feat!: Refector directories and flux apps (#559)

2022-12-21 14:22:18 -05:00
1 parent a43e2325f1
commit 4e6edcc66a
@@ -1,12 +1,15 @@
 ---
 creation_rules:
-  - path_regex: provision/.*\.sops\.ya?ml
-    unencrypted_regex: "^(kind)$"
-    key_groups:
-      - age:
-          - ${BOOTSTRAP_AGE_PUBLIC_KEY}
-  - path_regex: cluster/.*\.sops\.ya?ml
+  - path_regex: kubernetes/.*\.sops\.ya?ml
    encrypted_regex: "^(data|stringData)$"
    key_groups:
      - age:
          - ${BOOTSTRAP_AGE_PUBLIC_KEY}
+  - path_regex: ansible/.*\.sops\.ya?ml
+    key_groups:
+      - age:
+          - ${BOOTSTRAP_AGE_PUBLIC_KEY}
+  - path_regex: terraform/.*\.sops\.ya?ml
+    key_groups:
+      - age:
+          - ${BOOTSTRAP_AGE_PUBLIC_KEY}
@@ -1,8 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-api-key
-  namespace: kube-system
-stringData:
-    api-key: ${BOOTSTRAP_CLOUDFLARE_APIKEY}
@@ -1,11 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-ddns
-  namespace: kube-system
-type: Opaque
-stringData:
-    CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
-    CLOUDFLARE_APIKEY: ${BOOTSTRAP_CLOUDFLARE_APIKEY}
-    CLOUDFLARE_RECORD_NAME: ipv4.${BOOTSTRAP_CLOUDFLARE_DOMAIN}
@@ -1,9 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cluster-secrets
-  namespace: flux-system
-stringData:
-  SECRET_DOMAIN: ${BOOTSTRAP_CLOUDFLARE_DOMAIN}
-  SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
@@ -1,11 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cluster-settings
-  namespace: flux-system
-data:
-  TIMEZONE: ${BOOTSTRAP_TIMEZONE}
-  METALLB_LB_RANGE: ${BOOTSTRAP_METALLB_LB_RANGE}
-  METALLB_K8S_GATEWAY_ADDR: ${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}
-  METALLB_INGRESS_ADDR: ${BOOTSTRAP_METALLB_INGRESS_ADDR}
@@ -1,9 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-  name: external-dns-cloud-credentials
-  namespace: kube-system
-stringData:
-    email: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
-    api-key: ${BOOTSTRAP_CLOUDFLARE_APIKEY}
@@ -1,5 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./webhooks
@@ -1,27 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: webhook-receiver
-  namespace: flux-system
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-staging"
-    external-dns/is-public: "true"
-    external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: "flux-receiver.${SECRET_DOMAIN}"
-      http:
-        paths:
-          - path: /hook/
-            pathType: Prefix
-            backend:
-              service:
-                name: webhook-receiver
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - "flux-receiver.${SECRET_DOMAIN}"
-      secretName: flux-receiver-tls
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./ingress.yaml
-  - ./receiver.yaml
-  - ./secret.sops.yaml
@@ -1,34 +0,0 @@
---
-apiVersion: notification.toolkit.fluxcd.io/v1beta1
-kind: Receiver
-metadata:
-  name: github-receiver
-  namespace: flux-system
-spec:
-  type: github
-  events:
-    - ping
-    - push
-  secretRef:
-    name: github-webhook-secret
-  resources:
-    - apiVersion: source.toolkit.fluxcd.io/v1beta2
-      kind: GitRepository
-      name: flux-cluster
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-      kind: Kustomization
-      name: apps
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-      kind: Kustomization
-      name: charts
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-      kind: Kustomization
-      name: config
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-      kind: Kustomization
-      name: flux-cluster
-      namespace: flux-system
@@ -1,5 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./github
@@ -1,75 +0,0 @@
---
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: kube-vip
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/instance: kube-vip
-    app.kubernetes.io/name: kube-vip
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: kube-vip
-      app.kubernetes.io/name: kube-vip
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: kube-vip
-        app.kubernetes.io/name: kube-vip
-    spec:
-      containers:
-        - name: kube-vip
-          image: ghcr.io/kube-vip/kube-vip:v0.5.7
-          imagePullPolicy: IfNotPresent
-          args:
-            - manager
-          env:
-            - name: vip_arp
-              value: "true"
-            - name: port
-              value: "6443"
-            - name: vip_cidr
-              value: "32"
-            - name: cp_enable
-              value: "true"
-            - name: cp_namespace
-              value: kube-system
-            - name: svc_enable
-              value: "false"
-            - name: vip_leaderelection
-              value: "true"
-            - name: vip_leaseduration
-              value: "15"
-            - name: vip_renewdeadline
-              value: "10"
-            - name: vip_retryperiod
-              value: "2"
-            - name: address
-              value: "${BOOTSTRAP_KUBE_VIP_ADDR}"
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-                - NET_RAW
-      hostAliases:
-        - hostnames:
-            - kubernetes
-          ip: 127.0.0.1
-      hostNetwork: true
-      serviceAccountName: kube-vip
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/master
-                    operator: Exists
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: Exists
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cert-manager-secret
+  namespace: cert-manager
+stringData:
+  api-key: "${BOOTSTRAP_CLOUDFLARE_APIKEY}"
@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-ddns-secret
+  namespace: networking
+type: Opaque
+stringData:
+  CLOUDFLARE_EMAIL: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
+  CLOUDFLARE_APIKEY: "${BOOTSTRAP_CLOUDFLARE_APIKEY}"
+  CLOUDFLARE_RECORD_NAME: "ipv4.${BOOTSTRAP_CLOUDFLARE_DOMAIN}"
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cluster-secrets
+  namespace: flux-system
+stringData:
+  SECRET_DOMAIN: "${BOOTSTRAP_CLOUDFLARE_DOMAIN}"
+  SECRET_CLOUDFLARE_EMAIL: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: external-dns-secret
+  namespace: networking
+stringData:
+  email: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
+  api-key: "${BOOTSTRAP_CLOUDFLARE_APIKEY}"
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-settings
+  namespace: flux-system
+data:
+  TIMEZONE: "${BOOTSTRAP_TIMEZONE}"
+  KUBE_VIP_ADDR: "${BOOTSTRAP_KUBE_VIP_ADDR}"
+  METALLB_LB_RANGE: "${BOOTSTRAP_METALLB_LB_RANGE}"
+  METALLB_K8S_GATEWAY_ADDR: "${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}"
+  METALLB_INGRESS_ADDR: "${BOOTSTRAP_METALLB_INGRESS_ADDR}"
@@ -2,27 +2,32 @@
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: GitRepository
 metadata:
-  name: flux-cluster
+  name: home-kubernetes
  namespace: flux-system
 spec:
  interval: 30m
  ref:
    branch: main
-  url: ${BOOTSTRAP_GIT_REPOSITORY}
+  url: "${BOOTSTRAP_GIT_REPOSITORY}"
+  ignore: |
+    # exclude all
+    /*
+    # include kubernetes directory
+    !/kubernetes
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
-  name: flux-cluster
+  name: cluster
  namespace: flux-system
 spec:
  interval: 30m
-  path: ./cluster/flux
+  path: ./kubernetes/flux
  prune: true
  wait: false
  sourceRef:
    kind: GitRepository
-    name: flux-cluster
+    name: home-kubernetes
  decryption:
    provider: sops
    secretRef:
@@ -1,8 +1,8 @@
-# yamllint disable
+---
 apiVersion: v1
 kind: Secret
 metadata:
-  name: github-webhook-secret
+  name: github-webhook-token-secret
  namespace: flux-system
 stringData:
  token: ${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: weave-gitops-secret
+  namespace: flux-system
+type: Opaque
+stringData:
+  adminPassword: "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}"
@@ -1,4 +1,3 @@
-kind: Secret
-cloudflare_email: ${BOOTSTRAP_CLOUDFLARE_EMAIL}
-cloudflare_apikey: ${BOOTSTRAP_CLOUDFLARE_APIKEY}
-cloudflare_domain: ${BOOTSTRAP_CLOUDFLARE_DOMAIN}
+cloudflare_email: "${BOOTSTRAP_CLOUDFLARE_EMAIL}"
+cloudflare_apikey: "${BOOTSTRAP_CLOUDFLARE_APIKEY}"
+cloudflare_domain: "${BOOTSTRAP_CLOUDFLARE_DOMAIN}"