feat: update network and cert-manager ns (#1263)

* feat: update network and cert-manager ns Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update sops var name to be consistent with env Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-26 18:48:35 -05:00
1 parent 4ac206aef5
commit 3b0fcb7ba5
@@ -0,0 +1,23 @@
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -18,25 +18,3 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app cert-manager-issuers
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -4,3 +4,4 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cert-manager/ks.yaml
+  - ./cert-manager-issuers/ks.yaml
@@ -11,3 +11,4 @@ resources:
  #% if bootstrap_distribution in ['k0s', 'talos'] %#
  - ./spegel/ks.yaml
  #% endif %#
+  - ./reloader/ks.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app certificates
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/network/certificates/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -1,14 +1,10 @@
 ---
 originRequest:
-  http2Origin: true
+  originServerName: "external.${SECRET_DOMAIN}"

 ingress:
  - hostname: "${SECRET_DOMAIN}"
    service: https://nginx-external-controller.network.svc.cluster.local:443
-    originRequest:
-      originServerName: "external.${SECRET_DOMAIN}"
  - hostname: "*.${SECRET_DOMAIN}"
    service: https://nginx-external-controller.network.svc.cluster.local:443
-    originRequest:
-      originServerName: "external.${SECRET_DOMAIN}"
  - service: http_status:404
@@ -38,6 +38,7 @@ spec:
              NO_AUTOUPDATE: "true"
              TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
              TUNNEL_METRICS: 0.0.0.0:8080
+              TUNNEL_ORIGIN_ENABLE_HTTP2: true
              TUNNEL_TRANSPORT_PROTOCOL: quic
              TUNNEL_POST_QUANTUM: true
              TUNNEL_ID:
@@ -10,6 +10,7 @@ spec:
    labels:
      app.kubernetes.io/name: *app
  dependsOn:
+    - name: certificates
    - name: external-dns
  path: ./kubernetes/apps/network/cloudflared/app
  prune: true
@@ -25,7 +25,6 @@ spec:
  values:
    controllers:
      main:
-        replicas: 2
        strategy: RollingUpdate
        containers:
          main:
@@ -66,12 +65,27 @@ spec:
            port: *port
    ingress:
      main:
+        enabled: false
+      external:
        enabled: true
        className: external
        annotations:
          external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
        hosts:
-          - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  name: main
+                  port: http
+        tls:
+          - hosts:
+              - *host
+      internal:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}"
            paths:
              - path: /
                service:
@@ -3,8 +3,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
+  - ./certificates/ks.yaml
  - ./cloudflared/ks.yaml
  - ./echo-server/ks.yaml
  - ./external-dns/ks.yaml
  - ./k8s-gateway/ks.yaml
-  - ./nginx/ks.yaml
+  - ./nginx-external/ks.yaml
+  - ./nginx-internal/ks.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app nginx-external
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: certificates
+  path: ./kubernetes/apps/network/nginx-external/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
  name: nginx-internal
-  namespace: &namespace network
+  namespace: network
 spec:
  interval: 30m
  chart:
@@ -29,7 +29,6 @@ spec:
      replicaCount: 1
      service:
        annotations:
-          external-dns.alpha.kubernetes.io/hostname: "internal.${SECRET_DOMAIN}"
          io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app nginx-internal
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: certificates
+  path: ./kubernetes/apps/network/nginx-internal/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -1,66 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/apps/network/nginx/certificates
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-external
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: nginx-certificates
-  path: ./kubernetes/apps/network/nginx/external
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-internal
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: nginx-certificates
-  path: ./kubernetes/apps/network/nginx/internal
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m