feat!: switch from ingress-nginx to traefik

2021-08-26 08:51:40 -04:00
1 parent ae5e4429c4
commit 40dca8305c
@@ -25,6 +25,7 @@ spec:
      namespaceSelector:
        matchNames:
          - default
+          - networking
      name: "you"
      customApps:
        - name: Some External Cluster Service
@@ -98,8 +99,9 @@ spec:
    ingress:
      main:
        enabled: true
-        ingressClassName: nginx
+        ingressClassName: "traefik"
        annotations:
+          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
          hajimari.io/enable: "true"
          hajimari.io/icon: "weather-sunset"
        hosts:
@@ -1,41 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: ingress-nginx
-  namespace: networking
-spec:
-  interval: 5m
-  chart:
-    spec:
-      # renovate: registryUrl=https://kubernetes.github.io/ingress-nginx
-      chart: ingress-nginx
-      version: 4.0.1
-      sourceRef:
-        kind: HelmRepository
-        name: ingress-nginx-charts
-        namespace: flux-system
-  values:
-    controller:
-      ingressClass: nginx
-      replicaCount: 1
-      service:
-        type: LoadBalancer
-        loadBalancerIP: "${INGRESS_NGINX_LB}"
-        externalTrafficPolicy: Local
-      config:
-        ssl-protocols: "TLSv1.3 TLSv1.2"
-        proxy-body-size: "100m"
-        use-forwarded-headers: "true"
-      metrics:
-        enabled: false
-        serviceMonitor:
-          enabled: false
-      extraArgs:
-        default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-tls"
-      resources:
-        requests:
-          memory: 100Mi
-          cpu: 100m
-        limits:
-          memory: 500Mi
@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ingress-nginx
+  - traefik
  - wildcard-certificate
@@ -0,0 +1,28 @@
+  
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: traefik-dashboard
+  namespace: networking
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    hajimari.io/enable: "true"
+    hajimari.io/icon: "web"
+    hajimari.io/appName: "traefik"
+spec:
+  tls:
+    - hosts:
+        - "traefik.${SECRET_DOMAIN}"
+      secretName: "${SECRET_DOMAIN/./-}-tls"
+  rules:
+    - host: "traefik.${SECRET_DOMAIN}"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: traefik
+                port:
+                  number: 9000
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress.yaml
@@ -0,0 +1,85 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: networking
+spec:
+  interval: 5m
+  chart:
+    spec:
+      # renovate: registryUrl=https://helm.traefik.io/traefik
+      chart: traefik
+      version: 10.3.2
+      sourceRef:
+        kind: HelmRepository
+        name: traefik-charts
+        namespace: flux-system
+      interval: 5m
+  dependsOn:
+    - name: cert-manager
+      namespace: cert-manager
+  values:
+    image:
+      name: ghcr.io/k8s-at-home/traefik
+    deployment:
+      kind: Deployment
+      replicas: 1
+    service:
+      enabled: true
+      type: LoadBalancer
+      spec:
+        loadBalancerIP: "${SVC_TRAEFIK_ADDR}"
+        externalTrafficPolicy: Local
+    logs:
+      general:
+        format: json
+        level: DEBUG
+      access:
+        enabled: true
+        format: json
+    ingressClass:
+      enabled: true
+      isDefaultClass: true
+      fallbackApiVersion: v1
+    ingressRoute:
+      dashboard:
+        enabled: false
+    globalArguments:
+      - "--api.insecure=true"
+      - "--serverstransport.insecureskipverify=true"
+      - "--providers.kubernetesingress.ingressclass=traefik"
+      - "--metrics.prometheus=true"
+      - "--metrics.prometheus.entryPoint=metrics"
+    additionalArguments:
+      - "--providers.kubernetesingress.ingressendpoint.ip=${SVC_TRAEFIK_ADDR}"
+      - "--providers.kubernetescrd.allowexternalnameservices=true"
+    ports:
+      traefik:
+        expose: true
+      web:
+        redirectTo: websecure
+      websecure:
+        tls:
+          enabled: true
+          options: "default"
+      metrics:
+        port: 8082
+        expose: true
+        exposedPort: 8082
+    tlsOptions:
+      default:
+        minVersion: VersionTLS12
+        maxVersion: VersionTLS13
+        sniStrict: true
+    pilot:
+      enabled: false
+    experimental:
+      plugins:
+        enabled: false
+    resources:
+      requests:
+        memory: 100Mi
+        cpu: 500m
+      limits:
+        memory: 500Mi
@@ -2,3 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - helm-release.yaml
+  - tls-store
+  - dashboard
@@ -0,0 +1,9 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSStore
+metadata:
+  name: default
+  namespace: networking
+spec:
+  defaultCertificate:
+    secretName: "${SECRET_DOMAIN/./-}-tls"
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - default.yaml
@@ -2,9 +2,9 @@
 apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: HelmRepository
 metadata:
-  name: ingress-nginx-charts
+  name: authentik-charts
  namespace: flux-system
 spec:
  interval: 1h
-  url: https://kubernetes.github.io/ingress-nginx
+  url: https://docker.beryju.org/chartrepo/authentik
  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: deliveryhero-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://charts.deliveryhero.io/
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: descheduler-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/descheduler
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: external-dns-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/external-dns
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: grafana-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://grafana.github.io/helm-charts
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: infracloudio-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://infracloudio.github.io/charts
+  timeout: 3m
@@ -1,9 +1,23 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - authentik-charts.yaml
  - bitnami-charts.yaml
+  - deliveryhero-charts.yaml
+  - descheduler-charts.yaml
+  - external-dns-charts.yaml
+  - grafana-charts.yaml
  - hajimari-charts.yaml
-  - ingress-nginx-charts.yaml
+  - infracloudio-charts.yaml
  - jetstack-charts.yaml
  - k8s-at-home-charts.yaml
  - metallb-charts.yaml
+  - minecraft-server-charts.yaml
+  - minio-charts.yaml
+  - nfs-subdir-external-provisioner-charts.yaml
+  - node-feature-discovery-charts.yaml
+  - prometheus-community-charts.yaml
+  - rook-ceph-charts.yaml
+  - stakater-charts.yaml
+  - traefik-charts.yaml
+  - weaveworks-kured-charts.yaml
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: minecraft-server-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://itzg.github.io/minecraft-server-charts/
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: minio-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://operator.min.io
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: nfs-subdir-external-provisioner-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: node-feature-discovery-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/node-feature-discovery/charts
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: prometheus-community-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://prometheus-community.github.io/helm-charts
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: rook-ceph-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://charts.rook.io/release
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: stakater-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://stakater.github.io/stakater-charts
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: traefik-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://helm.traefik.io/traefik
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: weaveworks-kured-charts
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://weaveworks.github.io/kured
+  timeout: 3m
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - cert-manager
+  - traefik
@@ -0,0 +1,57 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: traefik-crd-source
+  namespace: flux-system
+spec:
+  interval: 30m
+  url: https://github.com/traefik/traefik-helm-chart.git
+  ref:
+    # renovate: registryUrl=https://helm.traefik.io/traefik chart=traefik
+    tag: v10.3.2
+  ignore: |
+    # exclude all
+    /*
+    # path to crds
+    !/traefik/crds/
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
+kind: Kustomization
+metadata:
+  name: traefik-crds
+  namespace: flux-system
+spec:
+  interval: 15m
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: traefik-crd-source
+  healthChecks:
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: ingressroutes.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: ingressroutetcps.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: ingressrouteudps.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: middlewares.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: middlewaretcps.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: serverstransports.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: tlsoptions.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: tlsstores.traefik.containo.us
+    - apiVersion: apiextensions.k8s.io/v1
+      kind: CustomResourceDefinition
+      name: traefikservices.traefik.containo.us
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - crds.yaml