From 4e6edcc66a7cee52fb74d454bd36a55bfc600b85 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Wed, 21 Dec 2022 14:22:18 -0500 Subject: [PATCH] feat!: Refector directories and flux apps (#559) --- .config.sample.env | 14 +- .editorconfig | 3 - .envrc | 2 +- .gitattributes | 2 + .github/CODEOWNERS | 2 - .github/ISSUE_TEMPLATE/bug-report.md | 12 -- .github/ISSUE_TEMPLATE/config.yml | 6 - .github/ISSUE_TEMPLATE/feature-request.md | 12 -- .github/ISSUE_TEMPLATE/question.md | 12 -- .github/PULL_REQUEST_TEMPLATE.md | 20 --- .github/linters/.ansible-lint | 3 - .github/linters/.markdownlint.yaml | 23 --- .github/linters/.prettierignore | 2 - .github/linters/.prettierrc.yaml | 5 - .github/linters/.tflint.hcl | 0 .github/renovate.json5 | 38 +---- .github/workflows/lint.yaml | 61 -------- .gitignore | 2 - .pre-commit-config.yaml | 30 +--- .secretlintignore | 3 - .sourceignore | 17 --- .taskfiles/AnsibleTasks.yml | 18 +-- .taskfiles/ClusterTasks.yml | 12 +- .taskfiles/SopsTasks.yml | 8 +- .taskfiles/TerraformTasks.yml | 6 +- .vscode/extensions.json | 10 +- .vscode/settings.json | 22 +-- .../linters/.yamllint.yaml => .yamllint.yaml | 1 - README.md | 33 ++--- Taskfile.yml | 9 +- ansible.cfg | 4 +- .../inventory/group_vars/kubernetes/k3s.yml | 0 .../inventory/group_vars/kubernetes/os.yml | 0 .../inventory/group_vars/master/k3s.yml | 12 -- .../inventory/group_vars/worker/k3s.yml | 3 - .../inventory/host_vars}/.gitkeep | 0 .../playbooks/cluster-installation.yml | 10 +- .../playbooks/cluster-nuke.yml | 0 .../playbooks/cluster-prepare.yml | 0 .../playbooks/cluster-reboot.yml | 0 .../templates/calico-installation.yaml.j2 | 0 .../templates/kube-vip-daemonset.yaml.j2 | 7 +- .../ansible => ansible}/requirements.yml | 0 cluster/apps/default/hajimari/config-pvc.yaml | 13 -- .../apps/default/hajimari/helm-release.yaml | 131 ------------------ .../cert-manager/issuers/helm-release.yaml | 69 --------- .../cert-manager/kustomization.yaml | 5 - .../kube-system/cloudflare-ddns/cron-job.yaml | 42 ------ cluster/apps/kube-system/kustomization.yaml | 14 -- .../metallb/config/helm-release.yaml | 45 ------ .../metallb/config/kustomization.yaml | 4 - cluster/apps/kustomization.yaml | 7 - .../system-upgrade/kured/helm-release.yaml | 32 ----- .../system-upgrade/kured/kustomization.yaml | 5 - .../apps/system-upgrade/kustomization.yaml | 9 -- .../kustomization.yaml | 27 ---- cluster/flux/config/kustomization.yaml | 6 - .../repositories/helm/kubereboot-charts.yaml | 9 -- .../flux/repositories/helm/kustomization.yaml | 16 --- configure | 109 +++++++++------ .../cert-manager/app/helmrelease.yaml | 20 ++- .../cert-manager/app/kustomization.yaml | 17 +++ .../cert-manager/app/prometheusrule.yaml | 68 +++++++++ .../cert-manager/issuers/issuers.yaml | 41 ++++++ .../cert-manager/issuers}/kustomization.yaml | 2 +- .../apps/cert-manager/cert-manager/ks.yaml | 41 ++++++ .../apps/cert-manager}/kustomization.yaml | 3 +- kubernetes/apps/cert-manager/namespace.yaml | 7 + .../default/echo-server/app/helmrelease.yaml | 29 ++-- .../echo-server/app}/kustomization.yaml | 3 +- kubernetes/apps/default/echo-server/ks.yaml | 22 +++ .../default/hajimari/app/helmrelease.yaml | 62 +++++++++ .../default/hajimari/app}/kustomization.yaml | 3 +- kubernetes/apps/default/hajimari/ks.yaml | 22 +++ kubernetes/apps/default/kustomization.yaml | 7 + .../apps/default/namespace.yaml | 0 kubernetes/apps/flux-system/addons/ks.yaml | 18 +++ .../addons}/webhooks/github/ingress.yaml | 4 +- .../webhooks/github/kustomization.yaml | 2 +- .../addons}/webhooks/github/receiver.yaml | 16 +-- .../addons}/webhooks/kustomization.yaml | 0 .../apps/flux-system/kustomization.yaml | 7 + kubernetes/apps/flux-system/namespace.yaml | 7 + .../weave-gitops/app/helmrelease.yaml | 54 ++++++++ .../weave-gitops/app/kustomization.yaml | 7 + .../apps/flux-system/weave-gitops/ks.yaml | 22 +++ .../kube-system/kube-vip/app/daemonset.yaml | 9 +- .../kube-vip/app}/kustomization.yaml | 1 + .../apps/kube-system/kube-vip/app}/rbac.yaml | 0 kubernetes/apps/kube-system/kube-vip/ks.yaml | 22 +++ .../apps/kube-system/kustomization.yaml | 8 ++ .../metrics-server/app/helmrelease.yaml | 9 +- .../metrics-server/app}/kustomization.yaml | 4 +- .../apps/kube-system/metrics-server/ks.yaml | 22 +++ .../apps/kube-system/namespace.yaml | 0 .../kube-system/reloader/app/helmrelease.yaml | 16 ++- .../reloader/app/kustomization.yaml | 6 + kubernetes/apps/kube-system/reloader/ks.yaml | 22 +++ .../cloudflare-ddns/app}/cloudflare-ddns.sh | 0 .../cloudflare-ddns/app/helmrelease.yaml | 49 +++++++ .../cloudflare-ddns/app}/kustomization.yaml | 6 +- .../apps/networking/cloudflare-ddns/ks.yaml | 21 +++ .../external-dns/app/helmrelease.yaml | 34 ++--- .../external-dns/app}/kustomization.yaml | 4 +- .../apps/networking/external-dns/ks.yaml | 22 +++ .../ingress-nginx/app/cloudflare-networks.txt | 0 .../ingress-nginx/app/helmrelease.yaml | 18 ++- .../ingress-nginx/app}/kustomization.yaml | 8 +- .../apps/networking/ingress-nginx/ks.yaml | 27 ++++ .../k8s-gateway/app/helmrelease.yaml | 5 +- .../k8s-gateway/app}/kustomization.yaml | 4 +- .../apps/networking/k8s-gateway/ks.yaml | 25 ++++ kubernetes/apps/networking/kustomization.yaml | 10 ++ .../networking/metallb/app/helmrelease.yaml | 6 +- .../networking/metallb/app/kustomization.yaml | 6 + .../metallb/config}/kustomization.yaml | 4 +- .../networking/metallb/config/resources.yaml | 18 +++ kubernetes/apps/networking/metallb/ks.yaml | 42 ++++++ kubernetes/apps/networking/namespace.yaml | 7 + .../apps/system-upgrade/kustomization.yaml | 6 + .../apps/system-upgrade/namespace.yaml | 0 .../app/kustomization.yaml | 20 +++ .../system-upgrade-controller/ks.yaml | 38 +++++ .../plans/agent.yaml | 17 +-- .../plans/kustomization.yaml | 2 +- .../plans/server.yaml | 14 +- .../bootstrap/kustomization.yaml | 22 ++- {cluster => kubernetes}/flux/apps.yaml | 9 +- .../flux/config/flux.yaml | 41 +++--- .../flux/config}/kustomization.yaml | 3 +- .../flux/repositories/git}/.gitkeep | 0 .../flux/repositories/helm/bitnami.yaml | 0 .../flux/repositories/helm/bjw-s.yaml | 0 .../flux/repositories/helm/external-dns.yaml | 0 .../flux/repositories/helm/hajimari.yaml | 0 .../flux/repositories/helm/ingress-nginx.yaml | 0 .../flux/repositories/helm/jetstack.yaml | 0 .../flux/repositories/helm/k8s-gateway.yaml | 0 .../flux/repositories/helm/kustomization.yaml | 15 ++ .../flux/repositories/helm/metallb.yaml | 0 .../repositories/helm/metrics-server.yaml | 0 .../flux/repositories/helm/stakater.yaml | 0 .../flux/repositories/helm/weave-gitops.yaml | 4 +- .../flux/repositories/kustomization.yaml | 0 .../flux/repositories/oci}/.gitkeep | 0 .../flux/vars/kustomization.yaml | 0 .../cloudflare/main.tf | 26 ++-- tmpl/.sops.yaml | 15 +- tmpl/cluster/cert-manager-secret.sops.yaml | 8 -- tmpl/cluster/cloudflare-ddns-secret.sops.yaml | 11 -- tmpl/cluster/cluster-secrets.sops.yaml | 9 -- tmpl/cluster/cluster-settings.yaml | 11 -- tmpl/cluster/external-dns-secret.sops.yaml | 9 -- tmpl/cluster/flux/kustomization.yaml | 5 - tmpl/kubernetes/cert-manager-secret.sops.yaml | 8 ++ .../cloudflare-ddns-secret.sops.yaml | 11 ++ tmpl/kubernetes/cluster-secrets.sops.yaml | 9 ++ tmpl/kubernetes/external-dns-secret.sops.yaml | 9 ++ tmpl/kubernetes/flux/cluster-settings.yaml | 12 ++ .../flux/cluster.yaml} | 15 +- .../github-webhook-token-secret.sops.yaml} | 4 +- tmpl/kubernetes/weave-gitops-secret.sops.yaml | 8 ++ tmpl/terraform/secret.sops.yaml | 7 +- 163 files changed, 1194 insertions(+), 1060 deletions(-) delete mode 100644 .github/CODEOWNERS delete mode 100644 .github/ISSUE_TEMPLATE/bug-report.md delete mode 100644 .github/ISSUE_TEMPLATE/config.yml delete mode 100644 .github/ISSUE_TEMPLATE/feature-request.md delete mode 100644 .github/ISSUE_TEMPLATE/question.md delete mode 100644 .github/PULL_REQUEST_TEMPLATE.md delete mode 100644 .github/linters/.ansible-lint delete mode 100644 .github/linters/.markdownlint.yaml delete mode 100644 .github/linters/.prettierignore delete mode 100644 .github/linters/.prettierrc.yaml delete mode 100644 .github/linters/.tflint.hcl delete mode 100644 .github/workflows/lint.yaml delete mode 100644 .secretlintignore delete mode 100644 .sourceignore rename .github/linters/.yamllint.yaml => .yamllint.yaml (93%) rename {provision/ansible => ansible}/inventory/group_vars/kubernetes/k3s.yml (100%) rename {provision/ansible => ansible}/inventory/group_vars/kubernetes/os.yml (100%) rename {provision/ansible => ansible}/inventory/group_vars/master/k3s.yml (72%) rename {provision/ansible => ansible}/inventory/group_vars/worker/k3s.yml (71%) rename {cluster/flux/repositories/git => ansible/inventory/host_vars}/.gitkeep (100%) rename {provision/ansible => ansible}/playbooks/cluster-installation.yml (94%) rename {provision/ansible => ansible}/playbooks/cluster-nuke.yml (100%) rename {provision/ansible => ansible}/playbooks/cluster-prepare.yml (100%) rename {provision/ansible => ansible}/playbooks/cluster-reboot.yml (100%) rename {provision/ansible => ansible}/playbooks/templates/calico-installation.yaml.j2 (100%) rename {provision/ansible => ansible}/playbooks/templates/kube-vip-daemonset.yaml.j2 (94%) rename {provision/ansible => ansible}/requirements.yml (100%) delete mode 100644 cluster/apps/default/hajimari/config-pvc.yaml delete mode 100644 cluster/apps/default/hajimari/helm-release.yaml delete mode 100644 cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml delete mode 100644 cluster/apps/kube-system/cert-manager/kustomization.yaml delete mode 100644 cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml delete mode 100644 cluster/apps/kube-system/kustomization.yaml delete mode 100644 cluster/apps/kube-system/metallb/config/helm-release.yaml delete mode 100644 cluster/apps/kube-system/metallb/config/kustomization.yaml delete mode 100644 cluster/apps/kustomization.yaml delete mode 100644 cluster/apps/system-upgrade/kured/helm-release.yaml delete mode 100644 cluster/apps/system-upgrade/kured/kustomization.yaml delete mode 100644 cluster/apps/system-upgrade/kustomization.yaml delete mode 100644 cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml delete mode 100644 cluster/flux/config/kustomization.yaml delete mode 100644 cluster/flux/repositories/helm/kubereboot-charts.yaml delete mode 100644 cluster/flux/repositories/helm/kustomization.yaml rename cluster/apps/kube-system/cert-manager/helm-release.yaml => kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml (70%) create mode 100644 kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml create mode 100644 kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml create mode 100644 kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml rename {cluster/apps/kube-system/external-dns => kubernetes/apps/cert-manager/cert-manager/issuers}/kustomization.yaml (80%) create mode 100644 kubernetes/apps/cert-manager/cert-manager/ks.yaml rename {cluster/apps/default => kubernetes/apps/cert-manager}/kustomization.yaml (75%) create mode 100644 kubernetes/apps/cert-manager/namespace.yaml rename cluster/apps/default/echo-server/helm-release.yaml => kubernetes/apps/default/echo-server/app/helmrelease.yaml (72%) rename {cluster/apps/kube-system/metrics-server => kubernetes/apps/default/echo-server/app}/kustomization.yaml (65%) create mode 100644 kubernetes/apps/default/echo-server/ks.yaml create mode 100644 kubernetes/apps/default/hajimari/app/helmrelease.yaml rename {cluster/apps/default/echo-server => kubernetes/apps/default/hajimari/app}/kustomization.yaml (65%) create mode 100644 kubernetes/apps/default/hajimari/ks.yaml create mode 100644 kubernetes/apps/default/kustomization.yaml rename {cluster => kubernetes}/apps/default/namespace.yaml (100%) create mode 100644 kubernetes/apps/flux-system/addons/ks.yaml rename {tmpl/cluster/flux => kubernetes/apps/flux-system/addons}/webhooks/github/ingress.yaml (87%) rename {tmpl/cluster/flux => kubernetes/apps/flux-system/addons}/webhooks/github/kustomization.yaml (100%) rename {tmpl/cluster/flux => kubernetes/apps/flux-system/addons}/webhooks/github/receiver.yaml (59%) rename {tmpl/cluster/flux => kubernetes/apps/flux-system/addons}/webhooks/kustomization.yaml (100%) create mode 100644 kubernetes/apps/flux-system/kustomization.yaml create mode 100644 kubernetes/apps/flux-system/namespace.yaml create mode 100644 kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml create mode 100644 kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml create mode 100644 kubernetes/apps/flux-system/weave-gitops/ks.yaml rename tmpl/cluster/kube-vip-daemonset.yaml => kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml (92%) rename {cluster/apps/kube-system/kube-vip => kubernetes/apps/kube-system/kube-vip/app}/kustomization.yaml (88%) rename {cluster/apps/kube-system/kube-vip => kubernetes/apps/kube-system/kube-vip/app}/rbac.yaml (100%) create mode 100644 kubernetes/apps/kube-system/kube-vip/ks.yaml create mode 100644 kubernetes/apps/kube-system/kustomization.yaml rename cluster/apps/kube-system/metrics-server/helm-release.yaml => kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml (84%) rename {cluster/apps/default/hajimari => kubernetes/apps/kube-system/metrics-server/app}/kustomization.yaml (63%) create mode 100644 kubernetes/apps/kube-system/metrics-server/ks.yaml rename {cluster => kubernetes}/apps/kube-system/namespace.yaml (100%) rename cluster/apps/kube-system/reloader/helm-release.yaml => kubernetes/apps/kube-system/reloader/app/helmrelease.yaml (59%) create mode 100644 kubernetes/apps/kube-system/reloader/app/kustomization.yaml create mode 100644 kubernetes/apps/kube-system/reloader/ks.yaml rename {cluster/apps/kube-system/cloudflare-ddns => kubernetes/apps/networking/cloudflare-ddns/app}/cloudflare-ddns.sh (100%) create mode 100644 kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml rename {cluster/apps/kube-system/cloudflare-ddns => kubernetes/apps/networking/cloudflare-ddns/app}/kustomization.yaml (77%) create mode 100644 kubernetes/apps/networking/cloudflare-ddns/ks.yaml rename cluster/apps/kube-system/external-dns/helm-release.yaml => kubernetes/apps/networking/external-dns/app/helmrelease.yaml (60%) rename {cluster/apps/kube-system/cert-manager/issuers => kubernetes/apps/networking/external-dns/app}/kustomization.yaml (66%) create mode 100644 kubernetes/apps/networking/external-dns/ks.yaml rename cluster/apps/kube-system/ingress-nginx/cloudflare-proxied-networks.txt => kubernetes/apps/networking/ingress-nginx/app/cloudflare-networks.txt (100%) rename cluster/apps/kube-system/ingress-nginx/helm-release.yaml => kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml (84%) rename {cluster/apps/kube-system/ingress-nginx => kubernetes/apps/networking/ingress-nginx/app}/kustomization.yaml (55%) create mode 100644 kubernetes/apps/networking/ingress-nginx/ks.yaml rename cluster/apps/kube-system/k8s-gateway/helm-release.yaml => kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml (89%) rename {cluster/apps/kube-system/metallb => kubernetes/apps/networking/k8s-gateway/app}/kustomization.yaml (63%) create mode 100644 kubernetes/apps/networking/k8s-gateway/ks.yaml create mode 100644 kubernetes/apps/networking/kustomization.yaml rename cluster/apps/kube-system/metallb/helm-release.yaml => kubernetes/apps/networking/metallb/app/helmrelease.yaml (87%) create mode 100644 kubernetes/apps/networking/metallb/app/kustomization.yaml rename {cluster/apps/kube-system/k8s-gateway => kubernetes/apps/networking/metallb/config}/kustomization.yaml (64%) create mode 100644 kubernetes/apps/networking/metallb/config/resources.yaml create mode 100644 kubernetes/apps/networking/metallb/ks.yaml create mode 100644 kubernetes/apps/networking/namespace.yaml create mode 100644 kubernetes/apps/system-upgrade/kustomization.yaml rename {cluster => kubernetes}/apps/system-upgrade/namespace.yaml (100%) create mode 100644 kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml create mode 100644 kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml rename {cluster => kubernetes}/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml (63%) rename {cluster => kubernetes}/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml (100%) rename {cluster => kubernetes}/apps/system-upgrade/system-upgrade-controller/plans/server.yaml (61%) rename {cluster => kubernetes}/bootstrap/kustomization.yaml (66%) rename {cluster => kubernetes}/flux/apps.yaml (75%) rename cluster/flux/config/flux-installation.yaml => kubernetes/flux/config/flux.yaml (66%) rename {cluster/apps/kube-system/reloader => kubernetes/flux/config}/kustomization.yaml (69%) rename {cluster/flux/repositories/oci => kubernetes/flux/repositories/git}/.gitkeep (100%) rename cluster/flux/repositories/helm/bitnami-charts.yaml => kubernetes/flux/repositories/helm/bitnami.yaml (100%) rename cluster/flux/repositories/helm/bjw-s-charts.yaml => kubernetes/flux/repositories/helm/bjw-s.yaml (100%) rename cluster/flux/repositories/helm/external-dns-charts.yaml => kubernetes/flux/repositories/helm/external-dns.yaml (100%) rename cluster/flux/repositories/helm/hajimari-charts.yaml => kubernetes/flux/repositories/helm/hajimari.yaml (100%) rename cluster/flux/repositories/helm/ingress-nginx-charts.yaml => kubernetes/flux/repositories/helm/ingress-nginx.yaml (100%) rename cluster/flux/repositories/helm/jetstack-charts.yaml => kubernetes/flux/repositories/helm/jetstack.yaml (100%) rename cluster/flux/repositories/helm/k8s-gateway-charts.yaml => kubernetes/flux/repositories/helm/k8s-gateway.yaml (100%) create mode 100644 kubernetes/flux/repositories/helm/kustomization.yaml rename cluster/flux/repositories/helm/metallb-charts.yaml => kubernetes/flux/repositories/helm/metallb.yaml (100%) rename cluster/flux/repositories/helm/metrics-server-charts.yaml => kubernetes/flux/repositories/helm/metrics-server.yaml (100%) rename cluster/flux/repositories/helm/stakater-charts.yaml => kubernetes/flux/repositories/helm/stakater.yaml (100%) rename cluster/flux/repositories/helm/dysnix-charts.yaml => kubernetes/flux/repositories/helm/weave-gitops.yaml (67%) rename {cluster => kubernetes}/flux/repositories/kustomization.yaml (100%) rename {provision/ansible/inventory/host_vars => kubernetes/flux/repositories/oci}/.gitkeep (100%) rename {cluster => kubernetes}/flux/vars/kustomization.yaml (100%) rename {provision/terraform => terraform}/cloudflare/main.tf (83%) delete mode 100644 tmpl/cluster/cert-manager-secret.sops.yaml delete mode 100644 tmpl/cluster/cloudflare-ddns-secret.sops.yaml delete mode 100644 tmpl/cluster/cluster-secrets.sops.yaml delete mode 100644 tmpl/cluster/cluster-settings.yaml delete mode 100644 tmpl/cluster/external-dns-secret.sops.yaml delete mode 100644 tmpl/cluster/flux/kustomization.yaml create mode 100644 tmpl/kubernetes/cert-manager-secret.sops.yaml create mode 100644 tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml create mode 100644 tmpl/kubernetes/cluster-secrets.sops.yaml create mode 100644 tmpl/kubernetes/external-dns-secret.sops.yaml create mode 100644 tmpl/kubernetes/flux/cluster-settings.yaml rename tmpl/{cluster/flux-cluster.yaml => kubernetes/flux/cluster.yaml} (71%) rename tmpl/{cluster/flux/webhooks/github/secret.sops.yaml => kubernetes/github-webhook-token-secret.sops.yaml} (71%) create mode 100644 tmpl/kubernetes/weave-gitops-secret.sops.yaml diff --git a/.config.sample.env b/.config.sample.env index 39fa00d2..48d6d6c3 100644 --- a/.config.sample.env +++ b/.config.sample.env @@ -6,11 +6,15 @@ # e.g. https://github.com/onedr0p/home-cluster export BOOTSTRAP_GIT_REPOSITORY="" -# Optional: Enable GitHub to send a webhook to update Flux, set the following to one of: -# ignored - this feature will be disabled -# generated - this will generate a token and print it in the logs +# To enable Flux to update your cluster on `git push` set the following to one of: +# `generated` - this will generate a token and print it in the logs # Set this to any other string and it will be used for the secret -export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="ignored" +export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="generated" + +# The Weave GitOps dashboard admin password +# `generated` - this will generate a token and print it in the logs +# Set this to any other string and it will be used for the secret +export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="generated" # Choose one of your cloudflare domains # e.g. onedr0p.com @@ -44,8 +48,6 @@ export BOOTSTRAP_AGE_PUBLIC_KEY="" export BOOTSTRAP_KUBE_VIP_ADDR="" # Choose your timezone -# Used to set your systems timezone -# and Kured timezone # e.g. America/New_York export BOOTSTRAP_TIMEZONE="Etc/UTC" diff --git a/.editorconfig b/.editorconfig index 2f1eafd3..547304ee 100644 --- a/.editorconfig +++ b/.editorconfig @@ -16,6 +16,3 @@ indent_size = 4 [*.{bash,sh}] indent_style = space indent_size = 4 - -[*.{yaml,yml}] -indent_size = 2 diff --git a/.envrc b/.envrc index e0a5845d..2b089196 100644 --- a/.envrc +++ b/.envrc @@ -1,5 +1,5 @@ #shellcheck disable=SC2148,SC2155 -export KUBECONFIG=$(expand_path ./provision/kubeconfig) +export KUBECONFIG=$(expand_path ./kubeconfig) export ANSIBLE_CONFIG=$(expand_path ./ansible.cfg) export ANSIBLE_HOST_KEY_CHECKING="False" export SOPS_AGE_KEY_FILE=$(expand_path ~/.config/sops/age/keys.txt) diff --git a/.gitattributes b/.gitattributes index af37c0fd..17e94531 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1 +1,3 @@ +* text=auto eol=lf *.sops.* diff=sopsdiffer +*.sops.toml linguist-language=JSON diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS deleted file mode 100644 index 9c858678..00000000 --- a/.github/CODEOWNERS +++ /dev/null @@ -1,2 +0,0 @@ -# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners -* @onedr0p diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md deleted file mode 100644 index b5dff9c9..00000000 --- a/.github/ISSUE_TEMPLATE/bug-report.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -name: Bug report -about: Create a report to help us improve -title: '' -labels: kind/bug -assignees: '' - ---- - -# Details - - diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index e54e04ec..00000000 --- a/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -blank_issues_enabled: false -contact_links: - - name: Discuss on Discord - url: https://discord.gg/k8s-at-home - about: Join our Discord community diff --git a/.github/ISSUE_TEMPLATE/feature-request.md b/.github/ISSUE_TEMPLATE/feature-request.md deleted file mode 100644 index 75726f70..00000000 --- a/.github/ISSUE_TEMPLATE/feature-request.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -name: Feature request -about: Suggest an idea for this project -title: '' -labels: kind/enhancement -assignees: '' - ---- - -# Details - - diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md deleted file mode 100644 index 38b30cb8..00000000 --- a/.github/ISSUE_TEMPLATE/question.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -name: Question -about: Ask a question to the maintainer -title: '' -labels: kind/question -assignees: '' - ---- - -# Details - - diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index 49fca846..00000000 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ /dev/null @@ -1,20 +0,0 @@ -**Description of the change** - - - -**Benefits** - - - -**Possible drawbacks** - - - -**Applicable issues** - - -- fixes # - -**Additional information** - - diff --git a/.github/linters/.ansible-lint b/.github/linters/.ansible-lint deleted file mode 100644 index 1a8e36ab..00000000 --- a/.github/linters/.ansible-lint +++ /dev/null @@ -1,3 +0,0 @@ -# .ansible-lint -warn_list: - - unnamed-task diff --git a/.github/linters/.markdownlint.yaml b/.github/linters/.markdownlint.yaml deleted file mode 100644 index 3443fa75..00000000 --- a/.github/linters/.markdownlint.yaml +++ /dev/null @@ -1,23 +0,0 @@ ---- -default: true - -# MD013/line-length - Line length -MD013: - # Number of characters - line_length: 240 - # Number of characters for headings - heading_line_length: 80 - # Number of characters for code blocks - code_block_line_length: 80 - # Include code blocks - code_blocks: true - # Include tables - tables: true - # Include headings - headings: true - # Include headings - headers: true - # Strict length checking - strict: false - # Stern length checking - stern: false diff --git a/.github/linters/.prettierignore b/.github/linters/.prettierignore deleted file mode 100644 index e168780f..00000000 --- a/.github/linters/.prettierignore +++ /dev/null @@ -1,2 +0,0 @@ -*.sops.* -gotk-components.yaml diff --git a/.github/linters/.prettierrc.yaml b/.github/linters/.prettierrc.yaml deleted file mode 100644 index e30d9f99..00000000 --- a/.github/linters/.prettierrc.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -trailingComma: "es5" -tabWidth: 2 -semi: false -singleQuote: false diff --git a/.github/linters/.tflint.hcl b/.github/linters/.tflint.hcl deleted file mode 100644 index e69de29b..00000000 diff --git a/.github/renovate.json5 b/.github/renovate.json5 index 717d0352..2c76c83b 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -10,34 +10,20 @@ "enabled": true }, "flux": { - "fileMatch": ["cluster/.+\\.ya?ml$"] + "fileMatch": ["kubernetes/.+\\.ya?ml$"] }, "helm-values": { - "fileMatch": ["cluster/.+\\.ya?ml$"] + "fileMatch": ["kubernetes/.+\\.ya?ml$"] }, "kubernetes": { - "fileMatch": [ - "cluster/.+\\.ya?ml$", - "provision/ansible/.+\\.ya?ml.j2$" - ] + "fileMatch": ["kubernetes/.+\\.ya?ml$"] }, "regexManagers": [ - { - "description": "Process CRD dependencies", - "fileMatch": ["cluster/crds/.+\\.ya?ml$"], - "matchStrings": [ - // GitRepository and Flux Kustomization where 'Git release/tag' matches 'Helm' version - "registryUrl=(?\\S+) chart=(?\\S+)\n.*?(?[^-\\s]*)\n", - // Kustomization where 'GitHub release artifact URL' matches 'Docker image' version - "datasource=(?\\S+) image=(?\\S+)\n.*?-\\s(.*?)\/(?[^/]+)\/[^/]+\n" - ], - "datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}helm{{/if}}" - }, { "description": "Process various other dependencies", "fileMatch": [ - "provision/ansible/.+\\.ya?ml$", - "cluster/.+\\.ya?ml$" + "ansible/.+\\.ya?ml$", + "kubernetes/.+\\.ya?ml$" ], "matchStrings": [ "datasource=(?\\S+) depName=(?\\S+)( versioning=(?\\S+))?\n.*?\"(?.*)\"\n" @@ -47,12 +33,6 @@ } ], "packageRules": [ - { - "description": "Disable kubernetes-api", - "matchManagers": ["kubernetes"], - "matchDatasources": ["kubernetes-api"], - "enabled": false - }, // setup datasources { "matchDatasources": ["helm"], @@ -67,14 +47,6 @@ "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}", "matchUpdateTypes": ["major", "minor", "patch"] }, - { - "description": "Group Cert-Manager image (for CRDs) and chart", - "groupName": "Cert-Manager", - "matchPackagePatterns": ["cert-manager"], - "matchDatasources": ["docker", "helm"], - "group": { "commitMessageTopic": "{{{groupName}}} group" }, - "separateMinorPatch": true - }, // add labels according to package and update types { "matchDatasources": ["docker"], diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml deleted file mode 100644 index f8a57921..00000000 --- a/.github/workflows/lint.yaml +++ /dev/null @@ -1,61 +0,0 @@ ---- -name: Lint - -on: # yamllint disable-line rule:truthy - workflow_dispatch: - pull_request: - branches: - - main - -concurrency: - group: ${{ github.ref }}-${{ github.workflow }} - cancel-in-progress: true - -env: - # Currently no way to detect automatically - DEFAULT_BRANCH: main - -jobs: - build: - name: MegaLinter - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v3 - with: - fetch-depth: 0 - - - name: MegaLinter - uses: oxsecurity/megalinter@v6.15.0 - env: - GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'workflow_dispatch' }} - ENABLE_LINTERS: |- - ${{ - join( - fromJSON(' - [ - "ACTION_ACTIONLINT", - "ANSIBLE_ANSIBLE_LINT", - "COPYPASTE_JSCPD", - "KUBERNETES_KUBEVAL", - "MARKDOWN_MARKDOWNLINT", - "REPOSITORY_GIT_DIFF", - "REPOSITORY_SECRETLINT", - "TERRAFORM_TERRAFORM_FMT", - "YAML_PRETTIER", - "YAML_YAMLLINT" - ] - '), - ',' - ) - }} - ANSIBLE_DIRECTORY: provision/ansible - ANSIBLE_ANSIBLE_LINT_CONFIG_FILE: .github/linters/.ansible-lint - KUBERNETES_DIRECTORY: cluster - KUBERNETES_KUBEVAL_ARGUMENTS: --ignore-missing-schemas - MARKDOWN_MARKDOWNLINT_CONFIG_FILE: .github/linters/.markdownlint.yaml - MARKDOWN_MARKDOWNLINT_RULES_PATH: .github/ - YAML_YAMLLINT_CONFIG_FILE: .github/linters/.yamllint.yaml - YAML_PRETTIER_CONFIG_FILE: .github/linters/.prettierrc.yaml - YAML_PRETTIER_FILTER_REGEX_EXCLUDE: "(.*\\.sops\\.ya?ml)" diff --git a/.gitignore b/.gitignore index ebbdf564..28309de3 100644 --- a/.gitignore +++ b/.gitignore @@ -9,11 +9,9 @@ kubeconfig *.agekey *.pub *.key -github-deploy-key* # Ansible xanmanning.k3s* # Terraform .terraform .terraform.tfstate* terraform.tfstate* -megalinter-reports diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 7328a9b9..7f27c5ec 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -6,37 +6,9 @@ repos: hooks: - args: - --config-file - - .github/linters/.yamllint.yaml + - .yamllint.yaml id: yamllint - - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.4.0 - hooks: - - id: check-merge-conflict - - id: end-of-file-fixer - - id: mixed-line-ending - - id: trailing-whitespace - args: [--markdown-linebreak-ext=md] - - repo: https://github.com/Lucas-C/pre-commit-hooks - rev: v1.3.1 - hooks: - - id: remove-crlf - - id: remove-tabs - - repo: https://github.com/sirosen/texthooks - rev: 0.4.0 - hooks: - - id: fix-smartquotes - - repo: https://github.com/onedr0p/sops-pre-commit - rev: v2.1.1 - hooks: - - id: forbid-secrets - exclude: | - (?x)^( - cluster\/apps\/kube-system\/kube-vip\/rbac.yaml| - tmpl\/.*.sops\.ya?ml - )$ - repo: https://github.com/gruntwork-io/pre-commit rev: v0.1.17 hooks: - id: terraform-fmt - - id: terraform-validate - - id: tflint diff --git a/.secretlintignore b/.secretlintignore deleted file mode 100644 index 208737e8..00000000 --- a/.secretlintignore +++ /dev/null @@ -1,3 +0,0 @@ -megalinter-reports -tmpl -README.md diff --git a/.sourceignore b/.sourceignore deleted file mode 100644 index 21b66683..00000000 --- a/.sourceignore +++ /dev/null @@ -1,17 +0,0 @@ -# See https://toolkit.fluxcd.io/components/source/gitrepositories/#excluding-files -.github/ -.taskfiles/ -.vscode/ -provision/ -tmpl/ -.config.sample.env -.envrc -.gitattributes -.gitignore -.pre-commit-config.yaml -.sops.yaml -ansible.cfg -configure -LICENSE -README.md -Taskfile.yml diff --git a/.taskfiles/AnsibleTasks.yml b/.taskfiles/AnsibleTasks.yml index ed3798b7..e07ece62 100644 --- a/.taskfiles/AnsibleTasks.yml +++ b/.taskfiles/AnsibleTasks.yml @@ -12,32 +12,32 @@ tasks: init: desc: Install / Upgrade Ansible galaxy deps - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible-galaxy install -r requirements.yml --roles-path ~/.ansible/roles --force - ansible-galaxy collection install -r requirements.yml --collections-path ~/.ansible/collections --force list: desc: List all the hosts - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --list-hosts prepare: desc: Prepare all the k8s nodes for running k3s - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-prepare.yml install: desc: Install Kubernetes on the nodes - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-installation.yml nuke: desc: Uninstall Kubernetes on the nodes - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" interactive: true cmds: - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-nuke.yml @@ -45,24 +45,24 @@ tasks: ping: desc: Ping all the hosts - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -m 'ping' uptime: desc: Uptime of all the hosts - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -a 'uptime' reboot: desc: Reboot all the k8s nodes - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-reboot.yml poweroff: desc: Shutdown all the k8s nodes - dir: provision/ansible + dir: "{{.ANSIBLE_DIR}}" cmds: - ansible kubernetes -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml -a '/usr/bin/systemctl poweroff' --become diff --git a/.taskfiles/ClusterTasks.yml b/.taskfiles/ClusterTasks.yml index 78977720..1f79debc 100644 --- a/.taskfiles/ClusterTasks.yml +++ b/.taskfiles/ClusterTasks.yml @@ -11,11 +11,11 @@ tasks: install: desc: Install Flux into your cluster cmds: - - kubectl apply --kustomize {{.CLUSTER_DIR}}/bootstrap/ + - kubectl apply --kustomize {{.KUBERNETES_DIR}}/bootstrap - cat {{.SOPS_AGE_KEY_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin - - sops --decrypt {{.CLUSTER_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f - - - kubectl apply -f {{.CLUSTER_DIR}}/flux/vars/cluster-settings.yaml - - kubectl apply --kustomize {{.CLUSTER_DIR}}/flux/config + - sops --decrypt {{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f - + - kubectl apply -f {{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml + - kubectl apply --kustomize {{.KUBERNETES_DIR}}/flux/config - task: reconcile preconditions: - sh: test -f {{.SOPS_AGE_KEY_FILE}} @@ -27,8 +27,8 @@ tasks: reconcile: desc: Force update Flux to pull in changes from your Git repository cmds: - - flux reconcile -n flux-system source git flux-cluster - - flux reconcile -n flux-system kustomization flux-cluster + - flux reconcile -n flux-system source git home-kubernetes + - flux reconcile -n flux-system kustomization cluster hr-restart: desc: Restart all failed Helm Releases diff --git a/.taskfiles/SopsTasks.yml b/.taskfiles/SopsTasks.yml index 28ca8abb..1b2ac2f0 100644 --- a/.taskfiles/SopsTasks.yml +++ b/.taskfiles/SopsTasks.yml @@ -3,12 +3,12 @@ version: "3" tasks: - encrypt: - desc: encrypt sops file 'to use must include -- before path to file.' eg "task sops:encrypt -- file.yml" + e: + desc: Encrypt sops file 'to use must include -- before path to file.' eg "task sops:e -- file.yaml" cmds: - sops --encrypt --in-place {{.CLI_ARGS}} - decrypt: - desc: decrypt sops file 'to use must include -- before path to file.' eg "task sops:decrypt -- file.yml" + d: + desc: Decrypt sops file 'to use must include -- before path to file.' eg "task sops:d -- file.yaml" cmds: - sops --decrypt --in-place {{.CLI_ARGS}} diff --git a/.taskfiles/TerraformTasks.yml b/.taskfiles/TerraformTasks.yml index 7c36bec4..f11a1981 100644 --- a/.taskfiles/TerraformTasks.yml +++ b/.taskfiles/TerraformTasks.yml @@ -5,18 +5,18 @@ tasks: init: desc: Initialize terraform dependencies - dir: provision/terraform/cloudflare + dir: "{{.TERRAFORM_DIR}}/cloudflare" cmds: - terraform init {{.CLI_ARGS}} plan: desc: Show the changes terraform will make - dir: provision/terraform/cloudflare + dir: "{{.TERRAFORM_DIR}}/cloudflare" cmds: - terraform plan {{.CLI_ARGS}} apply: desc: Apply the changes to Cloudflare - dir: provision/terraform/cloudflare + dir: "{{.TERRAFORM_DIR}}/cloudflare" cmds: - terraform apply {{.CLI_ARGS}} diff --git a/.vscode/extensions.json b/.vscode/extensions.json index c123b7f3..d7661c3d 100644 --- a/.vscode/extensions.json +++ b/.vscode/extensions.json @@ -1,13 +1,17 @@ { "recommendations": [ - "HashiCorp.terraform", + "albert.TabOut", "britesnow.vscode-toggle-quotes", + "fcrespo82.markdown-table-formatter", "mitchdenny.ecdc", "ms-kubernetes-tools.vscode-kubernetes-tools", - "oderwat.indent-rainbow", "redhat.ansible", "signageos.signageos-vscode-sops", "usernamehw.errorlens", - "fcrespo82.markdown-table-formatter" + "will-stone.in-any-case", + "BriteSnow.vscode-toggle-quotes", + "HashiCorp.terraform", + "PKief.material-icon-theme", + "Weaveworks.vscode-gitops-tools" ] } diff --git a/.vscode/settings.json b/.vscode/settings.json index 06eb4d24..abc72ddf 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,18 +1,20 @@ { - "ansible.ansibleLint.arguments": "-c .github/linters/.ansible-lint", "files.associations": { "*.json5": "jsonc", - "**/provision/ansible/**/*.yml": "ansible", - "**/provision/ansible/**/*.sops.yml": "yaml", - "**/provision/ansible/**/inventory/**/*.yml": "yaml", - "**/provision/terraform/**/*.tf": "terraform" + "**/ansible/**/*.yml": "ansible", + "**/ansible/**/*.sops.yml": "yaml", + "**/ansible/**/inventory/**/*.yml": "yaml", + "**/terraform/**/*.tf": "terraform", + "**/kubernetes/**/*.sops.toml": "plaintext" }, - "prettier.configPath": ".github/linters/.prettierrc.yaml", - "prettier.ignorePath": ".github/linters/.prettierignore", "yaml.schemas": { - "Kubernetes": "cluster/*.yaml" + "ansible": "ansible/*.yml", + "Kubernetes": "kubernetes/*.yaml" }, "editor.bracketPairColorization.enabled": true, - "editor.guides.bracketPairs":"active", - "editor.hover.delay": 1500 + "editor.guides.bracketPairs": true, + "editor.guides.bracketPairsHorizontal": true, + "editor.guides.highlightActiveBracketPair": true, + "editor.hover.delay": 1500, + "files.trimTrailingWhitespace": true, } diff --git a/.github/linters/.yamllint.yaml b/.yamllint.yaml similarity index 93% rename from .github/linters/.yamllint.yaml rename to .yamllint.yaml index e13c88db..76f1e8f9 100644 --- a/.github/linters/.yamllint.yaml +++ b/.yamllint.yaml @@ -1,7 +1,6 @@ --- ignore: | *.sops.* - gotk-components.yaml extends: default rules: truthy: diff --git a/README.md b/README.md index 4241a1b9..e604f179 100644 --- a/README.md +++ b/README.md @@ -102,11 +102,10 @@ It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-com The Git repository contains the following directories under `cluster` and are ordered below by how Flux will apply them. ```sh -📁 cluster # k8s cluster defined as code -├─📁 flux # flux, gitops operator, loaded before everything -├─📁 charts # helm chart repos -├─📁 config # cluster config -└─📁 apps # regular apps, namespaced dir tree, loaded last +📁 kubernetes # Kubernetes cluster defined as code +├─📁 bootstrap # Flux installation +├─📁 flux # Main Flux configuration of repository +└─📁 apps # Apps deployed into the cluster grouped by namespace ``` ## 🚀 Lets go @@ -221,7 +220,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y ### ⛵ Installing k3s with Ansible -📍 Here we will be running a Ansible Playbook to install [k3s](https://k3s.io/) with [this](https://galaxy.ansible.com/xanmanning/k3s) wonderful k3s Ansible galaxy role. After completion, Ansible will drop a `kubeconfig` in `./provision/kubeconfig` for use with interacting with your cluster with `kubectl`. +📍 Here we will be running a Ansible Playbook to install [k3s](https://k3s.io/) with [this](https://galaxy.ansible.com/xanmanning/k3s) wonderful k3s Ansible galaxy role. After completion, Ansible will drop a `kubeconfig` in `./kubeconfig` for use with interacting with your cluster with `kubectl`. ☢️ If you run into problems, you can run `task ansible:nuke` to destroy the k3s cluster and start over. @@ -254,7 +253,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y ### ☁️ Configuring Cloudflare DNS with Terraform -📍 Review the Terraform scripts under `./provision/terraform/cloudflare/` and make sure you understand what it's doing (no really review it). +📍 Review the Terraform scripts under `./terraform/cloudflare/` and make sure you understand what it's doing (no really review it). If your domain already has existing DNS records **be sure to export those DNS settings before you continue**. @@ -296,7 +295,7 @@ The cluster application [external-dns](https://github.com/kubernetes-sigs/extern 2. Push you changes to git - 📍 **Verify** all the `*.sops.yaml` and `*.sops.yml` files under the `./cluster` and `./provision` folders are **encrypted** with SOPS + 📍 **Verify** all the `*.sops.yaml` and `*.sops.yml` files under the `./ansible`, `./kubernetes`, and `./terraform` folders are **encrypted** with SOPS ```sh git add -A @@ -418,7 +417,7 @@ Flux is pull-based by design meaning it will periodically check your git reposit 1. Webhook URL - Your webhook receiver will be deployed on `https://flux-receiver.${BOOTSTRAP_CLOUDFLARE_DOMAIN}/hook/:hookId`. In order to find out your hook id you can run the following command: ```sh - kubectl -n flux-system get receiver/github-receiver --kubeconfig=./provision/kubeconfig + kubectl -n flux-system get receiver/github-receiver --kubeconfig=./kubeconfig # NAME AGE READY STATUS # github-receiver 6h8m True Receiver initialized with URL: /hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123 ``` @@ -432,7 +431,7 @@ Flux is pull-based by design meaning it will periodically check your git reposit 2. Webhook secret - Your webhook secret can be found by decrypting the `secret.sops.yaml` using the following command: ```sh - sops -d ./cluster/flux/config/webhooks/github/secret.sops.yaml | yq .stringData.token + sops -d ./kubernetes/flux/config/webhooks/github/secret.sops.yaml | yq .stringData.token ``` **Note:** Don't forget to update the `BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET` variable in your `.config.env` file so it matches the generated secret if applicable @@ -467,12 +466,11 @@ The benefits of a public repository include: 1. Generate new SSH key: ```sh - ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./cluster/github-deploy-key -q -P "" + ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./kubernetes/bootstrap/github-deploy.key -q -P "" ``` 2. Paste public key in the deploy keys section of your repository settings - 3. Create sops secret in `./cluster/bootstrap/github-deploy-key.sops.yaml` with the contents of: + 3. Create sops secret in `./kubernetes/bootstrap/github-deploy-key.sops.yaml` with the contents of: ```yaml - # yamllint disable apiVersion: v1 kind: Secret metadata: @@ -492,19 +490,18 @@ The benefits of a public repository include: ``` 4. Encrypt secret: ```sh - sops --encrypt --in-place ./cluster/bootstrap/github-deploy-key.sops.yaml + sops --encrypt --in-place ./kubernetes/bootstrap/github-deploy-key.sops.yaml ``` 5. Apply secret to cluster: ```sh - sops --decrypt cluster/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f - + sops --decrypt ./kubernetes/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f - ``` - 6. Update `cluster/flux/config/flux-cluster.yaml`: + 6. Update `./kubernetes/flux/config/cluster.yaml`: ```yaml - --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: GitRepository metadata: - name: flux-cluster + name: home-kubernetes namespace: flux-system spec: interval: 10m diff --git a/Taskfile.yml b/Taskfile.yml index 0512a257..2b0a8476 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -4,14 +4,14 @@ version: "3" vars: PROJECT_DIR: sh: "git rev-parse --show-toplevel" - CLUSTER_DIR: "{{.PROJECT_DIR}}/cluster" - ANSIBLE_DIR: "{{.PROJECT_DIR}}/provision/ansible" - TERRAFORM_DIR: "{{.PROJECT_DIR}}/provision/terraform" + KUBERNETES_DIR: "{{.PROJECT_DIR}}/kubernetes" + ANSIBLE_DIR: "{{.PROJECT_DIR}}/ansible" + TERRAFORM_DIR: "{{.PROJECT_DIR}}/terraform" dotenv: [".config.env"] env: - KUBECONFIG: "{{.PROJECT_DIR}}/provision/kubeconfig" + KUBECONFIG: "{{.PROJECT_DIR}}/kubeconfig" includes: ansible: .taskfiles/AnsibleTasks.yml @@ -49,6 +49,7 @@ tasks: stern terraform tflint + weaveworks/tap/gitops yamllint yq diff --git a/ansible.cfg b/ansible.cfg index b86d44e4..d7f3ef6d 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -6,8 +6,8 @@ stdout_callback = yaml force_valid_group_names = ignore # File/Directory settings log_path = ~/.ansible/ansible.log -inventory = ./provision/ansible/inventory -roles_path = ~/.ansible/roles:./provision/ansible/roles +inventory = ./ansible/inventory +roles_path = ~/.ansible/roles:./ansible/roles collections_path = ~/.ansible/collections remote_tmp = /tmp local_tmp = ~/.ansible/tmp diff --git a/provision/ansible/inventory/group_vars/kubernetes/k3s.yml b/ansible/inventory/group_vars/kubernetes/k3s.yml similarity index 100% rename from provision/ansible/inventory/group_vars/kubernetes/k3s.yml rename to ansible/inventory/group_vars/kubernetes/k3s.yml diff --git a/provision/ansible/inventory/group_vars/kubernetes/os.yml b/ansible/inventory/group_vars/kubernetes/os.yml similarity index 100% rename from provision/ansible/inventory/group_vars/kubernetes/os.yml rename to ansible/inventory/group_vars/kubernetes/os.yml diff --git a/provision/ansible/inventory/group_vars/master/k3s.yml b/ansible/inventory/group_vars/master/k3s.yml similarity index 72% rename from provision/ansible/inventory/group_vars/master/k3s.yml rename to ansible/inventory/group_vars/master/k3s.yml index 21e8d6b4..32035035 100644 --- a/provision/ansible/inventory/group_vars/master/k3s.yml +++ b/ansible/inventory/group_vars/master/k3s.yml @@ -9,7 +9,6 @@ k3s_control_node: true k3s_server: node-ip: "{{ ansible_host }}" tls-san: - # kube-vip - "{{ kubevip_address }}" # Disable Docker - this will use the default containerd CRI docker: false @@ -30,28 +29,17 @@ k3s_server: cluster-cidr: "10.42.0.0/16" # Network CIDR to use for service IPs service-cidr: "10.43.0.0/16" - kubelet-arg: - # Allow k8s services to contain TCP and UDP on the same port - - "feature-gates=MixedProtocolLBService=true" kube-controller-manager-arg: - # Allow k8s services to contain TCP and UDP on the same port - - "feature-gates=MixedProtocolLBService=true" # Required to monitor kube-controller-manager with kube-prometheus-stack - "bind-address=0.0.0.0" kube-proxy-arg: - # Allow k8s services to contain TCP and UDP on the same port - - "feature-gates=MixedProtocolLBService=true" # Required to monitor kube-proxy with kube-prometheus-stack - "metrics-bind-address=0.0.0.0" kube-scheduler-arg: - # Allow k8s services to contain TCP and UDP on the same port - - "feature-gates=MixedProtocolLBService=true" # Required to monitor kube-scheduler with kube-prometheus-stack - "bind-address=0.0.0.0" # Required to monitor etcd with kube-prometheus-stack etcd-expose-metrics: true kube-apiserver-arg: - # Allow k8s services to contain TCP and UDP on the same port - - "feature-gates=MixedProtocolLBService=true" # Required for HAProxy health-checks - "anonymous-auth=true" diff --git a/provision/ansible/inventory/group_vars/worker/k3s.yml b/ansible/inventory/group_vars/worker/k3s.yml similarity index 71% rename from provision/ansible/inventory/group_vars/worker/k3s.yml rename to ansible/inventory/group_vars/worker/k3s.yml index ce74f752..d2a44e05 100644 --- a/provision/ansible/inventory/group_vars/worker/k3s.yml +++ b/ansible/inventory/group_vars/worker/k3s.yml @@ -8,6 +8,3 @@ k3s_control_node: false # (dict) k3s settings for all worker nodes k3s_agent: node-ip: "{{ ansible_host }}" - kubelet-arg: - # Allow k8s services to contain TCP and UDP on the same port - - "feature-gates=MixedProtocolLBService=true" diff --git a/cluster/flux/repositories/git/.gitkeep b/ansible/inventory/host_vars/.gitkeep similarity index 100% rename from cluster/flux/repositories/git/.gitkeep rename to ansible/inventory/host_vars/.gitkeep diff --git a/provision/ansible/playbooks/cluster-installation.yml b/ansible/playbooks/cluster-installation.yml similarity index 94% rename from provision/ansible/playbooks/cluster-installation.yml rename to ansible/playbooks/cluster-installation.yml index bf1ddc96..7f93264a 100644 --- a/provision/ansible/playbooks/cluster-installation.yml +++ b/ansible/playbooks/cluster-installation.yml @@ -38,11 +38,11 @@ git rev-parse --show-toplevel register: repo_abs_path - - name: Copy kubeconfig to provision folder + - name: Copy kubeconfig project directory run_once: true ansible.builtin.fetch: src: "/etc/rancher/k3s/k3s.yaml" - dest: "{{ repo_abs_path.stdout }}/provision/kubeconfig" + dest: "{{ repo_abs_path.stdout }}/kubeconfig" flat: true when: - k3s_control_node is defined @@ -53,7 +53,7 @@ become: false run_once: true ansible.builtin.replace: - path: "{{ repo_abs_path.stdout }}/provision/kubeconfig" + path: "{{ repo_abs_path.stdout }}/kubeconfig" regexp: "https://127.0.0.1:6443" replace: "https://{{ k3s_registration_address }}:6443" @@ -99,11 +99,11 @@ - k3s_control_node # Cleaning up the manifests from the /var/lib/rancher/k3s/server/manifests - # directory is needed because k3s has an awesome "feature" to always deploy + # directory is needed because k3s has an awesome "feature" to always deploy # these on restarting the k3s systemd service. Removing them does NOT # uninstall the manifests. - # Removing them means we can manage the lifecycle of these components + # Removing them means we can manage the lifecycle of these components # outside of the /var/lib/rancher/k3s/server/manifests directory - name: Remove deployed manifest templates diff --git a/provision/ansible/playbooks/cluster-nuke.yml b/ansible/playbooks/cluster-nuke.yml similarity index 100% rename from provision/ansible/playbooks/cluster-nuke.yml rename to ansible/playbooks/cluster-nuke.yml diff --git a/provision/ansible/playbooks/cluster-prepare.yml b/ansible/playbooks/cluster-prepare.yml similarity index 100% rename from provision/ansible/playbooks/cluster-prepare.yml rename to ansible/playbooks/cluster-prepare.yml diff --git a/provision/ansible/playbooks/cluster-reboot.yml b/ansible/playbooks/cluster-reboot.yml similarity index 100% rename from provision/ansible/playbooks/cluster-reboot.yml rename to ansible/playbooks/cluster-reboot.yml diff --git a/provision/ansible/playbooks/templates/calico-installation.yaml.j2 b/ansible/playbooks/templates/calico-installation.yaml.j2 similarity index 100% rename from provision/ansible/playbooks/templates/calico-installation.yaml.j2 rename to ansible/playbooks/templates/calico-installation.yaml.j2 diff --git a/provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 b/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 similarity index 94% rename from provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 rename to ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 index fd7009c1..374add90 100644 --- a/provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 +++ b/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 @@ -22,8 +22,7 @@ spec: - name: kube-vip image: ghcr.io/kube-vip/kube-vip:v0.5.7 imagePullPolicy: IfNotPresent - args: - - manager + args: ["manager"] env: - name: vip_arp value: "true" @@ -49,9 +48,7 @@ spec: value: "{{ k3s_registration_address }}" securityContext: capabilities: - add: - - NET_ADMIN - - NET_RAW + add: ["NET_ADMIN", "NET_RAW"] hostAliases: - hostnames: - kubernetes diff --git a/provision/ansible/requirements.yml b/ansible/requirements.yml similarity index 100% rename from provision/ansible/requirements.yml rename to ansible/requirements.yml diff --git a/cluster/apps/default/hajimari/config-pvc.yaml b/cluster/apps/default/hajimari/config-pvc.yaml deleted file mode 100644 index e432bafc..00000000 --- a/cluster/apps/default/hajimari/config-pvc.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: hajimari-config - namespace: default -spec: - accessModes: - - ReadWriteOnce - storageClassName: local-path - resources: - requests: - storage: 128Mi diff --git a/cluster/apps/default/hajimari/helm-release.yaml b/cluster/apps/default/hajimari/helm-release.yaml deleted file mode 100644 index 1f424152..00000000 --- a/cluster/apps/default/hajimari/helm-release.yaml +++ /dev/null @@ -1,131 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: hajimari - namespace: default -spec: - interval: 15m - chart: - spec: - chart: hajimari - version: 2.0.2 - sourceRef: - kind: HelmRepository - name: hajimari - namespace: flux-system - interval: 15m - install: - createNamespace: true - remediation: - retries: 5 - upgrade: - remediation: - retries: 5 - values: - hajimari: - defaultEnable: false - namespaceSelector: - matchNames: - - default - name: "you" - customApps: - - name: Some External Cluster Service - url: http://192.168.1.100:5000 - icon: test-tube - showGlobalBookmarks: true - globalBookmarks: - - group: Communicate - bookmarks: - - name: Discord - url: "https://discord.com" - - name: Gmail - url: "https://gmail.com" - - name: Slack - url: "https://slack.com/signin" - - group: Cloud - bookmarks: - - name: Box - url: "https://box.com" - - name: Dropbox - url: "https://dropbox.com" - - name: Drive - url: "https://drive.google.com" - - group: Design - bookmarks: - - name: Awwwards - url: "https://awwwards.com" - - name: Dribbble - url: "https://dribbble.com" - - name: Muz.li - url: "https://medium.muz.li/" - - group: Dev - bookmarks: - - name: Codepen - url: "https://codepen.io/" - - name: Devdocs - url: "https://devdocs.io" - - name: Devhints - url: "https://devhints.io" - - group: Lifestyle - bookmarks: - - name: Design Milk - url: "https://design-milk.com/category/interior-design/" - - name: Dwell - url: "https://www.dwell.com/" - - name: Freshome - url: "https://www.mymove.com/freshome/" - - group: Media - bookmarks: - - name: Spotify - url: "http://browse.spotify.com" - - name: Trakt - url: "http://trakt.tv" - - name: YouTube - url: "https://youtube.com/feed/subscriptions" - - group: Reading - bookmarks: - - name: Instapaper - url: "https://www.instapaper.com/u" - - name: Medium - url: "http://medium.com" - - name: Reddit - url: "http://reddit.com" - - group: Tech - bookmarks: - - name: Hacker News - url: "https://news.ycombinator.com/" - - name: The Verge - url: "https://theverge.com/" - - name: MIT Technology Review - url: "https://www.technologyreview.com/" - ingress: - main: - enabled: true - ingressClassName: "nginx" - annotations: - cert-manager.io/cluster-issuer: "letsencrypt-staging" - hajimari.io/enable: "true" - hajimari.io/icon: "weather-sunset" - nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" - hosts: - - host: "hajimari.${SECRET_DOMAIN}" - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - "hajimari.${SECRET_DOMAIN}" - secretName: "hajimari-tls" - persistence: - data: - enabled: true - existingClaim: hajimari-config - podAnnotations: - configmap.reloader.stakater.com/reload: "hajimari-settings" - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi diff --git a/cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml b/cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml deleted file mode 100644 index fe2b9ffb..00000000 --- a/cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml +++ /dev/null @@ -1,69 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: cert-manager-issuers - namespace: kube-system -spec: - interval: 15m - chart: - spec: - chart: raw - version: v0.3.1 - sourceRef: - kind: HelmRepository - name: dysnix - namespace: flux-system - install: - createNamespace: true - remediation: - retries: 5 - upgrade: - remediation: - retries: 5 - dependsOn: - - name: cert-manager - namespace: kube-system - values: - resources: - - apiVersion: cert-manager.io/v1 - kind: ClusterIssuer - metadata: - name: letsencrypt-production - spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: "${SECRET_CLOUDFLARE_EMAIL}" - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: "${SECRET_CLOUDFLARE_EMAIL}" - apiKeySecretRef: - name: cloudflare-api-key - key: api-key - selector: - dnsZones: - - ${SECRET_DOMAIN} - - - apiVersion: cert-manager.io/v1 - kind: ClusterIssuer - metadata: - name: letsencrypt-staging - spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - email: "${SECRET_CLOUDFLARE_EMAIL}" - privateKeySecretRef: - name: letsencrypt-staging - solvers: - - dns01: - cloudflare: - email: "${SECRET_CLOUDFLARE_EMAIL}" - apiKeySecretRef: - name: cloudflare-api-key - key: api-key - selector: - dnsZones: - - ${SECRET_DOMAIN} diff --git a/cluster/apps/kube-system/cert-manager/kustomization.yaml b/cluster/apps/kube-system/cert-manager/kustomization.yaml deleted file mode 100644 index fca27a39..00000000 --- a/cluster/apps/kube-system/cert-manager/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helm-release.yaml - - ./issuers diff --git a/cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml b/cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml deleted file mode 100644 index 8d77a868..00000000 --- a/cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml +++ /dev/null @@ -1,42 +0,0 @@ ---- -apiVersion: batch/v1 -kind: CronJob -metadata: - name: &app cloudflare-ddns - namespace: kube-system -spec: - schedule: "@hourly" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 1 - failedJobsHistoryLimit: 2 - jobTemplate: - spec: - ttlSecondsAfterFinished: 3600 - template: - spec: - automountServiceAccountToken: false - restartPolicy: OnFailure - containers: - - name: *app - image: ghcr.io/onedr0p/kubernetes-kubectl:1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d - envFrom: - - secretRef: - name: *app - command: - - "/bin/bash" - - &scriptPath "/app/cloudflare-ddns.sh" - volumeMounts: - - name: *app - mountPath: *scriptPath - subPath: &scriptName cloudflare-ddns.sh - readOnly: true - volumes: - - name: *app - projected: - defaultMode: 0775 - sources: - - configMap: - name: *app - items: - - key: *scriptName - path: *scriptName diff --git a/cluster/apps/kube-system/kustomization.yaml b/cluster/apps/kube-system/kustomization.yaml deleted file mode 100644 index 4c6d3b53..00000000 --- a/cluster/apps/kube-system/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./namespace.yaml - - ./cert-manager - - ./cloudflare-ddns - - ./external-dns - - ./ingress-nginx - - ./k8s-gateway - - ./kube-vip - - ./metallb - - ./metrics-server - - ./reloader diff --git a/cluster/apps/kube-system/metallb/config/helm-release.yaml b/cluster/apps/kube-system/metallb/config/helm-release.yaml deleted file mode 100644 index bf05f755..00000000 --- a/cluster/apps/kube-system/metallb/config/helm-release.yaml +++ /dev/null @@ -1,45 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: metallb-config - namespace: kube-system -spec: - interval: 15m - chart: - spec: - chart: raw - version: v0.3.1 - sourceRef: - kind: HelmRepository - name: dysnix - namespace: flux-system - install: - createNamespace: true - remediation: - retries: 5 - upgrade: - remediation: - retries: 5 - dependsOn: - - name: metallb - namespace: kube-system - values: - resources: - - apiVersion: metallb.io/v1beta1 - kind: L2Advertisement - metadata: - name: l2-ip - namespace: kube-system - spec: - ipAddressPools: - - default-pool - - - apiVersion: metallb.io/v1beta1 - kind: IPAddressPool - metadata: - name: default-pool - namespace: kube-system - spec: - addresses: - - "${METALLB_LB_RANGE}" diff --git a/cluster/apps/kube-system/metallb/config/kustomization.yaml b/cluster/apps/kube-system/metallb/config/kustomization.yaml deleted file mode 100644 index 34a8531c..00000000 --- a/cluster/apps/kube-system/metallb/config/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - helm-release.yaml diff --git a/cluster/apps/kustomization.yaml b/cluster/apps/kustomization.yaml deleted file mode 100644 index d8cbac8a..00000000 --- a/cluster/apps/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./default - - ./kube-system - # - ./system-upgrade diff --git a/cluster/apps/system-upgrade/kured/helm-release.yaml b/cluster/apps/system-upgrade/kured/helm-release.yaml deleted file mode 100644 index 5aa062fa..00000000 --- a/cluster/apps/system-upgrade/kured/helm-release.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: kured - namespace: system-upgrade -spec: - interval: 15m - chart: - spec: - chart: kured - version: 4.2.0 - sourceRef: - kind: HelmRepository - name: kubereboot - namespace: flux-system - interval: 15m - install: - createNamespace: true - remediation: - retries: 5 - upgrade: - remediation: - retries: 5 - values: - configuration: - startTime: "10pm" - endTime: "2am" - logFormat: "json" - timeZone: "${TIMEZONE}" - rebootSentinelCommand: |- - sh -c "! needs-restarting --reboothint" diff --git a/cluster/apps/system-upgrade/kured/kustomization.yaml b/cluster/apps/system-upgrade/kured/kustomization.yaml deleted file mode 100644 index bfe61558..00000000 --- a/cluster/apps/system-upgrade/kured/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./helm-release.yaml diff --git a/cluster/apps/system-upgrade/kustomization.yaml b/cluster/apps/system-upgrade/kustomization.yaml deleted file mode 100644 index cd492b6e..00000000 --- a/cluster/apps/system-upgrade/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./namespace.yaml - # renovate: datasource=docker image=rancher/system-upgrade-controller - - https://github.com/rancher/system-upgrade-controller/releases/download/v0.9.1/crd.yaml - - ./system-upgrade-controller - - ./kured diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml b/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml deleted file mode 100644 index 1e72bd07..00000000 --- a/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - github.com/rancher/system-upgrade-controller?ref=v0.10.0 - - ./plans -images: - - name: rancher/system-upgrade-controller - newTag: v0.10.0 -patchesStrategicMerge: - # Delete namespace resource - - | - $patch: delete - apiVersion: v1 - kind: Namespace - metadata: - name: system-upgrade - # Add labels - - |- - apiVersion: apps/v1 - kind: Deployment - metadata: - name: system-upgrade-controller - namespace: system-upgrade - labels: - app.kubernetes.io/name: system-upgrade-controller - app.kubernetes.io/instance: system-upgrade-controller diff --git a/cluster/flux/config/kustomization.yaml b/cluster/flux/config/kustomization.yaml deleted file mode 100644 index 227abac2..00000000 --- a/cluster/flux/config/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./flux-installation.yaml - - ./flux-cluster.yaml diff --git a/cluster/flux/repositories/helm/kubereboot-charts.yaml b/cluster/flux/repositories/helm/kubereboot-charts.yaml deleted file mode 100644 index b15dcb2b..00000000 --- a/cluster/flux/repositories/helm/kubereboot-charts.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: kubereboot - namespace: flux-system -spec: - interval: 1h - url: https://kubereboot.github.io/charts diff --git a/cluster/flux/repositories/helm/kustomization.yaml b/cluster/flux/repositories/helm/kustomization.yaml deleted file mode 100644 index a5a8606e..00000000 --- a/cluster/flux/repositories/helm/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./bitnami-charts.yaml - - ./bjw-s-charts.yaml - - ./dysnix-charts.yaml - - ./external-dns-charts.yaml - - ./hajimari-charts.yaml - - ./ingress-nginx-charts.yaml - - ./jetstack-charts.yaml - - ./kubereboot-charts.yaml - - ./k8s-gateway-charts.yaml - - ./metallb-charts.yaml - - ./metrics-server-charts.yaml - - ./stakater-charts.yaml diff --git a/configure b/configure index 534fd3ba..1adbd950 100755 --- a/configure +++ b/configure @@ -40,39 +40,44 @@ main() { # generate sops configuration file envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \ > "${PROJECT_DIR}/.sops.yaml" + # generate cluster settings - envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-settings.yaml" \ - > "${PROJECT_DIR}/cluster/flux/vars/cluster-settings.yaml" - envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \ - > "${PROJECT_DIR}/cluster/flux/config/flux-cluster.yaml" - envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \ - > "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml" - # generate cluster secrets - envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \ - > "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml" - envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \ - > "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml" - envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \ - > "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml" - envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \ - > "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml" - # encrypt cluster secrets - sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml" - sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml" - sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml" - sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml" - # generate terraform secrets + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster-settings.yaml" \ + > "${PROJECT_DIR}/kubernetes/flux/vars/cluster-settings.yaml" + + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster.yaml" \ + > "${PROJECT_DIR}/kubernetes/flux/config/cluster.yaml" + + # generate secrets + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cluster-secrets.sops.yaml" \ + > "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml" + + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cert-manager-secret.sops.yaml" \ + > "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml" + + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml" \ + > "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml" + + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/external-dns-secret.sops.yaml" \ + > "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml" + envsubst < "${PROJECT_DIR}/tmpl/terraform/secret.sops.yaml" \ - > "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml" - # encrypt terraform secrets - sops --encrypt --in-place "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml" + > "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml" + # generate ansible settings envsubst < "${PROJECT_DIR}/tmpl/ansible/kube-vip.yml" \ - > "${PROJECT_DIR}/provision/ansible/inventory/group_vars/kubernetes/kube-vip.yml" + > "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/kube-vip.yml" + # generate ansible hosts file and secrets generate_ansible_hosts generate_ansible_host_secrets setup_github_webhook + setup_weave_gitops success fi } @@ -236,6 +241,7 @@ verify_binaries() { _has_binary "helm" _has_binary "ipcalc" _has_binary "jq" + _has_binary "gitops" _has_binary "yq" _has_binary "sops" _has_binary "ssh" @@ -289,25 +295,40 @@ verify_git_repository() { } setup_github_webhook() { - WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET:-ignored}" + _has_envar "BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET" - if [[ "${WEBHOOK_SECRET}" != "ignored" ]]; then - if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then - WEBHOOK_SECRET="$(openssl rand -base64 30)" - fi + WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}" - export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}" - _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux" - - mkdir -p "${PROJECT_DIR}/cluster/flux/add-ons" - cp -rf "${PROJECT_DIR}/tmpl/cluster/flux/webhooks" "${PROJECT_DIR}/cluster/flux/add-ons" - cp -rf "${PROJECT_DIR}/tmpl/cluster/flux/kustomization.yaml" "${PROJECT_DIR}/cluster/flux/add-ons" - - envsubst < "${PROJECT_DIR}/tmpl/cluster/flux/webhooks/github/secret.sops.yaml" \ - > "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml" - - sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml" + if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then + WEBHOOK_SECRET="$(openssl rand -base64 30)" fi + + export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}" + _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux" + + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/github-webhook-token-secret.sops.yaml" \ + > "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml" +} + +setup_weave_gitops() { + _has_envar "BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD" + + WEAVE_GITOPS_ADMIN_PASSWORD="${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" + + if [[ "${WEAVE_GITOPS_ADMIN_PASSWORD}" == "generated" ]]; then + WEAVE_GITOPS_ADMIN_PASSWORD="$(openssl rand -base64 30)" + fi + + export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="${WEAVE_GITOPS_ADMIN_PASSWORD}" + _log "INFO" "Using admin password '${WEAVE_GITOPS_ADMIN_PASSWORD}' for Weave Gitops" + + # Convert password to bcrypt hash + export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="$(echo -n "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" | gitops get bcrypt-hash)" + + envsubst < "${PROJECT_DIR}/tmpl/kubernetes/weave-gitops-secret.sops.yaml" \ + > "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml" } verify_cloudflare() { @@ -426,8 +447,8 @@ generate_ansible_host_secrets() { printf "kind: Secret\n" printf "ansible_user: %s\n" "${!node_username}" printf "ansible_become_pass: %s\n" "${!node_password}" - } > "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml" - sops --encrypt --in-place "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml" + } > "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml" + sops --encrypt --in-place "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml" done } @@ -480,7 +501,7 @@ generate_ansible_hosts() { fi done fi - } > "${PROJECT_DIR}/provision/ansible/inventory/hosts.yml" + } > "${PROJECT_DIR}/ansible/inventory/hosts.yml" } success() { diff --git a/cluster/apps/kube-system/cert-manager/helm-release.yaml b/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml similarity index 70% rename from cluster/apps/kube-system/cert-manager/helm-release.yaml rename to kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml index 2523712f..47e32b33 100644 --- a/cluster/apps/kube-system/cert-manager/helm-release.yaml +++ b/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: cert-manager - namespace: kube-system + namespace: cert-manager spec: interval: 15m chart: @@ -14,24 +14,30 @@ spec: kind: HelmRepository name: jetstack namespace: flux-system - interval: 15m install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 values: installCRDs: true + replicaCount: 3 webhook: - enabled: true + replicaCount: 3 + cainjector: + replicaCount: 3 extraArgs: - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53 - --dns01-recursive-nameservers-only - replicaCount: 1 - podDnsPolicy: "None" + podDnsPolicy: None podDnsConfig: nameservers: - "1.1.1.1" - "9.9.9.9" + prometheus: + enabled: true + servicemonitor: + enabled: true + prometheusInstance: monitoring diff --git a/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml b/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml new file mode 100644 index 00000000..8cd0c1a3 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: cert-manager +resources: + - ./helmrelease.yaml + - ./prometheusrule.yaml +configMapGenerator: + - name: cert-manager-dashboard + files: + - cert-manager-dashboard.json=https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json +generatorOptions: + disableNameSuffixHash: true + annotations: + kustomize.toolkit.fluxcd.io/substitute: disabled + labels: + grafana_dashboard: "true" diff --git a/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml b/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml new file mode 100644 index 00000000..56314796 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml @@ -0,0 +1,68 @@ +--- +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: cert-manager.rules + namespace: cert-manager +spec: + groups: + - name: cert-manager + rules: + - alert: CertManagerAbsent + expr: | + absent(up{job="cert-manager"}) + for: 15m + labels: + severity: critical + annotations: + description: + "New certificates will not be able to be minted, and existing + ones can't be renewed until cert-manager is back." + runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent + summary: "Cert Manager has dissapeared from Prometheus service discovery." + - name: certificates + rules: + - alert: CertManagerCertExpirySoon + expr: | + avg by (exported_namespace, namespace, name) ( + certmanager_certificate_expiration_timestamp_seconds - time()) + < (21 * 24 * 3600) + for: 15m + labels: + severity: warning + annotations: + description: + "The domain that this cert covers will be unavailable after + {{ $value | humanizeDuration }}. Clients using endpoints that this cert + protects will start to fail in {{ $value | humanizeDuration }}." + runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon + summary: + "The cert {{ $labels.name }} is {{ $value | humanizeDuration }} + from expiry, it should have renewed over a week ago." + - alert: CertManagerCertNotReady + expr: | + max by (name, exported_namespace, namespace, condition) ( + certmanager_certificate_ready_status{condition!="True"} == 1) + for: 15m + labels: + severity: critical + annotations: + description: + "This certificate has not been ready to serve traffic for at least + 10m. If the cert is being renewed or there is another valid cert, the ingress + controller _may_ be able to serve that instead." + runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready + summary: "The cert {{ $labels.name }} is not ready to serve traffic." + - alert: CertManagerHittingRateLimits + expr: | + sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) + > 0 + for: 15m + labels: + severity: critical + annotations: + description: + "Depending on the rate limit, cert-manager may be unable to generate + certificates for up to a week." + runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits + summary: "Cert manager hitting LetsEncrypt rate limits." diff --git a/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml b/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml new file mode 100644 index 00000000..473fb7b4 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml @@ -0,0 +1,41 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: "${SECRET_CLOUDFLARE_EMAIL}" + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiKeySecretRef: + name: cert-manager-secret + key: api-key + selector: + dnsZones: + - "${SECRET_DOMAIN}" +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: "${SECRET_CLOUDFLARE_EMAIL}" + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiKeySecretRef: + name: cert-manager-secret + key: api-key + selector: + dnsZones: + - "${SECRET_DOMAIN}" diff --git a/cluster/apps/kube-system/external-dns/kustomization.yaml b/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml similarity index 80% rename from cluster/apps/kube-system/external-dns/kustomization.yaml rename to kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml index 61fbca20..17754be6 100644 --- a/cluster/apps/kube-system/external-dns/kustomization.yaml +++ b/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml @@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ./helm-release.yaml - ./secret.sops.yaml + - ./issuers.yaml diff --git a/kubernetes/apps/cert-manager/cert-manager/ks.yaml b/kubernetes/apps/cert-manager/cert-manager/ks.yaml new file mode 100644 index 00000000..e248e2e6 --- /dev/null +++ b/kubernetes/apps/cert-manager/cert-manager/ks.yaml @@ -0,0 +1,41 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-cert-manager + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/cert-manager/cert-manager/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: cert-manager + namespace: cert-manager + interval: 30m + retryInterval: 1m + timeout: 3m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-cert-manager-issuers + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-cert-manager + path: ./kubernetes/apps/cert-manager/cert-manager/issuers + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/cluster/apps/default/kustomization.yaml b/kubernetes/apps/cert-manager/kustomization.yaml similarity index 75% rename from cluster/apps/default/kustomization.yaml rename to kubernetes/apps/cert-manager/kustomization.yaml index 518447c4..a0a3e5ed 100644 --- a/cluster/apps/default/kustomization.yaml +++ b/kubernetes/apps/cert-manager/kustomization.yaml @@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - - ./echo-server - - ./hajimari + - ./cert-manager/ks.yaml diff --git a/kubernetes/apps/cert-manager/namespace.yaml b/kubernetes/apps/cert-manager/namespace.yaml new file mode 100644 index 00000000..ed788350 --- /dev/null +++ b/kubernetes/apps/cert-manager/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: cert-manager + labels: + kustomize.toolkit.fluxcd.io/prune: disabled diff --git a/cluster/apps/default/echo-server/helm-release.yaml b/kubernetes/apps/default/echo-server/app/helmrelease.yaml similarity index 72% rename from cluster/apps/default/echo-server/helm-release.yaml rename to kubernetes/apps/default/echo-server/app/helmrelease.yaml index aa387675..e997d449 100644 --- a/cluster/apps/default/echo-server/helm-release.yaml +++ b/kubernetes/apps/default/echo-server/app/helmrelease.yaml @@ -2,7 +2,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: - name: echo-server + name: &app echo-server namespace: default spec: interval: 15m @@ -17,10 +17,10 @@ spec: install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 values: controller: replicas: 3 @@ -51,25 +51,28 @@ spec: ingress: main: enabled: true - ingressClassName: "nginx" + ingressClassName: nginx annotations: - cert-manager.io/cluster-issuer: "letsencrypt-staging" - external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" - external-dns/is-public: "true" - hajimari.io/enable: "true" + external-dns.home.arpa/enabled: "true" hajimari.io/icon: "video-input-antenna" hosts: - - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}" + - host: &host "{{ .Release.Name }}.devbu.io" paths: - path: / pathType: Prefix tls: - hosts: - *host - secretName: "echo-server-tls" + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app.kubernetes.io/name: *app resources: requests: - cpu: 50m - memory: 64Mi + cpu: 5m + memory: 10Mi limits: - memory: 96Mi + memory: 50Mi diff --git a/cluster/apps/kube-system/metrics-server/kustomization.yaml b/kubernetes/apps/default/echo-server/app/kustomization.yaml similarity index 65% rename from cluster/apps/kube-system/metrics-server/kustomization.yaml rename to kubernetes/apps/default/echo-server/app/kustomization.yaml index bfe61558..c0cd2183 100644 --- a/cluster/apps/kube-system/metrics-server/kustomization.yaml +++ b/kubernetes/apps/default/echo-server/app/kustomization.yaml @@ -1,5 +1,6 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: default resources: - - ./helm-release.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/default/echo-server/ks.yaml b/kubernetes/apps/default/echo-server/ks.yaml new file mode 100644 index 00000000..30baeb94 --- /dev/null +++ b/kubernetes/apps/default/echo-server/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-echo-server + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/default/echo-server/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: echo-server + namespace: default + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/kubernetes/apps/default/hajimari/app/helmrelease.yaml b/kubernetes/apps/default/hajimari/app/helmrelease.yaml new file mode 100644 index 00000000..3e32e66f --- /dev/null +++ b/kubernetes/apps/default/hajimari/app/helmrelease.yaml @@ -0,0 +1,62 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: hajimari + namespace: default +spec: + interval: 15m + chart: + spec: + chart: hajimari + version: 2.0.2 + sourceRef: + kind: HelmRepository + name: hajimari + namespace: flux-system + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + hajimari: + title: Apps + darkTheme: espresso + alwaysTargetBlank: true + showGreeting: false + showAppGroups: false + showAppStatus: false + showBookmarkGroups: false + showGlobalBookmarks: false + showAppUrls: false + defaultEnable: true + namespaceSelector: + matchNames: + - default + ingress: + main: + enabled: true + ingressClassName: nginx + annotations: + hajimari.io/enable: "false" + hosts: + - host: &host "${SECRET_DOMAIN}" + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - *host + podAnnotations: + configmap.reloader.stakater.com/reload: "hajimari-settings" + persistence: + data: + enabled: true + type: emptyDir + resources: + requests: + cpu: 100m + memory: 128M diff --git a/cluster/apps/default/echo-server/kustomization.yaml b/kubernetes/apps/default/hajimari/app/kustomization.yaml similarity index 65% rename from cluster/apps/default/echo-server/kustomization.yaml rename to kubernetes/apps/default/hajimari/app/kustomization.yaml index bfe61558..c0cd2183 100644 --- a/cluster/apps/default/echo-server/kustomization.yaml +++ b/kubernetes/apps/default/hajimari/app/kustomization.yaml @@ -1,5 +1,6 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: default resources: - - ./helm-release.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/default/hajimari/ks.yaml b/kubernetes/apps/default/hajimari/ks.yaml new file mode 100644 index 00000000..0e1dba45 --- /dev/null +++ b/kubernetes/apps/default/hajimari/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-hajimari + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/default/hajimari/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: hajimari + namespace: default + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/kubernetes/apps/default/kustomization.yaml b/kubernetes/apps/default/kustomization.yaml new file mode 100644 index 00000000..1e28c169 --- /dev/null +++ b/kubernetes/apps/default/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + - ./echo-server/ks.yaml + - ./hajimari/ks.yaml diff --git a/cluster/apps/default/namespace.yaml b/kubernetes/apps/default/namespace.yaml similarity index 100% rename from cluster/apps/default/namespace.yaml rename to kubernetes/apps/default/namespace.yaml diff --git a/kubernetes/apps/flux-system/addons/ks.yaml b/kubernetes/apps/flux-system/addons/ks.yaml new file mode 100644 index 00000000..f412434b --- /dev/null +++ b/kubernetes/apps/flux-system/addons/ks.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-flux-webhooks + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/flux-system/addons/webhooks + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/tmpl/cluster/flux/webhooks/github/ingress.yaml b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml similarity index 87% rename from tmpl/cluster/flux/webhooks/github/ingress.yaml rename to kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml index ca4b6a77..7657cc97 100644 --- a/tmpl/cluster/flux/webhooks/github/ingress.yaml +++ b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml @@ -11,7 +11,7 @@ metadata: spec: ingressClassName: nginx rules: - - host: "flux-receiver.${SECRET_DOMAIN}" + - host: &host "flux-receiver.${SECRET_DOMAIN}" http: paths: - path: /hook/ @@ -23,5 +23,5 @@ spec: number: 80 tls: - hosts: - - "flux-receiver.${SECRET_DOMAIN}" + - *host secretName: flux-receiver-tls diff --git a/tmpl/cluster/flux/webhooks/github/kustomization.yaml b/kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml similarity index 100% rename from tmpl/cluster/flux/webhooks/github/kustomization.yaml rename to kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml index f7dfdfea..786e654a 100644 --- a/tmpl/cluster/flux/webhooks/github/kustomization.yaml +++ b/kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml @@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: + - ./secret.sops.yaml - ./ingress.yaml - ./receiver.yaml - - ./secret.sops.yaml diff --git a/tmpl/cluster/flux/webhooks/github/receiver.yaml b/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml similarity index 59% rename from tmpl/cluster/flux/webhooks/github/receiver.yaml rename to kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml index 8349704d..9a842840 100644 --- a/tmpl/cluster/flux/webhooks/github/receiver.yaml +++ b/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml @@ -10,25 +10,17 @@ spec: - ping - push secretRef: - name: github-webhook-secret + name: github-webhook-token-secret resources: - apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: GitRepository - name: flux-cluster + name: home-kubernetes namespace: flux-system - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 kind: Kustomization - name: apps + name: cluster namespace: flux-system - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 kind: Kustomization - name: charts - namespace: flux-system - - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 - kind: Kustomization - name: config - namespace: flux-system - - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 - kind: Kustomization - name: flux-cluster + name: cluster-apps namespace: flux-system diff --git a/tmpl/cluster/flux/webhooks/kustomization.yaml b/kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml similarity index 100% rename from tmpl/cluster/flux/webhooks/kustomization.yaml rename to kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml diff --git a/kubernetes/apps/flux-system/kustomization.yaml b/kubernetes/apps/flux-system/kustomization.yaml new file mode 100644 index 00000000..e3bc8414 --- /dev/null +++ b/kubernetes/apps/flux-system/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + - ./addons/ks.yaml + - ./weave-gitops/ks.yaml diff --git a/kubernetes/apps/flux-system/namespace.yaml b/kubernetes/apps/flux-system/namespace.yaml new file mode 100644 index 00000000..b48db452 --- /dev/null +++ b/kubernetes/apps/flux-system/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: flux-system + labels: + kustomize.toolkit.fluxcd.io/prune: disabled diff --git a/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml new file mode 100644 index 00000000..82ca98ac --- /dev/null +++ b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml @@ -0,0 +1,54 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: weave-gitops + namespace: flux-system +spec: + interval: 15m + chart: + spec: + chart: weave-gitops + version: 4.0.9 + sourceRef: + kind: HelmRepository + name: weave-gitops + namespace: flux-system + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + adminUser: + create: true + username: admin + ingress: + enabled: true + className: nginx + annotations: + hajimari.io/icon: "sawtooth-wave" + hosts: + - host: &host "gitops.${SECRET_DOMAIN}" + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - *host + networkPolicy: + create: false + metrics: + enabled: true + rbac: + create: true + impersonationResourceNames: ["admin"] + podAnnotations: + secret.reloader.stakater.com/reload: weave-gitops-secret + valuesFrom: + - kind: Secret + name: weave-gitops-secret + valuesKey: adminPassword + targetPath: adminUser.passwordHash diff --git a/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml b/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml new file mode 100644 index 00000000..3805ad86 --- /dev/null +++ b/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: flux-system +resources: + - ./secret.sops.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/flux-system/weave-gitops/ks.yaml b/kubernetes/apps/flux-system/weave-gitops/ks.yaml new file mode 100644 index 00000000..f5b97d88 --- /dev/null +++ b/kubernetes/apps/flux-system/weave-gitops/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-weave-gitops + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/flux-system/weave-gitops/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: weave-gitops + namespace: flux-system + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/tmpl/cluster/kube-vip-daemonset.yaml b/kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml similarity index 92% rename from tmpl/cluster/kube-vip-daemonset.yaml rename to kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml index 612261f7..8a7f835b 100644 --- a/tmpl/cluster/kube-vip-daemonset.yaml +++ b/kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml @@ -22,8 +22,7 @@ spec: - name: kube-vip image: ghcr.io/kube-vip/kube-vip:v0.5.7 imagePullPolicy: IfNotPresent - args: - - manager + args: ["manager"] env: - name: vip_arp value: "true" @@ -46,12 +45,10 @@ spec: - name: vip_retryperiod value: "2" - name: address - value: "${BOOTSTRAP_KUBE_VIP_ADDR}" + value: "${KUBE_VIP_ADDR}" securityContext: capabilities: - add: - - NET_ADMIN - - NET_RAW + add: ["NET_ADMIN", "NET_RAW"] hostAliases: - hostnames: - kubernetes diff --git a/cluster/apps/kube-system/kube-vip/kustomization.yaml b/kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml similarity index 88% rename from cluster/apps/kube-system/kube-vip/kustomization.yaml rename to kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml index 7da80f8b..6c67d41b 100644 --- a/cluster/apps/kube-system/kube-vip/kustomization.yaml +++ b/kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml @@ -1,6 +1,7 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: kube-system resources: - ./rbac.yaml - ./daemon-set.yaml diff --git a/cluster/apps/kube-system/kube-vip/rbac.yaml b/kubernetes/apps/kube-system/kube-vip/app/rbac.yaml similarity index 100% rename from cluster/apps/kube-system/kube-vip/rbac.yaml rename to kubernetes/apps/kube-system/kube-vip/app/rbac.yaml diff --git a/kubernetes/apps/kube-system/kube-vip/ks.yaml b/kubernetes/apps/kube-system/kube-vip/ks.yaml new file mode 100644 index 00000000..6d371684 --- /dev/null +++ b/kubernetes/apps/kube-system/kube-vip/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-kube-vip + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/kube-system/kube-vip/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: apps/v1 + kind: DaemonSet + name: kube-vip + namespace: kube-system + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/kubernetes/apps/kube-system/kustomization.yaml b/kubernetes/apps/kube-system/kustomization.yaml new file mode 100644 index 00000000..b9817047 --- /dev/null +++ b/kubernetes/apps/kube-system/kustomization.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + - ./kube-vip/ks.yaml + - ./metrics-server/ks.yaml + - ./reloader/ks.yaml diff --git a/cluster/apps/kube-system/metrics-server/helm-release.yaml b/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml similarity index 84% rename from cluster/apps/kube-system/metrics-server/helm-release.yaml rename to kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml index 0e3953e5..3af2a2a3 100644 --- a/cluster/apps/kube-system/metrics-server/helm-release.yaml +++ b/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml @@ -14,17 +14,20 @@ spec: kind: HelmRepository name: metrics-server namespace: flux-system - interval: 15m install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 values: args: - --kubelet-insecure-tls - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --kubelet-use-node-status-port - --metric-resolution=15s + metrics: + enabled: true + serviceMonitor: + enabled: true diff --git a/cluster/apps/default/hajimari/kustomization.yaml b/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml similarity index 63% rename from cluster/apps/default/hajimari/kustomization.yaml rename to kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml index b514428e..1c3fdb04 100644 --- a/cluster/apps/default/hajimari/kustomization.yaml +++ b/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml @@ -1,6 +1,6 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: kube-system resources: - - ./config-pvc.yaml - - ./helm-release.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/kube-system/metrics-server/ks.yaml b/kubernetes/apps/kube-system/metrics-server/ks.yaml new file mode 100644 index 00000000..cb8b337a --- /dev/null +++ b/kubernetes/apps/kube-system/metrics-server/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-metrics-server + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/kube-system/metrics-server/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: metrics-server + namespace: kube-system + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/cluster/apps/kube-system/namespace.yaml b/kubernetes/apps/kube-system/namespace.yaml similarity index 100% rename from cluster/apps/kube-system/namespace.yaml rename to kubernetes/apps/kube-system/namespace.yaml diff --git a/cluster/apps/kube-system/reloader/helm-release.yaml b/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml similarity index 59% rename from cluster/apps/kube-system/reloader/helm-release.yaml rename to kubernetes/apps/kube-system/reloader/app/helmrelease.yaml index b3e87de8..b4f125a6 100644 --- a/cluster/apps/kube-system/reloader/helm-release.yaml +++ b/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: reloader - namespace: kube-system + namespace: &namespace kube-system spec: interval: 15m chart: @@ -14,13 +14,21 @@ spec: kind: HelmRepository name: stakater namespace: flux-system - interval: 15m install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 values: fullnameOverride: reloader + reloader: + enableHA: true + deployment: + replicas: 3 + reloadStrategy: annotations + reloadOnCreate: false + podMonitor: + enabled: true + namespace: *namespace diff --git a/kubernetes/apps/kube-system/reloader/app/kustomization.yaml b/kubernetes/apps/kube-system/reloader/app/kustomization.yaml new file mode 100644 index 00000000..1c3fdb04 --- /dev/null +++ b/kubernetes/apps/kube-system/reloader/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kube-system +resources: + - ./helmrelease.yaml diff --git a/kubernetes/apps/kube-system/reloader/ks.yaml b/kubernetes/apps/kube-system/reloader/ks.yaml new file mode 100644 index 00000000..bfcd9b85 --- /dev/null +++ b/kubernetes/apps/kube-system/reloader/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-reloader + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/kube-system/reloader/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: reloader + namespace: kube-system + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/cluster/apps/kube-system/cloudflare-ddns/cloudflare-ddns.sh b/kubernetes/apps/networking/cloudflare-ddns/app/cloudflare-ddns.sh similarity index 100% rename from cluster/apps/kube-system/cloudflare-ddns/cloudflare-ddns.sh rename to kubernetes/apps/networking/cloudflare-ddns/app/cloudflare-ddns.sh diff --git a/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml b/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml new file mode 100644 index 00000000..0be8d7cc --- /dev/null +++ b/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: cloudflare-ddns + namespace: networking +spec: + interval: 15m + chart: + spec: + chart: app-template + version: 1.2.0 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + controller: + type: cronjob + cronjob: + concurrencyPolicy: Forbid + schedule: "@hourly" + restartPolicy: OnFailure + image: + repository: ghcr.io/onedr0p/kubernetes-kubectl + tag: 1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d + command: ["/bin/bash", "/app/cloudflare-ddns.sh"] + envFrom: + - secretRef: + name: cloudflare-ddns-secret + service: + main: + enabled: false + persistence: + config: + enabled: true + type: configMap + name: cloudflare-ddns-configmap + subPath: cloudflare-ddns.sh + mountPath: /app/cloudflare-ddns.sh + defaultMode: 0775 + readOnly: true diff --git a/cluster/apps/kube-system/cloudflare-ddns/kustomization.yaml b/kubernetes/apps/networking/cloudflare-ddns/app/kustomization.yaml similarity index 77% rename from cluster/apps/kube-system/cloudflare-ddns/kustomization.yaml rename to kubernetes/apps/networking/cloudflare-ddns/app/kustomization.yaml index b4cebcb7..b726e78c 100644 --- a/cluster/apps/kube-system/cloudflare-ddns/kustomization.yaml +++ b/kubernetes/apps/networking/cloudflare-ddns/app/kustomization.yaml @@ -1,12 +1,12 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: networking resources: - - ./cron-job.yaml - ./secret.sops.yaml -namespace: kube-system + - ./helmrelease.yaml configMapGenerator: - - name: cloudflare-ddns + - name: cloudflare-ddns-configmap files: - ./cloudflare-ddns.sh generatorOptions: diff --git a/kubernetes/apps/networking/cloudflare-ddns/ks.yaml b/kubernetes/apps/networking/cloudflare-ddns/ks.yaml new file mode 100644 index 00000000..b3577fd6 --- /dev/null +++ b/kubernetes/apps/networking/cloudflare-ddns/ks.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-cloudflare-ddns + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/networking/cloudflare-ddns/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: cloudflare-ddns + namespace: networking + interval: 30m + timeout: 5m diff --git a/cluster/apps/kube-system/external-dns/helm-release.yaml b/kubernetes/apps/networking/external-dns/app/helmrelease.yaml similarity index 60% rename from cluster/apps/kube-system/external-dns/helm-release.yaml rename to kubernetes/apps/networking/external-dns/app/helmrelease.yaml index ae93b5b7..4de524f6 100644 --- a/cluster/apps/kube-system/external-dns/helm-release.yaml +++ b/kubernetes/apps/networking/external-dns/app/helmrelease.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: external-dns - namespace: kube-system + namespace: networking spec: interval: 15m chart: @@ -14,42 +14,38 @@ spec: kind: HelmRepository name: external-dns namespace: flux-system - interval: 15m install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 values: - interval: 5m - logLevel: debug + interval: 2m + # logLevel: debug provider: cloudflare env: - name: CF_API_EMAIL valueFrom: secretKeyRef: - name: external-dns-cloud-credentials + name: external-dns-secret key: email - name: CF_API_KEY valueFrom: secretKeyRef: - name: external-dns-cloud-credentials + name: external-dns-secret key: api-key extraArgs: - --cloudflare-proxied - - --annotation-filter=external-dns/is-public in (true) + - --annotation-filter=external-dns.home.arpa/enabled in (true) policy: sync - sources: - - ingress - txtPrefix: "k8s." - txtOwnerId: "default" + sources: ["ingress"] + txtPrefix: k8s. + txtOwnerId: default domainFilters: - "${SECRET_DOMAIN}" - resources: - requests: - memory: 100Mi - cpu: 25m - limits: - memory: 250Mi + serviceMonitor: + enabled: true + podAnnotations: + secret.reloader.stakater.com/reload: external-dns-secret diff --git a/cluster/apps/kube-system/cert-manager/issuers/kustomization.yaml b/kubernetes/apps/networking/external-dns/app/kustomization.yaml similarity index 66% rename from cluster/apps/kube-system/cert-manager/issuers/kustomization.yaml rename to kubernetes/apps/networking/external-dns/app/kustomization.yaml index 2ef9a38d..a07ca991 100644 --- a/cluster/apps/kube-system/cert-manager/issuers/kustomization.yaml +++ b/kubernetes/apps/networking/external-dns/app/kustomization.yaml @@ -1,5 +1,7 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: networking resources: - - ./helm-release.yaml - ./secret.sops.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/networking/external-dns/ks.yaml b/kubernetes/apps/networking/external-dns/ks.yaml new file mode 100644 index 00000000..45af753f --- /dev/null +++ b/kubernetes/apps/networking/external-dns/ks.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-external-dns + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/networking/external-dns/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: external-dns + namespace: networking + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/cluster/apps/kube-system/ingress-nginx/cloudflare-proxied-networks.txt b/kubernetes/apps/networking/ingress-nginx/app/cloudflare-networks.txt similarity index 100% rename from cluster/apps/kube-system/ingress-nginx/cloudflare-proxied-networks.txt rename to kubernetes/apps/networking/ingress-nginx/app/cloudflare-networks.txt diff --git a/cluster/apps/kube-system/ingress-nginx/helm-release.yaml b/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml similarity index 84% rename from cluster/apps/kube-system/ingress-nginx/helm-release.yaml rename to kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml index 0484c637..999f7b74 100644 --- a/cluster/apps/kube-system/ingress-nginx/helm-release.yaml +++ b/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: ingress-nginx - namespace: kube-system + namespace: networking spec: interval: 15m chart: @@ -18,18 +18,16 @@ spec: install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 dependsOn: - name: cert-manager - namespace: kube-system - - name: cert-manager-issuers - namespace: kube-system + namespace: cert-manager values: controller: - replicaCount: 1 + replicaCount: 2 extraEnvs: - name: TZ value: "${TIMEZONE}" @@ -59,7 +57,7 @@ spec: metrics: enabled: false podAnnotations: - configmap.reloader.stakater.com/reload: "cloudflare-proxied-networks" + configmap.reloader.stakater.com/reload: "cloudflare-networks" resources: requests: cpu: 10m @@ -82,5 +80,5 @@ spec: # https://www.cloudflare.com/ips/ - targetPath: controller.config.proxy-real-ip-cidr kind: ConfigMap - name: cloudflare-proxied-networks - valuesKey: cloudflare-proxied-networks.txt + name: cloudflare-networks + valuesKey: cloudflare-networks.txt diff --git a/cluster/apps/kube-system/ingress-nginx/kustomization.yaml b/kubernetes/apps/networking/ingress-nginx/app/kustomization.yaml similarity index 55% rename from cluster/apps/kube-system/ingress-nginx/kustomization.yaml rename to kubernetes/apps/networking/ingress-nginx/app/kustomization.yaml index 9f5faee7..bbb7ea26 100644 --- a/cluster/apps/kube-system/ingress-nginx/kustomization.yaml +++ b/kubernetes/apps/networking/ingress-nginx/app/kustomization.yaml @@ -1,12 +1,12 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -namespace: kube-system +namespace: networking resources: - - ./helm-release.yaml + - ./helmrelease.yaml configMapGenerator: - - name: cloudflare-proxied-networks + - name: cloudflare-networks files: - - ./cloudflare-proxied-networks.txt + - ./cloudflare-networks.txt generatorOptions: disableNameSuffixHash: true diff --git a/kubernetes/apps/networking/ingress-nginx/ks.yaml b/kubernetes/apps/networking/ingress-nginx/ks.yaml new file mode 100644 index 00000000..fc7e8d72 --- /dev/null +++ b/kubernetes/apps/networking/ingress-nginx/ks.yaml @@ -0,0 +1,27 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-ingress-nginx + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-cert-manager + - name: cluster-apps-cert-manager-issuers + - name: cluster-apps-metallb + - name: cluster-apps-metallb-config + path: ./kubernetes/apps/networking/ingress-nginx/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: ingress-nginx + namespace: networking + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/cluster/apps/kube-system/k8s-gateway/helm-release.yaml b/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml similarity index 89% rename from cluster/apps/kube-system/k8s-gateway/helm-release.yaml rename to kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml index f33b86ca..a0116e9b 100644 --- a/cluster/apps/kube-system/k8s-gateway/helm-release.yaml +++ b/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: k8s-gateway - namespace: kube-system + namespace: networking spec: interval: 15m chart: @@ -24,10 +24,9 @@ spec: retries: 5 dependsOn: - name: metallb - namespace: kube-system values: fullnameOverride: k8s-gateway - domain: ${SECRET_DOMAIN} + domain: "${SECRET_DOMAIN}" ttl: 1 service: type: LoadBalancer diff --git a/cluster/apps/kube-system/metallb/kustomization.yaml b/kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml similarity index 63% rename from cluster/apps/kube-system/metallb/kustomization.yaml rename to kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml index c3dfd010..c83d92a8 100644 --- a/cluster/apps/kube-system/metallb/kustomization.yaml +++ b/kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml @@ -1,6 +1,6 @@ --- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: networking resources: - - ./helm-release.yaml - - ./config + - ./helmrelease.yaml diff --git a/kubernetes/apps/networking/k8s-gateway/ks.yaml b/kubernetes/apps/networking/k8s-gateway/ks.yaml new file mode 100644 index 00000000..dfecac51 --- /dev/null +++ b/kubernetes/apps/networking/k8s-gateway/ks.yaml @@ -0,0 +1,25 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-k8s-gateway + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-metallb + - name: cluster-apps-metallb-config + path: ./kubernetes/apps/networking/k8s-gateway/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: k8s-gateway + namespace: networking + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/kubernetes/apps/networking/kustomization.yaml b/kubernetes/apps/networking/kustomization.yaml new file mode 100644 index 00000000..4a86c4fd --- /dev/null +++ b/kubernetes/apps/networking/kustomization.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + - ./cloudflare-ddns/ks.yaml + - ./external-dns/ks.yaml + - ./ingress-nginx/ks.yaml + - ./k8s-gateway/ks.yaml + - ./metallb/ks.yaml diff --git a/cluster/apps/kube-system/metallb/helm-release.yaml b/kubernetes/apps/networking/metallb/app/helmrelease.yaml similarity index 87% rename from cluster/apps/kube-system/metallb/helm-release.yaml rename to kubernetes/apps/networking/metallb/app/helmrelease.yaml index 4358eff3..2db0214e 100644 --- a/cluster/apps/kube-system/metallb/helm-release.yaml +++ b/kubernetes/apps/networking/metallb/app/helmrelease.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: metallb - namespace: kube-system + namespace: networking spec: interval: 15m chart: @@ -17,10 +17,10 @@ spec: install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: remediation: - retries: 5 + retries: 3 values: crds: enabled: true diff --git a/kubernetes/apps/networking/metallb/app/kustomization.yaml b/kubernetes/apps/networking/metallb/app/kustomization.yaml new file mode 100644 index 00000000..c83d92a8 --- /dev/null +++ b/kubernetes/apps/networking/metallb/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: networking +resources: + - ./helmrelease.yaml diff --git a/cluster/apps/kube-system/k8s-gateway/kustomization.yaml b/kubernetes/apps/networking/metallb/config/kustomization.yaml similarity index 64% rename from cluster/apps/kube-system/k8s-gateway/kustomization.yaml rename to kubernetes/apps/networking/metallb/config/kustomization.yaml index bfe61558..b739ea95 100644 --- a/cluster/apps/kube-system/k8s-gateway/kustomization.yaml +++ b/kubernetes/apps/networking/metallb/config/kustomization.yaml @@ -1,5 +1,5 @@ ---- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +namespace: networking resources: - - ./helm-release.yaml + - resources.yaml diff --git a/kubernetes/apps/networking/metallb/config/resources.yaml b/kubernetes/apps/networking/metallb/config/resources.yaml new file mode 100644 index 00000000..7c646df4 --- /dev/null +++ b/kubernetes/apps/networking/metallb/config/resources.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: l2-ip + namespace: networking +spec: + ipAddressPools: + - default-pool +--- +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: default-pool + namespace: networking +spec: + addresses: + - "${METALLB_LB_RANGE}" diff --git a/kubernetes/apps/networking/metallb/ks.yaml b/kubernetes/apps/networking/metallb/ks.yaml new file mode 100644 index 00000000..53f482f4 --- /dev/null +++ b/kubernetes/apps/networking/metallb/ks.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-metallb + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/networking/metallb/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2beta1 + kind: HelmRelease + name: metallb + namespace: networking + interval: 30m + retryInterval: 1m + timeout: 3m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-metallb-config + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-metallb + path: ./kubernetes/apps/networking/metallb/config + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 3m diff --git a/kubernetes/apps/networking/namespace.yaml b/kubernetes/apps/networking/namespace.yaml new file mode 100644 index 00000000..b9e4a416 --- /dev/null +++ b/kubernetes/apps/networking/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: networking + labels: + kustomize.toolkit.fluxcd.io/prune: disabled diff --git a/kubernetes/apps/system-upgrade/kustomization.yaml b/kubernetes/apps/system-upgrade/kustomization.yaml new file mode 100644 index 00000000..dbe5bdb5 --- /dev/null +++ b/kubernetes/apps/system-upgrade/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./namespace.yaml + # - ./system-upgrade-controller/ks.yaml diff --git a/cluster/apps/system-upgrade/namespace.yaml b/kubernetes/apps/system-upgrade/namespace.yaml similarity index 100% rename from cluster/apps/system-upgrade/namespace.yaml rename to kubernetes/apps/system-upgrade/namespace.yaml diff --git a/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml b/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml new file mode 100644 index 00000000..0e540a25 --- /dev/null +++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # renovate: datasource=docker image=rancher/system-upgrade-controller + - https://github.com/rancher/system-upgrade-controller/releases/download/v0.10.0/crd.yaml + - https://github.com/rancher/system-upgrade-controller?ref=v0.10.0 +images: + - name: rancher/system-upgrade-controller + newTag: v0.10.0 +commonLabels: + app.kubernetes.io/name: system-upgrade-controller + app.kubernetes.io/instance: system-upgrade-controller +patchesStrategicMerge: + - | + $patch: delete + apiVersion: v1 + kind: Namespace + metadata: + name: system-upgrade diff --git a/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml b/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml new file mode 100644 index 00000000..6d10ca90 --- /dev/null +++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-system-upgrade-controller + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 3m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: cluster-apps-system-upgrade-controller-plans + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-system-upgrade-controller + path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml similarity index 63% rename from cluster/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml rename to kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml index 440479ed..92444d7c 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml +++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml @@ -2,25 +2,18 @@ apiVersion: upgrade.cattle.io/v1 kind: Plan metadata: - name: k3s-agent + name: agent namespace: system-upgrade - labels: - k3s-upgrade: agent spec: - serviceAccountName: system-upgrade - concurrency: 1 # renovate: datasource=github-releases depName=k3s-io/k3s version: "v1.24.8+k3s1" + serviceAccountName: system-upgrade + concurrency: 1 nodeSelector: matchExpressions: - - key: node-role.kubernetes.io/master - operator: NotIn - values: - - "true" + - {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist} prepare: image: rancher/k3s-upgrade - args: - - "prepare" - - "k3s-server" + args: ["prepare", "server"] upgrade: image: rancher/k3s-upgrade diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml similarity index 100% rename from cluster/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml rename to kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml index 5b11f8da..2a658c35 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml +++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml @@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ./agent.yaml - ./server.yaml + - ./agent.yaml diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/plans/server.yaml b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml similarity index 61% rename from cluster/apps/system-upgrade/system-upgrade-controller/plans/server.yaml rename to kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml index aec4f995..5be645bf 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/plans/server.yaml +++ b/kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml @@ -2,22 +2,16 @@ apiVersion: upgrade.cattle.io/v1 kind: Plan metadata: - name: k3s-server + name: server namespace: system-upgrade spec: - serviceAccountName: system-upgrade - concurrency: 1 # renovate: datasource=github-releases depName=k3s-io/k3s version: "v1.24.8+k3s1" + serviceAccountName: system-upgrade + concurrency: 1 cordon: true nodeSelector: matchExpressions: - - key: node-role.kubernetes.io/master - operator: In - values: - - "true" - tolerations: - - key: "node-role.kubernetes.io/master" - operator: "Exists" + - {key: node-role.kubernetes.io/control-plane, operator: Exists} upgrade: image: rancher/k3s-upgrade diff --git a/cluster/bootstrap/kustomization.yaml b/kubernetes/bootstrap/kustomization.yaml similarity index 66% rename from cluster/bootstrap/kustomization.yaml rename to kubernetes/bootstrap/kustomization.yaml index f4287491..d50bda51 100644 --- a/cluster/bootstrap/kustomization.yaml +++ b/kubernetes/bootstrap/kustomization.yaml @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - github.com/fluxcd/flux2/manifests/install?ref=v0.37.0 + - github.com/fluxcd/flux2/manifests/install?ref=v0.38.1 images: - name: fluxcd/helm-controller newName: ghcr.io/fluxcd/helm-controller @@ -17,13 +17,23 @@ images: - name: fluxcd/source-controller newName: ghcr.io/fluxcd/source-controller patches: - - target: - group: networking.k8s.io - version: v1 - kind: NetworkPolicy - patch: |- + - patch: |- $patch: delete apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: not-used + target: + group: networking.k8s.io + version: v1 + kind: NetworkPolicy + - patch: | + - op: add + path: /spec/template/spec/containers/0/args/- + value: --concurrent=20 + - op: add + path: /spec/template/spec/containers/0/args/- + value: --requeue-dependency=5s + target: + kind: Deployment + name: "(kustomize-controller|helm-controller|source-controller)" diff --git a/cluster/flux/apps.yaml b/kubernetes/flux/apps.yaml similarity index 75% rename from cluster/flux/apps.yaml rename to kubernetes/flux/apps.yaml index 176c299a..d38f4d15 100644 --- a/cluster/flux/apps.yaml +++ b/kubernetes/flux/apps.yaml @@ -2,18 +2,15 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 kind: Kustomization metadata: - name: apps + name: cluster-apps namespace: flux-system spec: interval: 30m - path: ./cluster/apps + path: ./kubernetes/apps prune: true sourceRef: kind: GitRepository - name: flux-cluster - dependsOn: - - name: flux-installation - - name: flux-cluster + name: home-kubernetes decryption: provider: sops secretRef: diff --git a/cluster/flux/config/flux-installation.yaml b/kubernetes/flux/config/flux.yaml similarity index 66% rename from cluster/flux/config/flux-installation.yaml rename to kubernetes/flux/config/flux.yaml index 71d1c0e0..400e2fde 100644 --- a/cluster/flux/config/flux-installation.yaml +++ b/kubernetes/flux/config/flux.yaml @@ -1,33 +1,28 @@ --- apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: GitRepository +kind: OCIRepository metadata: - name: flux-installation + name: flux-manifests namespace: flux-system spec: interval: 10m + url: oci://ghcr.io/fluxcd/flux-manifests ref: - tag: v0.37.0 - url: https://github.com/fluxcd/flux2 - ignore: | - # exclude all - /* - # path to manifests - !/manifests + tag: v0.38.1 --- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 kind: Kustomization metadata: - name: flux-installation + name: flux namespace: flux-system spec: interval: 10m - path: ./manifests/install + path: ./ prune: true wait: true sourceRef: - kind: GitRepository - name: flux-installation + kind: OCIRepository + name: flux-manifests images: - name: fluxcd/helm-controller newName: ghcr.io/fluxcd/helm-controller @@ -42,13 +37,23 @@ spec: - name: fluxcd/source-controller newName: ghcr.io/fluxcd/source-controller patches: - - target: - group: networking.k8s.io - version: v1 - kind: NetworkPolicy - patch: |- + - patch: | $patch: delete apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: not-used + target: + group: networking.k8s.io + version: v1 + kind: NetworkPolicy + - patch: | + - op: add + path: /spec/template/spec/containers/0/args/- + value: --concurrent=20 + - op: add + path: /spec/template/spec/containers/0/args/- + value: --requeue-dependency=5s + target: + kind: Deployment + name: "(kustomize-controller|helm-controller|source-controller)" diff --git a/cluster/apps/kube-system/reloader/kustomization.yaml b/kubernetes/flux/config/kustomization.yaml similarity index 69% rename from cluster/apps/kube-system/reloader/kustomization.yaml rename to kubernetes/flux/config/kustomization.yaml index bfe61558..ef231746 100644 --- a/cluster/apps/kube-system/reloader/kustomization.yaml +++ b/kubernetes/flux/config/kustomization.yaml @@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ./helm-release.yaml + - ./flux.yaml + - ./cluster.yaml diff --git a/cluster/flux/repositories/oci/.gitkeep b/kubernetes/flux/repositories/git/.gitkeep similarity index 100% rename from cluster/flux/repositories/oci/.gitkeep rename to kubernetes/flux/repositories/git/.gitkeep diff --git a/cluster/flux/repositories/helm/bitnami-charts.yaml b/kubernetes/flux/repositories/helm/bitnami.yaml similarity index 100% rename from cluster/flux/repositories/helm/bitnami-charts.yaml rename to kubernetes/flux/repositories/helm/bitnami.yaml diff --git a/cluster/flux/repositories/helm/bjw-s-charts.yaml b/kubernetes/flux/repositories/helm/bjw-s.yaml similarity index 100% rename from cluster/flux/repositories/helm/bjw-s-charts.yaml rename to kubernetes/flux/repositories/helm/bjw-s.yaml diff --git a/cluster/flux/repositories/helm/external-dns-charts.yaml b/kubernetes/flux/repositories/helm/external-dns.yaml similarity index 100% rename from cluster/flux/repositories/helm/external-dns-charts.yaml rename to kubernetes/flux/repositories/helm/external-dns.yaml diff --git a/cluster/flux/repositories/helm/hajimari-charts.yaml b/kubernetes/flux/repositories/helm/hajimari.yaml similarity index 100% rename from cluster/flux/repositories/helm/hajimari-charts.yaml rename to kubernetes/flux/repositories/helm/hajimari.yaml diff --git a/cluster/flux/repositories/helm/ingress-nginx-charts.yaml b/kubernetes/flux/repositories/helm/ingress-nginx.yaml similarity index 100% rename from cluster/flux/repositories/helm/ingress-nginx-charts.yaml rename to kubernetes/flux/repositories/helm/ingress-nginx.yaml diff --git a/cluster/flux/repositories/helm/jetstack-charts.yaml b/kubernetes/flux/repositories/helm/jetstack.yaml similarity index 100% rename from cluster/flux/repositories/helm/jetstack-charts.yaml rename to kubernetes/flux/repositories/helm/jetstack.yaml diff --git a/cluster/flux/repositories/helm/k8s-gateway-charts.yaml b/kubernetes/flux/repositories/helm/k8s-gateway.yaml similarity index 100% rename from cluster/flux/repositories/helm/k8s-gateway-charts.yaml rename to kubernetes/flux/repositories/helm/k8s-gateway.yaml diff --git a/kubernetes/flux/repositories/helm/kustomization.yaml b/kubernetes/flux/repositories/helm/kustomization.yaml new file mode 100644 index 00000000..7bd24cd8 --- /dev/null +++ b/kubernetes/flux/repositories/helm/kustomization.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./bitnami.yaml + - ./bjw-s.yaml + - ./external-dns.yaml + - ./hajimari.yaml + - ./ingress-nginx.yaml + - ./jetstack.yaml + - ./k8s-gateway.yaml + - ./metallb.yaml + - ./metrics-server.yaml + - ./stakater.yaml + - ./weave-gitops.yaml diff --git a/cluster/flux/repositories/helm/metallb-charts.yaml b/kubernetes/flux/repositories/helm/metallb.yaml similarity index 100% rename from cluster/flux/repositories/helm/metallb-charts.yaml rename to kubernetes/flux/repositories/helm/metallb.yaml diff --git a/cluster/flux/repositories/helm/metrics-server-charts.yaml b/kubernetes/flux/repositories/helm/metrics-server.yaml similarity index 100% rename from cluster/flux/repositories/helm/metrics-server-charts.yaml rename to kubernetes/flux/repositories/helm/metrics-server.yaml diff --git a/cluster/flux/repositories/helm/stakater-charts.yaml b/kubernetes/flux/repositories/helm/stakater.yaml similarity index 100% rename from cluster/flux/repositories/helm/stakater-charts.yaml rename to kubernetes/flux/repositories/helm/stakater.yaml diff --git a/cluster/flux/repositories/helm/dysnix-charts.yaml b/kubernetes/flux/repositories/helm/weave-gitops.yaml similarity index 67% rename from cluster/flux/repositories/helm/dysnix-charts.yaml rename to kubernetes/flux/repositories/helm/weave-gitops.yaml index ce01a64b..81d4cea2 100644 --- a/cluster/flux/repositories/helm/dysnix-charts.yaml +++ b/kubernetes/flux/repositories/helm/weave-gitops.yaml @@ -2,8 +2,8 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: - name: dysnix + name: weave-gitops namespace: flux-system spec: interval: 1h - url: https://dysnix.github.io/charts + url: https://helm.gitops.weave.works diff --git a/cluster/flux/repositories/kustomization.yaml b/kubernetes/flux/repositories/kustomization.yaml similarity index 100% rename from cluster/flux/repositories/kustomization.yaml rename to kubernetes/flux/repositories/kustomization.yaml diff --git a/provision/ansible/inventory/host_vars/.gitkeep b/kubernetes/flux/repositories/oci/.gitkeep similarity index 100% rename from provision/ansible/inventory/host_vars/.gitkeep rename to kubernetes/flux/repositories/oci/.gitkeep diff --git a/cluster/flux/vars/kustomization.yaml b/kubernetes/flux/vars/kustomization.yaml similarity index 100% rename from cluster/flux/vars/kustomization.yaml rename to kubernetes/flux/vars/kustomization.yaml diff --git a/provision/terraform/cloudflare/main.tf b/terraform/cloudflare/main.tf similarity index 83% rename from provision/terraform/cloudflare/main.tf rename to terraform/cloudflare/main.tf index 0bba0c61..7b684737 100644 --- a/provision/terraform/cloudflare/main.tf +++ b/terraform/cloudflare/main.tf @@ -34,32 +34,26 @@ data "cloudflare_zones" "domain" { resource "cloudflare_zone_settings_override" "cloudflare_settings" { zone_id = lookup(data.cloudflare_zones.domain.zones[0], "id") settings { - # /ssl-tls - ssl = "strict" - # /ssl-tls/edge-certificates + ssl = "strict" always_use_https = "on" min_tls_version = "1.2" opportunistic_encryption = "on" tls_1_3 = "zrt" automatic_https_rewrites = "on" universal_ssl = "on" - # /firewall/settings - browser_check = "on" - challenge_ttl = 1800 - privacy_pass = "on" - security_level = "medium" - # /speed/optimization - brotli = "on" + browser_check = "on" + challenge_ttl = 1800 + privacy_pass = "on" + security_level = "medium" + brotli = "on" minify { css = "on" js = "on" html = "on" } - rocket_loader = "on" - # /caching/configuration - always_online = "off" - development_mode = "off" - # /network + rocket_loader = "on" + always_online = "off" + development_mode = "off" http3 = "on" zero_rtt = "on" ipv6 = "on" @@ -67,11 +61,9 @@ resource "cloudflare_zone_settings_override" "cloudflare_settings" { opportunistic_onion = "on" pseudo_ipv4 = "off" ip_geolocation = "on" - # /content-protection email_obfuscation = "on" server_side_exclude = "on" hotlink_protection = "off" - # /workers security_header { enabled = false } diff --git a/tmpl/.sops.yaml b/tmpl/.sops.yaml index 5839d9a8..727731e3 100644 --- a/tmpl/.sops.yaml +++ b/tmpl/.sops.yaml @@ -1,12 +1,15 @@ --- creation_rules: - - path_regex: provision/.*\.sops\.ya?ml - unencrypted_regex: "^(kind)$" - key_groups: - - age: - - ${BOOTSTRAP_AGE_PUBLIC_KEY} - - path_regex: cluster/.*\.sops\.ya?ml + - path_regex: kubernetes/.*\.sops\.ya?ml encrypted_regex: "^(data|stringData)$" key_groups: - age: - ${BOOTSTRAP_AGE_PUBLIC_KEY} + - path_regex: ansible/.*\.sops\.ya?ml + key_groups: + - age: + - ${BOOTSTRAP_AGE_PUBLIC_KEY} + - path_regex: terraform/.*\.sops\.ya?ml + key_groups: + - age: + - ${BOOTSTRAP_AGE_PUBLIC_KEY} diff --git a/tmpl/cluster/cert-manager-secret.sops.yaml b/tmpl/cluster/cert-manager-secret.sops.yaml deleted file mode 100644 index 38c38c85..00000000 --- a/tmpl/cluster/cert-manager-secret.sops.yaml +++ /dev/null @@ -1,8 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: cloudflare-api-key - namespace: kube-system -stringData: - api-key: ${BOOTSTRAP_CLOUDFLARE_APIKEY} diff --git a/tmpl/cluster/cloudflare-ddns-secret.sops.yaml b/tmpl/cluster/cloudflare-ddns-secret.sops.yaml deleted file mode 100644 index 107ad30a..00000000 --- a/tmpl/cluster/cloudflare-ddns-secret.sops.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: cloudflare-ddns - namespace: kube-system -type: Opaque -stringData: - CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL} - CLOUDFLARE_APIKEY: ${BOOTSTRAP_CLOUDFLARE_APIKEY} - CLOUDFLARE_RECORD_NAME: ipv4.${BOOTSTRAP_CLOUDFLARE_DOMAIN} diff --git a/tmpl/cluster/cluster-secrets.sops.yaml b/tmpl/cluster/cluster-secrets.sops.yaml deleted file mode 100644 index 24a68a4a..00000000 --- a/tmpl/cluster/cluster-secrets.sops.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: cluster-secrets - namespace: flux-system -stringData: - SECRET_DOMAIN: ${BOOTSTRAP_CLOUDFLARE_DOMAIN} - SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL} diff --git a/tmpl/cluster/cluster-settings.yaml b/tmpl/cluster/cluster-settings.yaml deleted file mode 100644 index e055b0b4..00000000 --- a/tmpl/cluster/cluster-settings.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: cluster-settings - namespace: flux-system -data: - TIMEZONE: ${BOOTSTRAP_TIMEZONE} - METALLB_LB_RANGE: ${BOOTSTRAP_METALLB_LB_RANGE} - METALLB_K8S_GATEWAY_ADDR: ${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR} - METALLB_INGRESS_ADDR: ${BOOTSTRAP_METALLB_INGRESS_ADDR} diff --git a/tmpl/cluster/external-dns-secret.sops.yaml b/tmpl/cluster/external-dns-secret.sops.yaml deleted file mode 100644 index b6316acb..00000000 --- a/tmpl/cluster/external-dns-secret.sops.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: external-dns-cloud-credentials - namespace: kube-system -stringData: - email: ${BOOTSTRAP_CLOUDFLARE_EMAIL} - api-key: ${BOOTSTRAP_CLOUDFLARE_APIKEY} diff --git a/tmpl/cluster/flux/kustomization.yaml b/tmpl/cluster/flux/kustomization.yaml deleted file mode 100644 index 04d02782..00000000 --- a/tmpl/cluster/flux/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ./webhooks diff --git a/tmpl/kubernetes/cert-manager-secret.sops.yaml b/tmpl/kubernetes/cert-manager-secret.sops.yaml new file mode 100644 index 00000000..49000027 --- /dev/null +++ b/tmpl/kubernetes/cert-manager-secret.sops.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: cert-manager-secret + namespace: cert-manager +stringData: + api-key: "${BOOTSTRAP_CLOUDFLARE_APIKEY}" diff --git a/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml b/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml new file mode 100644 index 00000000..d9af99bf --- /dev/null +++ b/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: cloudflare-ddns-secret + namespace: networking +type: Opaque +stringData: + CLOUDFLARE_EMAIL: "${BOOTSTRAP_CLOUDFLARE_EMAIL}" + CLOUDFLARE_APIKEY: "${BOOTSTRAP_CLOUDFLARE_APIKEY}" + CLOUDFLARE_RECORD_NAME: "ipv4.${BOOTSTRAP_CLOUDFLARE_DOMAIN}" diff --git a/tmpl/kubernetes/cluster-secrets.sops.yaml b/tmpl/kubernetes/cluster-secrets.sops.yaml new file mode 100644 index 00000000..22cc746d --- /dev/null +++ b/tmpl/kubernetes/cluster-secrets.sops.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: cluster-secrets + namespace: flux-system +stringData: + SECRET_DOMAIN: "${BOOTSTRAP_CLOUDFLARE_DOMAIN}" + SECRET_CLOUDFLARE_EMAIL: "${BOOTSTRAP_CLOUDFLARE_EMAIL}" diff --git a/tmpl/kubernetes/external-dns-secret.sops.yaml b/tmpl/kubernetes/external-dns-secret.sops.yaml new file mode 100644 index 00000000..5047e45c --- /dev/null +++ b/tmpl/kubernetes/external-dns-secret.sops.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: external-dns-secret + namespace: networking +stringData: + email: "${BOOTSTRAP_CLOUDFLARE_EMAIL}" + api-key: "${BOOTSTRAP_CLOUDFLARE_APIKEY}" diff --git a/tmpl/kubernetes/flux/cluster-settings.yaml b/tmpl/kubernetes/flux/cluster-settings.yaml new file mode 100644 index 00000000..5e126097 --- /dev/null +++ b/tmpl/kubernetes/flux/cluster-settings.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-settings + namespace: flux-system +data: + TIMEZONE: "${BOOTSTRAP_TIMEZONE}" + KUBE_VIP_ADDR: "${BOOTSTRAP_KUBE_VIP_ADDR}" + METALLB_LB_RANGE: "${BOOTSTRAP_METALLB_LB_RANGE}" + METALLB_K8S_GATEWAY_ADDR: "${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}" + METALLB_INGRESS_ADDR: "${BOOTSTRAP_METALLB_INGRESS_ADDR}" diff --git a/tmpl/cluster/flux-cluster.yaml b/tmpl/kubernetes/flux/cluster.yaml similarity index 71% rename from tmpl/cluster/flux-cluster.yaml rename to tmpl/kubernetes/flux/cluster.yaml index 77eda929..bfe7a5de 100644 --- a/tmpl/cluster/flux-cluster.yaml +++ b/tmpl/kubernetes/flux/cluster.yaml @@ -2,27 +2,32 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: GitRepository metadata: - name: flux-cluster + name: home-kubernetes namespace: flux-system spec: interval: 30m ref: branch: main - url: ${BOOTSTRAP_GIT_REPOSITORY} + url: "${BOOTSTRAP_GIT_REPOSITORY}" + ignore: | + # exclude all + /* + # include kubernetes directory + !/kubernetes --- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 kind: Kustomization metadata: - name: flux-cluster + name: cluster namespace: flux-system spec: interval: 30m - path: ./cluster/flux + path: ./kubernetes/flux prune: true wait: false sourceRef: kind: GitRepository - name: flux-cluster + name: home-kubernetes decryption: provider: sops secretRef: diff --git a/tmpl/cluster/flux/webhooks/github/secret.sops.yaml b/tmpl/kubernetes/github-webhook-token-secret.sops.yaml similarity index 71% rename from tmpl/cluster/flux/webhooks/github/secret.sops.yaml rename to tmpl/kubernetes/github-webhook-token-secret.sops.yaml index b20dfee4..ab22b6dc 100644 --- a/tmpl/cluster/flux/webhooks/github/secret.sops.yaml +++ b/tmpl/kubernetes/github-webhook-token-secret.sops.yaml @@ -1,8 +1,8 @@ -# yamllint disable +--- apiVersion: v1 kind: Secret metadata: - name: github-webhook-secret + name: github-webhook-token-secret namespace: flux-system stringData: token: ${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET} diff --git a/tmpl/kubernetes/weave-gitops-secret.sops.yaml b/tmpl/kubernetes/weave-gitops-secret.sops.yaml new file mode 100644 index 00000000..bb3d837f --- /dev/null +++ b/tmpl/kubernetes/weave-gitops-secret.sops.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Secret +metadata: + name: weave-gitops-secret + namespace: flux-system +type: Opaque +stringData: + adminPassword: "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" diff --git a/tmpl/terraform/secret.sops.yaml b/tmpl/terraform/secret.sops.yaml index 0becc70f..117a997e 100644 --- a/tmpl/terraform/secret.sops.yaml +++ b/tmpl/terraform/secret.sops.yaml @@ -1,4 +1,3 @@ -kind: Secret -cloudflare_email: ${BOOTSTRAP_CLOUDFLARE_EMAIL} -cloudflare_apikey: ${BOOTSTRAP_CLOUDFLARE_APIKEY} -cloudflare_domain: ${BOOTSTRAP_CLOUDFLARE_DOMAIN} +cloudflare_email: "${BOOTSTRAP_CLOUDFLARE_EMAIL}" +cloudflare_apikey: "${BOOTSTRAP_CLOUDFLARE_APIKEY}" +cloudflare_domain: "${BOOTSTRAP_CLOUDFLARE_DOMAIN}"