infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat!: Refector directories and flux apps (#559)

Browse Source
This commit is contained in:
Devin Buhl authored and GitHub committed 2022-12-21 14:22:18 -05:00
1 parent a43e2325f1
commit 4e6edcc66a
163 files changed
+1194 -1060
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
+43
View File
@@ -0,0 +1,43 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 15m
chart:
spec:
chart: cert-manager
version: v1.10.1
sourceRef:
kind: HelmRepository
name: jetstack
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
installCRDs: true
replicaCount: 3
webhook:
replicaCount: 3
cainjector:
replicaCount: 3
extraArgs:
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
- --dns01-recursive-nameservers-only
podDnsPolicy: None
podDnsConfig:
nameservers:
- "1.1.1.1"
- "9.9.9.9"
prometheus:
enabled: true
servicemonitor:
enabled: true
prometheusInstance: monitoring
kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml
+17
View File
@@ -0,0 +1,17 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-manager
resources:
- ./helmrelease.yaml
- ./prometheusrule.yaml
configMapGenerator:
- name: cert-manager-dashboard
files:
- cert-manager-dashboard.json=https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
generatorOptions:
disableNameSuffixHash: true
annotations:
kustomize.toolkit.fluxcd.io/substitute: disabled
labels:
grafana_dashboard: "true"
kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml
+68
View File
@@ -0,0 +1,68 @@
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-manager.rules
namespace: cert-manager
spec:
groups:
- name: cert-manager
rules:
- alert: CertManagerAbsent
expr: |
absent(up{job="cert-manager"})
for: 15m
labels:
severity: critical
annotations:
description:
"New certificates will not be able to be minted, and existing
ones can't be renewed until cert-manager is back."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
summary: "Cert Manager has dissapeared from Prometheus service discovery."
- name: certificates
rules:
- alert: CertManagerCertExpirySoon
expr: |
avg by (exported_namespace, namespace, name) (
certmanager_certificate_expiration_timestamp_seconds - time())
< (21 * 24 * 3600)
for: 15m
labels:
severity: warning
annotations:
description:
"The domain that this cert covers will be unavailable after
{{ $value | humanizeDuration }}. Clients using endpoints that this cert
protects will start to fail in {{ $value | humanizeDuration }}."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
summary:
"The cert {{ $labels.name }} is {{ $value | humanizeDuration }}
from expiry, it should have renewed over a week ago."
- alert: CertManagerCertNotReady
expr: |
max by (name, exported_namespace, namespace, condition) (
certmanager_certificate_ready_status{condition!="True"} == 1)
for: 15m
labels:
severity: critical
annotations:
description:
"This certificate has not been ready to serve traffic for at least
10m. If the cert is being renewed or there is another valid cert, the ingress
controller _may_ be able to serve that instead."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
summary: "The cert {{ $labels.name }} is not ready to serve traffic."
- alert: CertManagerHittingRateLimits
expr: |
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m]))
> 0
for: 15m
labels:
severity: critical
annotations:
description:
"Depending on the rate limit, cert-manager may be unable to generate
certificates for up to a week."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
summary: "Cert manager hitting LetsEncrypt rate limits."
kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml
+41
View File
@@ -0,0 +1,41 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: "${SECRET_CLOUDFLARE_EMAIL}"
privateKeySecretRef:
name: letsencrypt-production
solvers:
- dns01:
cloudflare:
email: "${SECRET_CLOUDFLARE_EMAIL}"
apiKeySecretRef:
name: cert-manager-secret
key: api-key
selector:
dnsZones:
- "${SECRET_DOMAIN}"
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: "${SECRET_CLOUDFLARE_EMAIL}"
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- dns01:
cloudflare:
email: "${SECRET_CLOUDFLARE_EMAIL}"
apiKeySecretRef:
name: cert-manager-secret
key: api-key
selector:
dnsZones:
- "${SECRET_DOMAIN}"
kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./issuers.yaml
kubernetes/apps/cert-manager/cert-manager/ks.yaml
+41
View File
@@ -0,0 +1,41 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-cert-manager
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/cert-manager/cert-manager/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: cert-manager
namespace: cert-manager
interval: 30m
retryInterval: 1m
timeout: 3m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-cert-manager-issuers
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-cert-manager
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/cert-manager/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cert-manager/ks.yaml
kubernetes/apps/cert-manager/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/default/echo-server/app/helmrelease.yaml
+78
View File
@@ -0,0 +1,78 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: &app echo-server
namespace: default
spec:
interval: 15m
chart:
spec:
chart: app-template
version: 1.2.0
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
controller:
replicas: 3
strategy: RollingUpdate
image:
repository: docker.io/jmalloc/echo-server
tag: 0.3.3
service:
main:
ports:
http:
port: &port 8080
probes:
liveness: &probes
enabled: true
custom: true
spec:
httpGet:
path: /health
port: *port
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
readiness: *probes
startup:
enabled: false
ingress:
main:
enabled: true
ingressClassName: nginx
annotations:
external-dns.home.arpa/enabled: "true"
hajimari.io/icon: "video-input-antenna"
hosts:
- host: &host "{{ .Release.Name }}.devbu.io"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: *app
resources:
requests:
cpu: 5m
memory: 10Mi
limits:
memory: 50Mi
kubernetes/apps/default/echo-server/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./helmrelease.yaml
kubernetes/apps/default/echo-server/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-echo-server
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/default/echo-server/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: echo-server
namespace: default
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/default/hajimari/app/helmrelease.yaml
+62
View File
@@ -0,0 +1,62 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: hajimari
namespace: default
spec:
interval: 15m
chart:
spec:
chart: hajimari
version: 2.0.2
sourceRef:
kind: HelmRepository
name: hajimari
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
hajimari:
title: Apps
darkTheme: espresso
alwaysTargetBlank: true
showGreeting: false
showAppGroups: false
showAppStatus: false
showBookmarkGroups: false
showGlobalBookmarks: false
showAppUrls: false
defaultEnable: true
namespaceSelector:
matchNames:
- default
ingress:
main:
enabled: true
ingressClassName: nginx
annotations:
hajimari.io/enable: "false"
hosts:
- host: &host "${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
podAnnotations:
configmap.reloader.stakater.com/reload: "hajimari-settings"
persistence:
data:
enabled: true
type: emptyDir
resources:
requests:
cpu: 100m
memory: 128M
kubernetes/apps/default/hajimari/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./helmrelease.yaml
kubernetes/apps/default/hajimari/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-hajimari
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/default/hajimari/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: hajimari
namespace: default
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/default/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./echo-server/ks.yaml
- ./hajimari/ks.yaml
kubernetes/apps/default/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/flux-system/addons/ks.yaml
+18
View File
@@ -0,0 +1,18 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-flux-webhooks
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/flux-system/addons/webhooks
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
+27
View File
@@ -0,0 +1,27 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: webhook-receiver
namespace: flux-system
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-staging"
external-dns/is-public: "true"
external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
spec:
ingressClassName: nginx
rules:
- host: &host "flux-receiver.${SECRET_DOMAIN}"
http:
paths:
- path: /hook/
pathType: Prefix
backend:
service:
name: webhook-receiver
port:
number: 80
tls:
- hosts:
- *host
secretName: flux-receiver-tls
kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./ingress.yaml
- ./receiver.yaml
kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml
+26
View File
@@ -0,0 +1,26 @@
---
apiVersion: notification.toolkit.fluxcd.io/v1beta1
kind: Receiver
metadata:
name: github-receiver
namespace: flux-system
spec:
type: github
events:
- ping
- push
secretRef:
name: github-webhook-token-secret
resources:
- apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository
name: home-kubernetes
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
name: cluster
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
name: cluster-apps
namespace: flux-system
kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./github
kubernetes/apps/flux-system/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./addons/ks.yaml
- ./weave-gitops/ks.yaml
kubernetes/apps/flux-system/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
+54
View File
@@ -0,0 +1,54 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: weave-gitops
namespace: flux-system
spec:
interval: 15m
chart:
spec:
chart: weave-gitops
version: 4.0.9
sourceRef:
kind: HelmRepository
name: weave-gitops
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
adminUser:
create: true
username: admin
ingress:
enabled: true
className: nginx
annotations:
hajimari.io/icon: "sawtooth-wave"
hosts:
- host: &host "gitops.${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
networkPolicy:
create: false
metrics:
enabled: true
rbac:
create: true
impersonationResourceNames: ["admin"]
podAnnotations:
secret.reloader.stakater.com/reload: weave-gitops-secret
valuesFrom:
- kind: Secret
name: weave-gitops-secret
valuesKey: adminPassword
targetPath: adminUser.passwordHash
kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: flux-system
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/flux-system/weave-gitops/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-weave-gitops
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/flux-system/weave-gitops/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: weave-gitops
namespace: flux-system
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml
+72
View File
@@ -0,0 +1,72 @@
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: kube-vip
namespace: kube-system
labels:
app.kubernetes.io/instance: kube-vip
app.kubernetes.io/name: kube-vip
spec:
selector:
matchLabels:
app.kubernetes.io/instance: kube-vip
app.kubernetes.io/name: kube-vip
template:
metadata:
labels:
app.kubernetes.io/instance: kube-vip
app.kubernetes.io/name: kube-vip
spec:
containers:
- name: kube-vip
image: ghcr.io/kube-vip/kube-vip:v0.5.7
imagePullPolicy: IfNotPresent
args: ["manager"]
env:
- name: vip_arp
value: "true"
- name: port
value: "6443"
- name: vip_cidr
value: "32"
- name: cp_enable
value: "true"
- name: cp_namespace
value: kube-system
- name: svc_enable
value: "false"
- name: vip_leaderelection
value: "true"
- name: vip_leaseduration
value: "15"
- name: vip_renewdeadline
value: "10"
- name: vip_retryperiod
value: "2"
- name: address
value: "${KUBE_VIP_ADDR}"
securityContext:
capabilities:
add: ["NET_ADMIN", "NET_RAW"]
hostAliases:
- hostnames:
- kubernetes
ip: 127.0.0.1
hostNetwork: true
serviceAccountName: kube-vip
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/master
operator: Exists
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
tolerations:
- effect: NoSchedule
operator: Exists
- effect: NoExecute
operator: Exists
kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml
+10
View File
@@ -0,0 +1,10 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./rbac.yaml
- ./daemon-set.yaml
labels:
- pairs:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/kube-system/kube-vip/app/rbac.yaml
+44
View File
@@ -0,0 +1,44 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kube-vip
namespace: kube-system
secrets:
- name: kube-vip
---
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: kube-vip
namespace: kube-system
annotations:
kubernetes.io/service-account.name: kube-vip
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
name: system:kube-vip-role
rules:
- apiGroups: [""]
resources: ["services", "services/status", "nodes"]
verbs: ["list", "get", "watch", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["list", "get", "watch", "update", "create"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: system:kube-vip-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:kube-vip-role
subjects:
- kind: ServiceAccount
name: kube-vip
namespace: kube-system
kubernetes/apps/kube-system/kube-vip/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-kube-vip
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/kube-system/kube-vip/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: apps/v1
kind: DaemonSet
name: kube-vip
namespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/kube-system/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./kube-vip/ks.yaml
- ./metrics-server/ks.yaml
- ./reloader/ks.yaml
kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
+33
View File
@@ -0,0 +1,33 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: metrics-server
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: metrics-server
version: 3.8.3
sourceRef:
kind: HelmRepository
name: metrics-server
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
args:
- --kubelet-insecure-tls
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
metrics:
enabled: true
serviceMonitor:
enabled: true
kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/metrics-server/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-metrics-server
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/kube-system/metrics-server/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: metrics-server
namespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/kube-system/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/kube-system/reloader/app/helmrelease.yaml
+34
View File
@@ -0,0 +1,34 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: reloader
namespace: &namespace kube-system
spec:
interval: 15m
chart:
spec:
chart: reloader
version: v0.0.126
sourceRef:
kind: HelmRepository
name: stakater
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
fullnameOverride: reloader
reloader:
enableHA: true
deployment:
replicas: 3
reloadStrategy: annotations
reloadOnCreate: false
podMonitor:
enabled: true
namespace: *namespace
kubernetes/apps/kube-system/reloader/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/reloader/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-reloader
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/kube-system/reloader/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: reloader
namespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/networking/cloudflare-ddns/app/cloudflare-ddns.sh
Executable
+39
View File
@@ -0,0 +1,39 @@
#!/usr/bin/env bash
set -o nounset
set -o errexit
current_ipv4="$(curl -s https://ipv4.icanhazip.com/)"
zone_id=$(curl -s -X GET \
"https://api.cloudflare.com/client/v4/zones?name=${CLOUDFLARE_RECORD_NAME#*.}&status=active" \
-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
-H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
-H "Content-Type: application/json" \
| jq --raw-output ".result[0] | .id"
)
record_ipv4=$(curl -s -X GET \
"https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records?name=${CLOUDFLARE_RECORD_NAME}&type=A" \
-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
-H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
-H "Content-Type: application/json" \
)
old_ip4=$(echo "$record_ipv4" | jq --raw-output '.result[0] | .content')
if [[ "${current_ipv4}" == "${old_ip4}" ]]; then
printf "%s - IP Address '%s' has not changed" "$(date -u)" "${current_ipv4}"
exit 0
fi
record_ipv4_identifier="$(echo "$record_ipv4" | jq --raw-output '.result[0] | .id')"
update_ipv4=$(curl -s -X PUT \
"https://api.cloudflare.com/client/v4/zones/${zone_id}/dns_records/${record_ipv4_identifier}" \
-H "X-Auth-Email: ${CLOUDFLARE_EMAIL}" \
-H "X-Auth-Key: ${CLOUDFLARE_APIKEY}" \
-H "Content-Type: application/json" \
--data "{\"id\":\"${zone_id}\",\"type\":\"A\",\"proxied\":true,\"name\":\"${CLOUDFLARE_RECORD_NAME}\",\"content\":\"${current_ipv4}\"}" \
)
if [[ "$(echo "$update_ipv4" | jq --raw-output '.success')" == "true" ]]; then
printf "%s - Success - IP Address '%s' has been updated" "$(date -u)" "${current_ipv4}"
exit 0
else
printf "%s - Yikes - Updating IP Address '%s' has failed" "$(date -u)" "${current_ipv4}"
exit 1
fi
kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml
+49
View File
@@ -0,0 +1,49 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cloudflare-ddns
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: app-template
version: 1.2.0
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
controller:
type: cronjob
cronjob:
concurrencyPolicy: Forbid
schedule: "@hourly"
restartPolicy: OnFailure
image:
repository: ghcr.io/onedr0p/kubernetes-kubectl
tag: 1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d
command: ["/bin/bash", "/app/cloudflare-ddns.sh"]
envFrom:
- secretRef:
name: cloudflare-ddns-secret
service:
main:
enabled: false
persistence:
config:
enabled: true
type: configMap
name: cloudflare-ddns-configmap
subPath: cloudflare-ddns.sh
mountPath: /app/cloudflare-ddns.sh
defaultMode: 0775
readOnly: true
kubernetes/apps/networking/cloudflare-ddns/app/kustomization.yaml
+15
View File
@@ -0,0 +1,15 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
configMapGenerator:
- name: cloudflare-ddns-configmap
files:
- ./cloudflare-ddns.sh
generatorOptions:
disableNameSuffixHash: true
annotations:
kustomize.toolkit.fluxcd.io/substitute: disabled
kubernetes/apps/networking/cloudflare-ddns/ks.yaml
+21
View File
@@ -0,0 +1,21 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-cloudflare-ddns
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/networking/cloudflare-ddns/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: cloudflare-ddns
namespace: networking
interval: 30m
timeout: 5m
kubernetes/apps/networking/external-dns/app/helmrelease.yaml
+51
View File
@@ -0,0 +1,51 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: external-dns
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: external-dns
version: 1.12.0
sourceRef:
kind: HelmRepository
name: external-dns
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
interval: 2m
# logLevel: debug
provider: cloudflare
env:
- name: CF_API_EMAIL
valueFrom:
secretKeyRef:
name: external-dns-secret
key: email
- name: CF_API_KEY
valueFrom:
secretKeyRef:
name: external-dns-secret
key: api-key
extraArgs:
- --cloudflare-proxied
- --annotation-filter=external-dns.home.arpa/enabled in (true)
policy: sync
sources: ["ingress"]
txtPrefix: k8s.
txtOwnerId: default
domainFilters:
- "${SECRET_DOMAIN}"
serviceMonitor:
enabled: true
podAnnotations:
secret.reloader.stakater.com/reload: external-dns-secret
kubernetes/apps/networking/external-dns/app/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/networking/external-dns/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-external-dns
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/networking/external-dns/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: external-dns
namespace: networking
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/networking/ingress-nginx/app/cloudflare-networks.txt
+1
View File
@@ -0,0 +1 @@
173.245.48.0/20\,103.21.244.0/22\,103.22.200.0/22\,103.31.4.0/22\,141.101.64.0/18\,108.162.192.0/18\,190.93.240.0/20\,188.114.96.0/20\,197.234.240.0/22\,198.41.128.0/17\,162.158.0.0/15\,104.16.0.0/13\,104.24.0.0/14\,172.64.0.0/13\,131.0.72.0/22\,2400:cb00::/32\,2606:4700::/32\,2803:f800::/32\,2405:b500::/32\,2405:8100::/32\,2a06:98c0::/29\,2c0f:f248::/32
kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
+84
View File
@@ -0,0 +1,84 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: ingress-nginx
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: ingress-nginx
version: 4.4.0
sourceRef:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
interval: 15m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
dependsOn:
- name: cert-manager
namespace: cert-manager
values:
controller:
replicaCount: 2
extraEnvs:
- name: TZ
value: "${TIMEZONE}"
service:
annotations:
metallb.universe.tf/loadBalancerIPs: |-
${METALLB_INGRESS_ADDR}
externalTrafficPolicy: Local
publishService:
enabled: true
ingressClassResource:
default: true
config:
client-header-timeout: 120
client-body-buffer-size: "100M"
client-body-timeout: 120
custom-http-errors: |-
401,403,404,500,501,502,503
enable-brotli: "true"
forwarded-for-header: "CF-Connecting-IP"
hsts-max-age: "31449600"
keep-alive: 120
keep-alive-requests: 10000
proxy-body-size: "100M"
ssl-protocols: "TLSv1.3 TLSv1.2"
use-forwarded-headers: "true"
metrics:
enabled: false
podAnnotations:
configmap.reloader.stakater.com/reload: "cloudflare-networks"
resources:
requests:
cpu: 10m
memory: 250Mi
limits:
memory: 500Mi
defaultBackend:
enabled: true
image:
repository: ghcr.io/tarampampam/error-pages
tag: 2.19.0
replicaCount: 1
extraEnvs:
- name: TEMPLATE_NAME
value: lost-in-space
- name: SHOW_DETAILS
value: "false"
valuesFrom:
# Cloudflare Networks
# https://www.cloudflare.com/ips/
- targetPath: controller.config.proxy-real-ip-cidr
kind: ConfigMap
name: cloudflare-networks
valuesKey: cloudflare-networks.txt
kubernetes/apps/networking/ingress-nginx/app/kustomization.yaml
+12
View File
@@ -0,0 +1,12 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./helmrelease.yaml
configMapGenerator:
- name: cloudflare-networks
files:
- ./cloudflare-networks.txt
generatorOptions:
disableNameSuffixHash: true
kubernetes/apps/networking/ingress-nginx/ks.yaml
+27
View File
@@ -0,0 +1,27 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-ingress-nginx
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-cert-manager
- name: cluster-apps-cert-manager-issuers
- name: cluster-apps-metallb
- name: cluster-apps-metallb-config
path: ./kubernetes/apps/networking/ingress-nginx/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: ingress-nginx
namespace: networking
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml
+36
View File
@@ -0,0 +1,36 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: k8s-gateway
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: k8s-gateway
version: 2.0.0
sourceRef:
kind: HelmRepository
name: k8s-gateway
namespace: flux-system
interval: 15m
install:
createNamespace: true
remediation:
retries: 5
upgrade:
remediation:
retries: 5
dependsOn:
- name: metallb
values:
fullnameOverride: k8s-gateway
domain: "${SECRET_DOMAIN}"
ttl: 1
service:
type: LoadBalancer
port: 53
annotations:
metallb.universe.tf/loadBalancerIPs: "${METALLB_K8S_GATEWAY_ADDR}"
externalTrafficPolicy: Local
kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./helmrelease.yaml
kubernetes/apps/networking/k8s-gateway/ks.yaml
+25
View File
@@ -0,0 +1,25 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-k8s-gateway
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-metallb
- name: cluster-apps-metallb-config
path: ./kubernetes/apps/networking/k8s-gateway/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: k8s-gateway
namespace: networking
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/networking/kustomization.yaml
+10
View File
@@ -0,0 +1,10 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cloudflare-ddns/ks.yaml
- ./external-dns/ks.yaml
- ./ingress-nginx/ks.yaml
- ./k8s-gateway/ks.yaml
- ./metallb/ks.yaml
kubernetes/apps/networking/metallb/app/helmrelease.yaml
+28
View File
@@ -0,0 +1,28 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: metallb
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: metallb
version: 0.13.7
sourceRef:
kind: HelmRepository
name: metallb
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
crds:
enabled: true
psp:
create: false
kubernetes/apps/networking/metallb/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./helmrelease.yaml
kubernetes/apps/networking/metallb/config/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- resources.yaml
kubernetes/apps/networking/metallb/config/resources.yaml
+18
View File
@@ -0,0 +1,18 @@
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
name: l2-ip
namespace: networking
spec:
ipAddressPools:
- default-pool
---
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
name: default-pool
namespace: networking
spec:
addresses:
- "${METALLB_LB_RANGE}"
kubernetes/apps/networking/metallb/ks.yaml
+42
View File
@@ -0,0 +1,42 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-metallb
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/networking/metallb/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: metallb
namespace: networking
interval: 30m
retryInterval: 1m
timeout: 3m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-metallb-config
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-metallb
path: ./kubernetes/apps/networking/metallb/config
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/networking/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: networking
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/system-upgrade/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
# - ./system-upgrade-controller/ks.yaml
kubernetes/apps/system-upgrade/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml
+20
View File
@@ -0,0 +1,20 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
# renovate: datasource=docker image=rancher/system-upgrade-controller
- https://github.com/rancher/system-upgrade-controller/releases/download/v0.10.0/crd.yaml
- https://github.com/rancher/system-upgrade-controller?ref=v0.10.0
images:
- name: rancher/system-upgrade-controller
newTag: v0.10.0
commonLabels:
app.kubernetes.io/name: system-upgrade-controller
app.kubernetes.io/instance: system-upgrade-controller
patchesStrategicMerge:
- |
$patch: delete
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml
+38
View File
@@ -0,0 +1,38 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-system-upgrade-controller
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 3m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-system-upgrade-controller-plans
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-system-upgrade-controller
path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml
+19
View File
@@ -0,0 +1,19 @@
---
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: agent
namespace: system-upgrade
spec:
# renovate: datasource=github-releases depName=k3s-io/k3s
version: "v1.24.8+k3s1"
serviceAccountName: system-upgrade
concurrency: 1
nodeSelector:
matchExpressions:
- {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist}
prepare:
image: rancher/k3s-upgrade
args: ["prepare", "server"]
upgrade:
image: rancher/k3s-upgrade
kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./server.yaml
- ./agent.yaml
kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml
+17
View File
@@ -0,0 +1,17 @@
---
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: server
namespace: system-upgrade
spec:
# renovate: datasource=github-releases depName=k3s-io/k3s
version: "v1.24.8+k3s1"
serviceAccountName: system-upgrade
concurrency: 1
cordon: true
nodeSelector:
matchExpressions:
- {key: node-role.kubernetes.io/control-plane, operator: Exists}
upgrade:
image: rancher/k3s-upgrade
kubernetes/bootstrap/kustomization.yaml
+39
View File
@@ -0,0 +1,39 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- github.com/fluxcd/flux2/manifests/install?ref=v0.38.1
images:
- name: fluxcd/helm-controller
newName: ghcr.io/fluxcd/helm-controller
- name: fluxcd/image-automation-controller
newName: ghcr.io/fluxcd/image-automation-controller
- name: fluxcd/image-reflector-controller
newName: ghcr.io/fluxcd/image-reflector-controller
- name: fluxcd/kustomize-controller
newName: ghcr.io/fluxcd/kustomize-controller
- name: fluxcd/notification-controller
newName: ghcr.io/fluxcd/notification-controller
- name: fluxcd/source-controller
newName: ghcr.io/fluxcd/source-controller
patches:
- patch: |-
$patch: delete
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: not-used
target:
group: networking.k8s.io
version: v1
kind: NetworkPolicy
- patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --concurrent=20
- op: add
path: /spec/template/spec/containers/0/args/-
value: --requeue-dependency=5s
target:
kind: Deployment
name: "(kustomize-controller|helm-controller|source-controller)"
kubernetes/flux/apps.yaml
+23
View File
@@ -0,0 +1,23 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps
namespace: flux-system
spec:
interval: 30m
path: ./kubernetes/apps
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets
kubernetes/flux/config/flux.yaml
+59
View File
@@ -0,0 +1,59 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: OCIRepository
metadata:
name: flux-manifests
namespace: flux-system
spec:
interval: 10m
url: oci://ghcr.io/fluxcd/flux-manifests
ref:
tag: v0.38.1
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: flux
namespace: flux-system
spec:
interval: 10m
path: ./
prune: true
wait: true
sourceRef:
kind: OCIRepository
name: flux-manifests
images:
- name: fluxcd/helm-controller
newName: ghcr.io/fluxcd/helm-controller
- name: fluxcd/image-automation-controller
newName: ghcr.io/fluxcd/image-automation-controller
- name: fluxcd/image-reflector-controller
newName: ghcr.io/fluxcd/image-reflector-controller
- name: fluxcd/kustomize-controller
newName: ghcr.io/fluxcd/kustomize-controller
- name: fluxcd/notification-controller
newName: ghcr.io/fluxcd/notification-controller
- name: fluxcd/source-controller
newName: ghcr.io/fluxcd/source-controller
patches:
- patch: |
$patch: delete
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: not-used
target:
group: networking.k8s.io
version: v1
kind: NetworkPolicy
- patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --concurrent=20
- op: add
path: /spec/template/spec/containers/0/args/-
value: --requeue-dependency=5s
target:
kind: Deployment
name: "(kustomize-controller|helm-controller|source-controller)"
kubernetes/flux/config/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./flux.yaml
- ./cluster.yaml
kubernetes/flux/repositories/git/.gitkeep
View File
Whitespace-only changes.
kubernetes/flux/repositories/helm/bitnami.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: bitnami
namespace: flux-system
spec:
interval: 1h
url: https://charts.bitnami.com/bitnami
kubernetes/flux/repositories/helm/bjw-s.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: bjw-s
namespace: flux-system
spec:
interval: 1h
url: https://bjw-s.github.io/helm-charts/
kubernetes/flux/repositories/helm/external-dns.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: external-dns
namespace: flux-system
spec:
interval: 1h
url: https://kubernetes-sigs.github.io/external-dns
kubernetes/flux/repositories/helm/hajimari.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: hajimari
namespace: flux-system
spec:
interval: 1h
url: https://hajimari.io
kubernetes/flux/repositories/helm/ingress-nginx.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: ingress-nginx
namespace: flux-system
spec:
interval: 1h
url: https://kubernetes.github.io/ingress-nginx
kubernetes/flux/repositories/helm/jetstack.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: jetstack
namespace: flux-system
spec:
interval: 1h
url: https://charts.jetstack.io/
kubernetes/flux/repositories/helm/k8s-gateway.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: k8s-gateway
namespace: flux-system
spec:
interval: 1h
url: https://ori-edge.github.io/k8s_gateway/
kubernetes/flux/repositories/helm/kustomization.yaml
+15
View File
@@ -0,0 +1,15 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./bitnami.yaml
- ./bjw-s.yaml
- ./external-dns.yaml
- ./hajimari.yaml
- ./ingress-nginx.yaml
- ./jetstack.yaml
- ./k8s-gateway.yaml
- ./metallb.yaml
- ./metrics-server.yaml
- ./stakater.yaml
- ./weave-gitops.yaml
kubernetes/flux/repositories/helm/metallb.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: metallb
namespace: flux-system
spec:
interval: 1h
url: https://metallb.github.io/metallb
kubernetes/flux/repositories/helm/metrics-server.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: metrics-server
namespace: flux-system
spec:
interval: 1h
url: https://kubernetes-sigs.github.io/metrics-server
kubernetes/flux/repositories/helm/stakater.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: stakater
namespace: flux-system
spec:
interval: 1h
url: https://stakater.github.io/stakater-charts
kubernetes/flux/repositories/helm/weave-gitops.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: weave-gitops
namespace: flux-system
spec:
interval: 1h
url: https://helm.gitops.weave.works
kubernetes/flux/repositories/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
# - ./git
- ./helm
# - ./oci
kubernetes/flux/repositories/oci/.gitkeep
View File
Whitespace-only changes.
kubernetes/flux/vars/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./cluster-settings.yaml
- ./cluster-secrets.sops.yaml