infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: add bootstrap_acme_enable_production_certs config var

Browse Source 
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl committed 2023-07-15 15:25:27 -04:00
1 parent 983ba00cc6
commit 42e4de3eac
5 files changed
+30 -64
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.taskfiles/ClusterTasks.yaml
+1
View File
@@ -75,5 +75,6 @@ tasks:
- task: helmrepositories
- task: gitrepositories
- task: certificates
- task: certificaterequests
- task: ingresses
- task: pods
README.md
+14 -63
View File
@@ -295,9 +295,7 @@ The configure script will have created a `./ansible` directory and the following
task cluster:nodes
# NAME STATUS ROLES AGE VERSION
# k8s-0 Ready control-plane,etcd,master 1h v1.27.3+k3s1
# k8s-1 Ready control-plane,etcd,master 1h v1.27.3+k3s1
# k8s-2 Ready control-plane,etcd,master 1h v1.27.3+k3s1
# k8s-3 Ready worker 1h v1.27.3+k3s1
# k8s-1 Ready worker 1h v1.27.3+k3s1
```
### 🔹 GitOps with Flux
@@ -330,6 +328,7 @@ The configure script will have created a `./ansible` directory and the following
task cluster:install
# namespace/flux-system configured
# customresourcedefinition.apiextensions.k8s.io/alerts.notification.toolkit.fluxcd.io created
# ...
```
4. Verify Flux components are running in the cluster
@@ -428,54 +427,7 @@ If nothing is working, that is expected. This is DNS after all!
### 📜 Certificates
By default this template will deploy a wildcard certificate with the Let's Encrypt staging servers. This is to prevent you from getting rate-limited on configuration that might not be valid on bootstrap using the production server. Once you have confirmed the certificate is created and valid, make sure to switch to the Let's Encrypt production servers as outlined below. Do not enable the production certificate until you are sure you will keep the cluster up for more than a few hours.
1. Update the resources to use the production Let's Encrypt server:
```patch
diff --git a/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml b/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
index e582d4a..0f80700 100644
--- a/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
+++ b/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
@@ -60,7 +60,7 @@ spec:
namespaceSelector:
any: true
extraArgs:
- default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
+ default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
resources:
requests:
cpu: 10m
diff --git a/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml b/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml
index d57147d..f58e4a7 100644
--- a/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml
+++ b/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./staging.yaml
- # - ./production.yaml
+ - ./production.yaml
```
2. Commit and push your changes:
```sh
git add -A
git commit -m "fix: use production LE certificates"
git push
```
3. Force Flux to pick up the changes:
```sh
task cluster:reconcile
```
- To view the certificate request run `kubectl -n networking get certificaterequests`
- To verify the certificate is created run `kubectl -n networking get certificates`
You should start to see your applications using the new certificate.
By default this template will deploy a wildcard certificate with the Let's Encrypt staging servers. This is to prevent you from getting rate-limited on configuration that might not be valid on bootstrap using the production server. If you had `bootstrap_acme_enable_production_certs` set to `false` in your `bootstrap/vars/config.yaml`, make sure to switch to the Let's Encrypt production servers as outlined in that file. Do not enable the production certificate until you are sure you will keep the cluster up for more than a few hours.
### 🤖 Renovatebot
@@ -487,23 +439,22 @@ To enable Renovate on your repository, click the 'Configure' button over at thei
### 🪝 Github Webhook
Flux is pull-based by design meaning it will periodically check your git repository for changes, using a webhook you can enable Flux to update your cluster on `git push`. In order to configure Github to send `push` events from your repository to the Flux webhook receiver you will need two things:
Flux is pull-based by design meaning it will periodically check your git repository for changes, using a webhook you can enable Flux to update your cluster on `git push`. In order to configure Github to send `push` events from your repository you must find your hook id that is already generated.
1. Webhook URL - Your webhook receiver will be deployed on `https://flux-webhook.${bootstrap_cloudflare_domain}/hook/:hookId`. In order to find out your hook id you can run the following command:
1. Obtain the hook id and path
```sh
kubectl -n flux-system get receiver/github-receiver
# NAME AGE READY STATUS
# github-receiver 6h8m True Receiver initialized with URL: /hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
```
```sh
kubectl -n flux-system get receiver github-receiver -o jsonpath='{.status.webhookPath}'
/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
```
So if my domain was `onedr0p.com` the full url would look like this:
2. Piece your full URL with the hook path appended
```text
https://flux-webhook.onedr0p.com/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
```
```text
https://flux-webhook.${bootstrap_cloudflare_domain}/hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
```
Now that you have the webhook url and secret, it's time to set everything up on the Github repository side. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret.
3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret.
### 💾 Storage
bootstrap/templates/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml.j2
+5
View File
@@ -1,3 +1,4 @@
#jinja2: trim_blocks: True, lstrip_blocks: True
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
@@ -60,7 +61,11 @@ spec:
namespaceSelector:
any: true
extraArgs:
{% if bootstrap_acme_enable_production_certs | default(false) %}
default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
{% else %}
default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
{% endif %}
resources:
requests:
cpu: 10m
bootstrap/templates/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml.j2
+4 -1
View File
@@ -1,6 +1,9 @@
#jinja2: trim_blocks: True, lstrip_blocks: True
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./staging.yaml
# - ./production.yaml
{% if bootstrap_acme_enable_production_certs | default(false) %}
- ./production.yaml
{% endif %}
bootstrap/vars/config.sample.yaml
+6
View File
@@ -13,6 +13,12 @@ bootstrap_age_public_key:
bootstrap_timezone: Etc/UTC
# Email you want to be associated with the ACME account (used for TLS certificates via letsencrypt.org)
bootstrap_acme_email:
# Use ACME production servers when requesting the wildcard certificate
# The default here is `false` which means ACME staging certs will be used instead
# This is to prevent being rate-limited. Update this option to `true` when you
# have verified the staging certificate works and then re-run `task configure`
# and push your changes to Github.
bootstrap_acme_enable_production_certs: false
# Flux github webhook token (openssl rand -hex 12)
bootstrap_flux_github_webhook_token: