}}/bin/makejinja" preconditions: - - { msg: "Missing virtual environment", sh: "test -d {{.VIRTUAL_ENV}}" } - - { msg: "Missing Makejinja config file", sh: "test -f {{.MAKEJINJA_CONFIG_FILE}}" } - - { msg: "Missing Makejinja plugin file", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/plugin.py" } - - { msg: "Missing bootstrap config file", sh: "test -f {{.BOOTSTRAP_CONFIG_FILE}}" } + - msg: Missing virtual environment + sh: test -d {{.VIRTUAL_ENV}} + - msg: Missing Makejinja config file + sh: test -f {{.MAKEJINJA_CONFIG_FILE}} + - msg: Missing Makejinja plugin file + sh: test -f {{.BOOTSTRAP_DIR}}/scripts/plugin.py + - msg: Missing bootstrap config file + sh: test -f {{.BOOTSTRAP_CONFIG_FILE}} .validate: internal: true