infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat!: Refector directories and flux apps (#559)

Browse Source
This commit is contained in:
Devin Buhl authored and GitHub committed 2022-12-21 14:22:18 -05:00
1 parent a43e2325f1
commit 4e6edcc66a
163 files changed
+1194 -1060
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.config.sample.env
+8 -6
View File
@@ -6,11 +6,15 @@
# e.g. https://github.com/onedr0p/home-cluster # e.g. https://github.com/onedr0p/home-cluster
export BOOTSTRAP_GIT_REPOSITORY="" export BOOTSTRAP_GIT_REPOSITORY=""
# Optional: Enable GitHub to send a webhook to update Flux, set the following to one of: # To enable Flux to update your cluster on `git push` set the following to one of:
# ignored - this feature will be disabled # `generated` - this will generate a token and print it in the logs
# generated - this will generate a token and print it in the logs
# Set this to any other string and it will be used for the secret # Set this to any other string and it will be used for the secret
export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="ignored" export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="generated"
# The Weave GitOps dashboard admin password
# `generated` - this will generate a token and print it in the logs
# Set this to any other string and it will be used for the secret
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="generated"
# Choose one of your cloudflare domains # Choose one of your cloudflare domains
# e.g. onedr0p.com # e.g. onedr0p.com
@@ -44,8 +48,6 @@ export BOOTSTRAP_AGE_PUBLIC_KEY=""
export BOOTSTRAP_KUBE_VIP_ADDR="" export BOOTSTRAP_KUBE_VIP_ADDR=""
# Choose your timezone # Choose your timezone
# Used to set your systems timezone
# and Kured timezone
# e.g. America/New_York # e.g. America/New_York
export BOOTSTRAP_TIMEZONE="Etc/UTC" export BOOTSTRAP_TIMEZONE="Etc/UTC"
.editorconfig
-3
View File
@@ -16,6 +16,3 @@ indent_size = 4
[*.{bash,sh}] [*.{bash,sh}]
indent_style = space indent_style = space
indent_size = 4 indent_size = 4
[*.{yaml,yml}]
indent_size = 2
.envrc
+1 -1
View File
@@ -1,5 +1,5 @@
#shellcheck disable=SC2148,SC2155 #shellcheck disable=SC2148,SC2155
export KUBECONFIG=$(expand_path ./provision/kubeconfig) export KUBECONFIG=$(expand_path ./kubeconfig)
export ANSIBLE_CONFIG=$(expand_path ./ansible.cfg) export ANSIBLE_CONFIG=$(expand_path ./ansible.cfg)
export ANSIBLE_HOST_KEY_CHECKING="False" export ANSIBLE_HOST_KEY_CHECKING="False"
export SOPS_AGE_KEY_FILE=$(expand_path ~/.config/sops/age/keys.txt) export SOPS_AGE_KEY_FILE=$(expand_path ~/.config/sops/age/keys.txt)
.gitattributes
+2
View File
@@ -1 +1,3 @@
* text=auto eol=lf
*.sops.* diff=sopsdiffer *.sops.* diff=sopsdiffer
*.sops.toml linguist-language=JSON
.github/CODEOWNERS
-2
View File
@@ -1,2 +0,0 @@
# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
* @onedr0p
.github/ISSUE_TEMPLATE/bug-report.md
-12
View File
@@ -1,12 +0,0 @@
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: kind/bug
assignees: ''
---
# Details
<!-- Note: This should be a clear and concise description of what the bug is. -->
.github/ISSUE_TEMPLATE/config.yml
-6
View File
@@ -1,6 +0,0 @@
---
blank_issues_enabled: false
contact_links:
- name: Discuss on Discord
url: https://discord.gg/k8s-at-home
about: Join our Discord community
.github/ISSUE_TEMPLATE/feature-request.md
-12
View File
@@ -1,12 +0,0 @@
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: kind/enhancement
assignees: ''
---
# Details
<!-- Note: A clear and concise description of what you want to happen. -->
.github/ISSUE_TEMPLATE/question.md
-12
View File
@@ -1,12 +0,0 @@
---
name: Question
about: Ask a question to the maintainer
title: ''
labels: kind/question
assignees: ''
---
# Details
<!-- Note: A clear and concise query of what you want to ask. -->
.github/PULL_REQUEST_TEMPLATE.md
-20
View File
@@ -1,20 +0,0 @@
**Description of the change**
<!-- Describe the scope of your change - i.e. what the change does. -->
**Benefits**
<!-- What benefits will be realized by the code change? -->
**Possible drawbacks**
<!-- Describe any known limitations with your change -->
**Applicable issues**
<!-- Enter any applicable Issues here (You can reference an issue using #) -->
- fixes #
**Additional information**
<!-- If there's anything else that's important and relevant to your pull request, mention that information here.-->
.github/linters/.ansible-lint
-3
View File
@@ -1,3 +0,0 @@
# .ansible-lint
warn_list:
- unnamed-task
.github/linters/.markdownlint.yaml
-23
View File
@@ -1,23 +0,0 @@
---
default: true
# MD013/line-length - Line length
MD013:
# Number of characters
line_length: 240
# Number of characters for headings
heading_line_length: 80
# Number of characters for code blocks
code_block_line_length: 80
# Include code blocks
code_blocks: true
# Include tables
tables: true
# Include headings
headings: true
# Include headings
headers: true
# Strict length checking
strict: false
# Stern length checking
stern: false
.github/linters/.prettierignore
-2
View File
@@ -1,2 +0,0 @@
*.sops.*
gotk-components.yaml
.github/linters/.prettierrc.yaml
-5
View File
@@ -1,5 +0,0 @@
---
trailingComma: "es5"
tabWidth: 2
semi: false
singleQuote: false
.github/linters/.tflint.hcl
View File
Whitespace-only changes.
.github/renovate.json5
+5 -33
View File
@@ -10,34 +10,20 @@
"enabled": true "enabled": true
}, },
"flux": { "flux": {
"fileMatch": ["cluster/.+\\.ya?ml$"] "fileMatch": ["kubernetes/.+\\.ya?ml$"]
}, },
"helm-values": { "helm-values": {
"fileMatch": ["cluster/.+\\.ya?ml$"] "fileMatch": ["kubernetes/.+\\.ya?ml$"]
}, },
"kubernetes": { "kubernetes": {
"fileMatch": [ "fileMatch": ["kubernetes/.+\\.ya?ml$"]
"cluster/.+\\.ya?ml$",
"provision/ansible/.+\\.ya?ml.j2$"
]
}, },
"regexManagers": [ "regexManagers": [
{
"description": "Process CRD dependencies",
"fileMatch": ["cluster/crds/.+\\.ya?ml$"],
"matchStrings": [
// GitRepository and Flux Kustomization where 'Git release/tag' matches 'Helm' version
"registryUrl=(?<registryUrl>\\S+) chart=(?<depName>\\S+)\n.*?(?<currentValue>[^-\\s]*)\n",
// Kustomization where 'GitHub release artifact URL' matches 'Docker image' version
"datasource=(?<datasource>\\S+) image=(?<depName>\\S+)\n.*?-\\s(.*?)\/(?<currentValue>[^/]+)\/[^/]+\n"
],
"datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}helm{{/if}}"
},
{ {
"description": "Process various other dependencies", "description": "Process various other dependencies",
"fileMatch": [ "fileMatch": [
"provision/ansible/.+\\.ya?ml$", "ansible/.+\\.ya?ml$",
"cluster/.+\\.ya?ml$" "kubernetes/.+\\.ya?ml$"
], ],
"matchStrings": [ "matchStrings": [
"datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?\n.*?\"(?<currentValue>.*)\"\n" "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?\n.*?\"(?<currentValue>.*)\"\n"
@@ -47,12 +33,6 @@
} }
], ],
"packageRules": [ "packageRules": [
{
"description": "Disable kubernetes-api",
"matchManagers": ["kubernetes"],
"matchDatasources": ["kubernetes-api"],
"enabled": false
},
// setup datasources // setup datasources
{ {
"matchDatasources": ["helm"], "matchDatasources": ["helm"],
@@ -67,14 +47,6 @@
"commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}", "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}",
"matchUpdateTypes": ["major", "minor", "patch"] "matchUpdateTypes": ["major", "minor", "patch"]
}, },
{
"description": "Group Cert-Manager image (for CRDs) and chart",
"groupName": "Cert-Manager",
"matchPackagePatterns": ["cert-manager"],
"matchDatasources": ["docker", "helm"],
"group": { "commitMessageTopic": "{{{groupName}}} group" },
"separateMinorPatch": true
},
// add labels according to package and update types // add labels according to package and update types
{ {
"matchDatasources": ["docker"], "matchDatasources": ["docker"],
.github/workflows/lint.yaml
-61
View File
@@ -1,61 +0,0 @@
---
name: Lint
on: # yamllint disable-line rule:truthy
workflow_dispatch:
pull_request:
branches:
- main
concurrency:
group: ${{ github.ref }}-${{ github.workflow }}
cancel-in-progress: true
env:
# Currently no way to detect automatically
DEFAULT_BRANCH: main
jobs:
build:
name: MegaLinter
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: MegaLinter
uses: oxsecurity/megalinter@v6.15.0
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'workflow_dispatch' }}
ENABLE_LINTERS: |-
${{
join(
fromJSON('
[
"ACTION_ACTIONLINT",
"ANSIBLE_ANSIBLE_LINT",
"COPYPASTE_JSCPD",
"KUBERNETES_KUBEVAL",
"MARKDOWN_MARKDOWNLINT",
"REPOSITORY_GIT_DIFF",
"REPOSITORY_SECRETLINT",
"TERRAFORM_TERRAFORM_FMT",
"YAML_PRETTIER",
"YAML_YAMLLINT"
]
'),
','
)
}}
ANSIBLE_DIRECTORY: provision/ansible
ANSIBLE_ANSIBLE_LINT_CONFIG_FILE: .github/linters/.ansible-lint
KUBERNETES_DIRECTORY: cluster
KUBERNETES_KUBEVAL_ARGUMENTS: --ignore-missing-schemas
MARKDOWN_MARKDOWNLINT_CONFIG_FILE: .github/linters/.markdownlint.yaml
MARKDOWN_MARKDOWNLINT_RULES_PATH: .github/
YAML_YAMLLINT_CONFIG_FILE: .github/linters/.yamllint.yaml
YAML_PRETTIER_CONFIG_FILE: .github/linters/.prettierrc.yaml
YAML_PRETTIER_FILTER_REGEX_EXCLUDE: "(.*\\.sops\\.ya?ml)"
.gitignore
-2
View File
@@ -9,11 +9,9 @@ kubeconfig
*.agekey *.agekey
*.pub *.pub
*.key *.key
github-deploy-key*
# Ansible # Ansible
xanmanning.k3s* xanmanning.k3s*
# Terraform # Terraform
.terraform .terraform
.terraform.tfstate* .terraform.tfstate*
terraform.tfstate* terraform.tfstate*
megalinter-reports
.pre-commit-config.yaml
+1 -29
View File
@@ -6,37 +6,9 @@ repos:
hooks: hooks:
- args: - args:
- --config-file - --config-file
- .github/linters/.yamllint.yaml - .yamllint.yaml
id: yamllint id: yamllint
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.4.0
hooks:
- id: check-merge-conflict
- id: end-of-file-fixer
- id: mixed-line-ending
- id: trailing-whitespace
args: [--markdown-linebreak-ext=md]
- repo: https://github.com/Lucas-C/pre-commit-hooks
rev: v1.3.1
hooks:
- id: remove-crlf
- id: remove-tabs
- repo: https://github.com/sirosen/texthooks
rev: 0.4.0
hooks:
- id: fix-smartquotes
- repo: https://github.com/onedr0p/sops-pre-commit
rev: v2.1.1
hooks:
- id: forbid-secrets
exclude: |
(?x)^(
cluster\/apps\/kube-system\/kube-vip\/rbac.yaml|
tmpl\/.*.sops\.ya?ml
)$
- repo: https://github.com/gruntwork-io/pre-commit - repo: https://github.com/gruntwork-io/pre-commit
rev: v0.1.17 rev: v0.1.17
hooks: hooks:
- id: terraform-fmt - id: terraform-fmt
- id: terraform-validate
- id: tflint
.secretlintignore
-3
View File
@@ -1,3 +0,0 @@
megalinter-reports
tmpl
README.md
.sourceignore
-17
View File
@@ -1,17 +0,0 @@
# See https://toolkit.fluxcd.io/components/source/gitrepositories/#excluding-files
.github/
.taskfiles/
.vscode/
provision/
tmpl/
.config.sample.env
.envrc
.gitattributes
.gitignore
.pre-commit-config.yaml
.sops.yaml
ansible.cfg
configure
LICENSE
README.md
Taskfile.yml
.taskfiles/AnsibleTasks.yml
+9 -9
View File
@@ -12,32 +12,32 @@ tasks:
init: init:
desc: Install / Upgrade Ansible galaxy deps desc: Install / Upgrade Ansible galaxy deps
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible-galaxy install -r requirements.yml --roles-path ~/.ansible/roles --force - ansible-galaxy install -r requirements.yml --roles-path ~/.ansible/roles --force
- ansible-galaxy collection install -r requirements.yml --collections-path ~/.ansible/collections --force - ansible-galaxy collection install -r requirements.yml --collections-path ~/.ansible/collections --force
list: list:
desc: List all the hosts desc: List all the hosts
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --list-hosts - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --list-hosts
prepare: prepare:
desc: Prepare all the k8s nodes for running k3s desc: Prepare all the k8s nodes for running k3s
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-prepare.yml - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-prepare.yml
install: install:
desc: Install Kubernetes on the nodes desc: Install Kubernetes on the nodes
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-installation.yml - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-installation.yml
nuke: nuke:
desc: Uninstall Kubernetes on the nodes desc: Uninstall Kubernetes on the nodes
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
interactive: true interactive: true
cmds: cmds:
- ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-nuke.yml - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-nuke.yml
@@ -45,24 +45,24 @@ tasks:
ping: ping:
desc: Ping all the hosts desc: Ping all the hosts
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -m 'ping' - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -m 'ping'
uptime: uptime:
desc: Uptime of all the hosts desc: Uptime of all the hosts
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -a 'uptime' - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -a 'uptime'
reboot: reboot:
desc: Reboot all the k8s nodes desc: Reboot all the k8s nodes
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-reboot.yml - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-reboot.yml
poweroff: poweroff:
desc: Shutdown all the k8s nodes desc: Shutdown all the k8s nodes
dir: provision/ansible dir: "{{.ANSIBLE_DIR}}"
cmds: cmds:
- ansible kubernetes -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml -a '/usr/bin/systemctl poweroff' --become - ansible kubernetes -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml -a '/usr/bin/systemctl poweroff' --become
.taskfiles/ClusterTasks.yml
+6 -6
View File
@@ -11,11 +11,11 @@ tasks:
install: install:
desc: Install Flux into your cluster desc: Install Flux into your cluster
cmds: cmds:
- kubectl apply --kustomize {{.CLUSTER_DIR}}/bootstrap/ - kubectl apply --kustomize {{.KUBERNETES_DIR}}/bootstrap
- cat {{.SOPS_AGE_KEY_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin - cat {{.SOPS_AGE_KEY_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin
- sops --decrypt {{.CLUSTER_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f - - sops --decrypt {{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f -
- kubectl apply -f {{.CLUSTER_DIR}}/flux/vars/cluster-settings.yaml - kubectl apply -f {{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml
- kubectl apply --kustomize {{.CLUSTER_DIR}}/flux/config - kubectl apply --kustomize {{.KUBERNETES_DIR}}/flux/config
- task: reconcile - task: reconcile
preconditions: preconditions:
- sh: test -f {{.SOPS_AGE_KEY_FILE}} - sh: test -f {{.SOPS_AGE_KEY_FILE}}
@@ -27,8 +27,8 @@ tasks:
reconcile: reconcile:
desc: Force update Flux to pull in changes from your Git repository desc: Force update Flux to pull in changes from your Git repository
cmds: cmds:
- flux reconcile -n flux-system source git flux-cluster - flux reconcile -n flux-system source git home-kubernetes
- flux reconcile -n flux-system kustomization flux-cluster - flux reconcile -n flux-system kustomization cluster
hr-restart: hr-restart:
desc: Restart all failed Helm Releases desc: Restart all failed Helm Releases
.taskfiles/SopsTasks.yml
+4 -4
View File
@@ -3,12 +3,12 @@ version: "3"
tasks: tasks:
encrypt: e:
desc: encrypt sops file 'to use must include -- before path to file.' eg "task sops:encrypt -- file.yml" desc: Encrypt sops file 'to use must include -- before path to file.' eg "task sops:e -- file.yaml"
cmds: cmds:
- sops --encrypt --in-place {{.CLI_ARGS}} - sops --encrypt --in-place {{.CLI_ARGS}}
decrypt: d:
desc: decrypt sops file 'to use must include -- before path to file.' eg "task sops:decrypt -- file.yml" desc: Decrypt sops file 'to use must include -- before path to file.' eg "task sops:d -- file.yaml"
cmds: cmds:
- sops --decrypt --in-place {{.CLI_ARGS}} - sops --decrypt --in-place {{.CLI_ARGS}}
.taskfiles/TerraformTasks.yml
+3 -3
View File
@@ -5,18 +5,18 @@ tasks:
init: init:
desc: Initialize terraform dependencies desc: Initialize terraform dependencies
dir: provision/terraform/cloudflare dir: "{{.TERRAFORM_DIR}}/cloudflare"
cmds: cmds:
- terraform init {{.CLI_ARGS}} - terraform init {{.CLI_ARGS}}
plan: plan:
desc: Show the changes terraform will make desc: Show the changes terraform will make
dir: provision/terraform/cloudflare dir: "{{.TERRAFORM_DIR}}/cloudflare"
cmds: cmds:
- terraform plan {{.CLI_ARGS}} - terraform plan {{.CLI_ARGS}}
apply: apply:
desc: Apply the changes to Cloudflare desc: Apply the changes to Cloudflare
dir: provision/terraform/cloudflare dir: "{{.TERRAFORM_DIR}}/cloudflare"
cmds: cmds:
- terraform apply {{.CLI_ARGS}} - terraform apply {{.CLI_ARGS}}
.vscode/extensions.json
Vendored
+7 -3
View File
@@ -1,13 +1,17 @@
{ {
"recommendations": [ "recommendations": [
"HashiCorp.terraform", "albert.TabOut",
"britesnow.vscode-toggle-quotes", "britesnow.vscode-toggle-quotes",
"fcrespo82.markdown-table-formatter",
"mitchdenny.ecdc", "mitchdenny.ecdc",
"ms-kubernetes-tools.vscode-kubernetes-tools", "ms-kubernetes-tools.vscode-kubernetes-tools",
"oderwat.indent-rainbow",
"redhat.ansible", "redhat.ansible",
"signageos.signageos-vscode-sops", "signageos.signageos-vscode-sops",
"usernamehw.errorlens", "usernamehw.errorlens",
"fcrespo82.markdown-table-formatter" "will-stone.in-any-case",
"BriteSnow.vscode-toggle-quotes",
"HashiCorp.terraform",
"PKief.material-icon-theme",
"Weaveworks.vscode-gitops-tools"
] ]
} }
.vscode/settings.json
Vendored
+12 -10
View File
@@ -1,18 +1,20 @@
{ {
"ansible.ansibleLint.arguments": "-c .github/linters/.ansible-lint",
"files.associations": { "files.associations": {
"*.json5": "jsonc", "*.json5": "jsonc",
"**/provision/ansible/**/*.yml": "ansible", "**/ansible/**/*.yml": "ansible",
"**/provision/ansible/**/*.sops.yml": "yaml", "**/ansible/**/*.sops.yml": "yaml",
"**/provision/ansible/**/inventory/**/*.yml": "yaml", "**/ansible/**/inventory/**/*.yml": "yaml",
"**/provision/terraform/**/*.tf": "terraform" "**/terraform/**/*.tf": "terraform",
"**/kubernetes/**/*.sops.toml": "plaintext"
}, },
"prettier.configPath": ".github/linters/.prettierrc.yaml",
"prettier.ignorePath": ".github/linters/.prettierignore",
"yaml.schemas": { "yaml.schemas": {
"Kubernetes": "cluster/*.yaml" "ansible": "ansible/*.yml",
"Kubernetes": "kubernetes/*.yaml"
}, },
"editor.bracketPairColorization.enabled": true, "editor.bracketPairColorization.enabled": true,
"editor.guides.bracketPairs":"active", "editor.guides.bracketPairs": true,
"editor.hover.delay": 1500 "editor.guides.bracketPairsHorizontal": true,
"editor.guides.highlightActiveBracketPair": true,
"editor.hover.delay": 1500,
"files.trimTrailingWhitespace": true,
} }
.github/linters/.yamllint.yaml → .yamllint.yaml
-1
View File
@@ -1,7 +1,6 @@
--- ---
ignore: | ignore: |
*.sops.* *.sops.*
gotk-components.yaml
extends: default extends: default
rules: rules:
truthy: truthy:
README.md
+15 -18
View File
@@ -102,11 +102,10 @@ It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-com
The Git repository contains the following directories under `cluster` and are ordered below by how Flux will apply them. The Git repository contains the following directories under `cluster` and are ordered below by how Flux will apply them.
```sh ```sh
📁 cluster # k8s cluster defined as code 📁 kubernetes # Kubernetes cluster defined as code
├─📁 flux # flux, gitops operator, loaded before everything ├─📁 bootstrap # Flux installation
├─📁 charts # helm chart repos ├─📁 flux # Main Flux configuration of repository
├─📁 config # cluster config └─📁 apps # Apps deployed into the cluster grouped by namespace
└─📁 apps # regular apps, namespaced dir tree, loaded last
``` ```
## 🚀 Lets go ## 🚀 Lets go
@@ -221,7 +220,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y
### ⛵ Installing k3s with Ansible ### ⛵ Installing k3s with Ansible
📍 Here we will be running a Ansible Playbook to install [k3s](https://k3s.io/) with [this](https://galaxy.ansible.com/xanmanning/k3s) wonderful k3s Ansible galaxy role. After completion, Ansible will drop a `kubeconfig` in `./provision/kubeconfig` for use with interacting with your cluster with `kubectl`. 📍 Here we will be running a Ansible Playbook to install [k3s](https://k3s.io/) with [this](https://galaxy.ansible.com/xanmanning/k3s) wonderful k3s Ansible galaxy role. After completion, Ansible will drop a `kubeconfig` in `./kubeconfig` for use with interacting with your cluster with `kubectl`.
☢️ If you run into problems, you can run `task ansible:nuke` to destroy the k3s cluster and start over. ☢️ If you run into problems, you can run `task ansible:nuke` to destroy the k3s cluster and start over.
@@ -254,7 +253,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y
### ☁️ Configuring Cloudflare DNS with Terraform ### ☁️ Configuring Cloudflare DNS with Terraform
📍 Review the Terraform scripts under `./provision/terraform/cloudflare/` and make sure you understand what it's doing (no really review it). 📍 Review the Terraform scripts under `./terraform/cloudflare/` and make sure you understand what it's doing (no really review it).
If your domain already has existing DNS records **be sure to export those DNS settings before you continue**. If your domain already has existing DNS records **be sure to export those DNS settings before you continue**.
@@ -296,7 +295,7 @@ The cluster application [external-dns](https://github.com/kubernetes-sigs/extern
2. Push you changes to git 2. Push you changes to git
📍 **Verify** all the `*.sops.yaml` and `*.sops.yml` files under the `./cluster` and `./provision` folders are **encrypted** with SOPS 📍 **Verify** all the `*.sops.yaml` and `*.sops.yml` files under the `./ansible`, `./kubernetes`, and `./terraform` folders are **encrypted** with SOPS
```sh ```sh
git add -A git add -A
@@ -418,7 +417,7 @@ Flux is pull-based by design meaning it will periodically check your git reposit
1. Webhook URL - Your webhook receiver will be deployed on `https://flux-receiver.${BOOTSTRAP_CLOUDFLARE_DOMAIN}/hook/:hookId`. In order to find out your hook id you can run the following command: 1. Webhook URL - Your webhook receiver will be deployed on `https://flux-receiver.${BOOTSTRAP_CLOUDFLARE_DOMAIN}/hook/:hookId`. In order to find out your hook id you can run the following command:
```sh ```sh
kubectl -n flux-system get receiver/github-receiver --kubeconfig=./provision/kubeconfig kubectl -n flux-system get receiver/github-receiver --kubeconfig=./kubeconfig
# NAME AGE READY STATUS # NAME AGE READY STATUS
# github-receiver 6h8m True Receiver initialized with URL: /hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123 # github-receiver 6h8m True Receiver initialized with URL: /hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
``` ```
@@ -432,7 +431,7 @@ Flux is pull-based by design meaning it will periodically check your git reposit
2. Webhook secret - Your webhook secret can be found by decrypting the `secret.sops.yaml` using the following command: 2. Webhook secret - Your webhook secret can be found by decrypting the `secret.sops.yaml` using the following command:
```sh ```sh
sops -d ./cluster/flux/config/webhooks/github/secret.sops.yaml | yq .stringData.token sops -d ./kubernetes/flux/config/webhooks/github/secret.sops.yaml | yq .stringData.token
``` ```
**Note:** Don't forget to update the `BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET` variable in your `.config.env` file so it matches the generated secret if applicable **Note:** Don't forget to update the `BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET` variable in your `.config.env` file so it matches the generated secret if applicable
@@ -467,12 +466,11 @@ The benefits of a public repository include:
1. Generate new SSH key: 1. Generate new SSH key:
```sh ```sh
ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./cluster/github-deploy-key -q -P "" ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./kubernetes/bootstrap/github-deploy.key -q -P ""
``` ```
2. Paste public key in the deploy keys section of your repository settings 2. Paste public key in the deploy keys section of your repository settings
3. Create sops secret in `./cluster/bootstrap/github-deploy-key.sops.yaml` with the contents of: 3. Create sops secret in `./kubernetes/bootstrap/github-deploy-key.sops.yaml` with the contents of:
```yaml ```yaml
# yamllint disable
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
@@ -492,19 +490,18 @@ The benefits of a public repository include:
``` ```
4. Encrypt secret: 4. Encrypt secret:
```sh ```sh
sops --encrypt --in-place ./cluster/bootstrap/github-deploy-key.sops.yaml sops --encrypt --in-place ./kubernetes/bootstrap/github-deploy-key.sops.yaml
``` ```
5. Apply secret to cluster: 5. Apply secret to cluster:
```sh ```sh
sops --decrypt cluster/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f - sops --decrypt ./kubernetes/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f -
``` ```
6. Update `cluster/flux/config/flux-cluster.yaml`: 6. Update `./kubernetes/flux/config/cluster.yaml`:
```yaml ```yaml
---
apiVersion: source.toolkit.fluxcd.io/v1beta2 apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository kind: GitRepository
metadata: metadata:
name: flux-cluster name: home-kubernetes
namespace: flux-system namespace: flux-system
spec: spec:
interval: 10m interval: 10m
Taskfile.yml
+5 -4
View File
@@ -4,14 +4,14 @@ version: "3"
vars: vars:
PROJECT_DIR: PROJECT_DIR:
sh: "git rev-parse --show-toplevel" sh: "git rev-parse --show-toplevel"
CLUSTER_DIR: "{{.PROJECT_DIR}}/cluster" KUBERNETES_DIR: "{{.PROJECT_DIR}}/kubernetes"
ANSIBLE_DIR: "{{.PROJECT_DIR}}/provision/ansible" ANSIBLE_DIR: "{{.PROJECT_DIR}}/ansible"
TERRAFORM_DIR: "{{.PROJECT_DIR}}/provision/terraform" TERRAFORM_DIR: "{{.PROJECT_DIR}}/terraform"
dotenv: [".config.env"] dotenv: [".config.env"]
env: env:
KUBECONFIG: "{{.PROJECT_DIR}}/provision/kubeconfig" KUBECONFIG: "{{.PROJECT_DIR}}/kubeconfig"
includes: includes:
ansible: .taskfiles/AnsibleTasks.yml ansible: .taskfiles/AnsibleTasks.yml
@@ -49,6 +49,7 @@ tasks:
stern stern
terraform terraform
tflint tflint
weaveworks/tap/gitops
yamllint yamllint
yq yq
ansible.cfg
+2 -2
View File
@@ -6,8 +6,8 @@ stdout_callback = yaml
force_valid_group_names = ignore force_valid_group_names = ignore
# File/Directory settings # File/Directory settings
log_path = ~/.ansible/ansible.log log_path = ~/.ansible/ansible.log
inventory = ./provision/ansible/inventory inventory = ./ansible/inventory
roles_path = ~/.ansible/roles:./provision/ansible/roles roles_path = ~/.ansible/roles:./ansible/roles
collections_path = ~/.ansible/collections collections_path = ~/.ansible/collections
remote_tmp = /tmp remote_tmp = /tmp
local_tmp = ~/.ansible/tmp local_tmp = ~/.ansible/tmp
provision/ansible/inventory/group_vars/kubernetes/k3s.yml → ansible/inventory/group_vars/kubernetes/k3s.yml
View File
File renamed without changes.
provision/ansible/inventory/group_vars/kubernetes/os.yml → ansible/inventory/group_vars/kubernetes/os.yml
View File
File renamed without changes.
provision/ansible/inventory/group_vars/master/k3s.yml → ansible/inventory/group_vars/master/k3s.yml
-12
View File
@@ -9,7 +9,6 @@ k3s_control_node: true
k3s_server: k3s_server:
node-ip: "{{ ansible_host }}" node-ip: "{{ ansible_host }}"
tls-san: tls-san:
# kube-vip
- "{{ kubevip_address }}" - "{{ kubevip_address }}"
# Disable Docker - this will use the default containerd CRI # Disable Docker - this will use the default containerd CRI
docker: false docker: false
@@ -30,28 +29,17 @@ k3s_server:
cluster-cidr: "10.42.0.0/16" cluster-cidr: "10.42.0.0/16"
# Network CIDR to use for service IPs # Network CIDR to use for service IPs
service-cidr: "10.43.0.0/16" service-cidr: "10.43.0.0/16"
kubelet-arg:
# Allow k8s services to contain TCP and UDP on the same port
- "feature-gates=MixedProtocolLBService=true"
kube-controller-manager-arg: kube-controller-manager-arg:
# Allow k8s services to contain TCP and UDP on the same port
- "feature-gates=MixedProtocolLBService=true"
# Required to monitor kube-controller-manager with kube-prometheus-stack # Required to monitor kube-controller-manager with kube-prometheus-stack
- "bind-address=0.0.0.0" - "bind-address=0.0.0.0"
kube-proxy-arg: kube-proxy-arg:
# Allow k8s services to contain TCP and UDP on the same port
- "feature-gates=MixedProtocolLBService=true"
# Required to monitor kube-proxy with kube-prometheus-stack # Required to monitor kube-proxy with kube-prometheus-stack
- "metrics-bind-address=0.0.0.0" - "metrics-bind-address=0.0.0.0"
kube-scheduler-arg: kube-scheduler-arg:
# Allow k8s services to contain TCP and UDP on the same port
- "feature-gates=MixedProtocolLBService=true"
# Required to monitor kube-scheduler with kube-prometheus-stack # Required to monitor kube-scheduler with kube-prometheus-stack
- "bind-address=0.0.0.0" - "bind-address=0.0.0.0"
# Required to monitor etcd with kube-prometheus-stack # Required to monitor etcd with kube-prometheus-stack
etcd-expose-metrics: true etcd-expose-metrics: true
kube-apiserver-arg: kube-apiserver-arg:
# Allow k8s services to contain TCP and UDP on the same port
- "feature-gates=MixedProtocolLBService=true"
# Required for HAProxy health-checks # Required for HAProxy health-checks
- "anonymous-auth=true" - "anonymous-auth=true"
provision/ansible/inventory/group_vars/worker/k3s.yml → ansible/inventory/group_vars/worker/k3s.yml
-3
View File
@@ -8,6 +8,3 @@ k3s_control_node: false
# (dict) k3s settings for all worker nodes # (dict) k3s settings for all worker nodes
k3s_agent: k3s_agent:
node-ip: "{{ ansible_host }}" node-ip: "{{ ansible_host }}"
kubelet-arg:
# Allow k8s services to contain TCP and UDP on the same port
- "feature-gates=MixedProtocolLBService=true"
cluster/flux/repositories/git/.gitkeep → ansible/inventory/host_vars/.gitkeep
View File
File renamed without changes.
provision/ansible/playbooks/cluster-installation.yml → ansible/playbooks/cluster-installation.yml
+5 -5
View File
@@ -38,11 +38,11 @@
git rev-parse --show-toplevel git rev-parse --show-toplevel
register: repo_abs_path register: repo_abs_path
- name: Copy kubeconfig to provision folder - name: Copy kubeconfig project directory
run_once: true run_once: true
ansible.builtin.fetch: ansible.builtin.fetch:
src: "/etc/rancher/k3s/k3s.yaml" src: "/etc/rancher/k3s/k3s.yaml"
dest: "{{ repo_abs_path.stdout }}/provision/kubeconfig" dest: "{{ repo_abs_path.stdout }}/kubeconfig"
flat: true flat: true
when: when:
- k3s_control_node is defined - k3s_control_node is defined
@@ -53,7 +53,7 @@
become: false become: false
run_once: true run_once: true
ansible.builtin.replace: ansible.builtin.replace:
path: "{{ repo_abs_path.stdout }}/provision/kubeconfig" path: "{{ repo_abs_path.stdout }}/kubeconfig"
regexp: "https://127.0.0.1:6443" regexp: "https://127.0.0.1:6443"
replace: "https://{{ k3s_registration_address }}:6443" replace: "https://{{ k3s_registration_address }}:6443"
@@ -99,11 +99,11 @@
- k3s_control_node - k3s_control_node
# Cleaning up the manifests from the /var/lib/rancher/k3s/server/manifests # Cleaning up the manifests from the /var/lib/rancher/k3s/server/manifests
# directory is needed because k3s has an awesome "feature" to always deploy # directory is needed because k3s has an awesome "feature" to always deploy
# these on restarting the k3s systemd service. Removing them does NOT # these on restarting the k3s systemd service. Removing them does NOT
# uninstall the manifests. # uninstall the manifests.
# Removing them means we can manage the lifecycle of these components # Removing them means we can manage the lifecycle of these components
# outside of the /var/lib/rancher/k3s/server/manifests directory # outside of the /var/lib/rancher/k3s/server/manifests directory
- name: Remove deployed manifest templates - name: Remove deployed manifest templates
provision/ansible/playbooks/cluster-nuke.yml → ansible/playbooks/cluster-nuke.yml
View File
File renamed without changes.
provision/ansible/playbooks/cluster-prepare.yml → ansible/playbooks/cluster-prepare.yml
View File
File renamed without changes.
provision/ansible/playbooks/cluster-reboot.yml → ansible/playbooks/cluster-reboot.yml
View File
File renamed without changes.
provision/ansible/playbooks/templates/calico-installation.yaml.j2 → ansible/playbooks/templates/calico-installation.yaml.j2
View File
File renamed without changes.
provision/ansible/playbooks/templates/kube-vip-daemonset.yaml.j2 → ansible/playbooks/templates/kube-vip-daemonset.yaml.j2
+2 -5
View File
@@ -22,8 +22,7 @@ spec:
- name: kube-vip - name: kube-vip
image: ghcr.io/kube-vip/kube-vip:v0.5.7 image: ghcr.io/kube-vip/kube-vip:v0.5.7
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args: ["manager"]
- manager
env: env:
- name: vip_arp - name: vip_arp
value: "true" value: "true"
@@ -49,9 +48,7 @@ spec:
value: "{{ k3s_registration_address }}" value: "{{ k3s_registration_address }}"
securityContext: securityContext:
capabilities: capabilities:
add: add: ["NET_ADMIN", "NET_RAW"]
- NET_ADMIN
- NET_RAW
hostAliases: hostAliases:
- hostnames: - hostnames:
- kubernetes - kubernetes
provision/ansible/requirements.yml → ansible/requirements.yml
View File
File renamed without changes.
cluster/apps/default/hajimari/config-pvc.yaml
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: hajimari-config
namespace: default
spec:
accessModes:
- ReadWriteOnce
storageClassName: local-path
resources:
requests:
storage: 128Mi
cluster/apps/default/hajimari/helm-release.yaml
-131
View File
@@ -1,131 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: hajimari
namespace: default
spec:
interval: 15m
chart:
spec:
chart: hajimari
version: 2.0.2
sourceRef:
kind: HelmRepository
name: hajimari
namespace: flux-system
interval: 15m
install:
createNamespace: true
remediation:
retries: 5
upgrade:
remediation:
retries: 5
values:
hajimari:
defaultEnable: false
namespaceSelector:
matchNames:
- default
name: "you"
customApps:
- name: Some External Cluster Service
url: http://192.168.1.100:5000
icon: test-tube
showGlobalBookmarks: true
globalBookmarks:
- group: Communicate
bookmarks:
- name: Discord
url: "https://discord.com"
- name: Gmail
url: "https://gmail.com"
- name: Slack
url: "https://slack.com/signin"
- group: Cloud
bookmarks:
- name: Box
url: "https://box.com"
- name: Dropbox
url: "https://dropbox.com"
- name: Drive
url: "https://drive.google.com"
- group: Design
bookmarks:
- name: Awwwards
url: "https://awwwards.com"
- name: Dribbble
url: "https://dribbble.com"
- name: Muz.li
url: "https://medium.muz.li/"
- group: Dev
bookmarks:
- name: Codepen
url: "https://codepen.io/"
- name: Devdocs
url: "https://devdocs.io"
- name: Devhints
url: "https://devhints.io"
- group: Lifestyle
bookmarks:
- name: Design Milk
url: "https://design-milk.com/category/interior-design/"
- name: Dwell
url: "https://www.dwell.com/"
- name: Freshome
url: "https://www.mymove.com/freshome/"
- group: Media
bookmarks:
- name: Spotify
url: "http://browse.spotify.com"
- name: Trakt
url: "http://trakt.tv"
- name: YouTube
url: "https://youtube.com/feed/subscriptions"
- group: Reading
bookmarks:
- name: Instapaper
url: "https://www.instapaper.com/u"
- name: Medium
url: "http://medium.com"
- name: Reddit
url: "http://reddit.com"
- group: Tech
bookmarks:
- name: Hacker News
url: "https://news.ycombinator.com/"
- name: The Verge
url: "https://theverge.com/"
- name: MIT Technology Review
url: "https://www.technologyreview.com/"
ingress:
main:
enabled: true
ingressClassName: "nginx"
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-staging"
hajimari.io/enable: "true"
hajimari.io/icon: "weather-sunset"
nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
hosts:
- host: "hajimari.${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- "hajimari.${SECRET_DOMAIN}"
secretName: "hajimari-tls"
persistence:
data:
enabled: true
existingClaim: hajimari-config
podAnnotations:
configmap.reloader.stakater.com/reload: "hajimari-settings"
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 256Mi
cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml
-69
View File
@@ -1,69 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cert-manager-issuers
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: raw
version: v0.3.1
sourceRef:
kind: HelmRepository
name: dysnix
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 5
upgrade:
remediation:
retries: 5
dependsOn:
- name: cert-manager
namespace: kube-system
values:
resources:
- apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: "${SECRET_CLOUDFLARE_EMAIL}"
privateKeySecretRef:
name: letsencrypt-production
solvers:
- dns01:
cloudflare:
email: "${SECRET_CLOUDFLARE_EMAIL}"
apiKeySecretRef:
name: cloudflare-api-key
key: api-key
selector:
dnsZones:
- ${SECRET_DOMAIN}
- apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: "${SECRET_CLOUDFLARE_EMAIL}"
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- dns01:
cloudflare:
email: "${SECRET_CLOUDFLARE_EMAIL}"
apiKeySecretRef:
name: cloudflare-api-key
key: api-key
selector:
dnsZones:
- ${SECRET_DOMAIN}
cluster/apps/kube-system/cert-manager/kustomization.yaml
-5
View File
@@ -1,5 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-release.yaml
- ./issuers
cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml
-42
View File
@@ -1,42 +0,0 @@
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: &app cloudflare-ddns
namespace: kube-system
spec:
schedule: "@hourly"
concurrencyPolicy: Forbid
successfulJobsHistoryLimit: 1
failedJobsHistoryLimit: 2
jobTemplate:
spec:
ttlSecondsAfterFinished: 3600
template:
spec:
automountServiceAccountToken: false
restartPolicy: OnFailure
containers:
- name: *app
image: ghcr.io/onedr0p/kubernetes-kubectl:1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d
envFrom:
- secretRef:
name: *app
command:
- "/bin/bash"
- &scriptPath "/app/cloudflare-ddns.sh"
volumeMounts:
- name: *app
mountPath: *scriptPath
subPath: &scriptName cloudflare-ddns.sh
readOnly: true
volumes:
- name: *app
projected:
defaultMode: 0775
sources:
- configMap:
name: *app
items:
- key: *scriptName
path: *scriptName
cluster/apps/kube-system/kustomization.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cert-manager
- ./cloudflare-ddns
- ./external-dns
- ./ingress-nginx
- ./k8s-gateway
- ./kube-vip
- ./metallb
- ./metrics-server
- ./reloader
cluster/apps/kube-system/metallb/config/helm-release.yaml
-45
View File
@@ -1,45 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: metallb-config
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: raw
version: v0.3.1
sourceRef:
kind: HelmRepository
name: dysnix
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 5
upgrade:
remediation:
retries: 5
dependsOn:
- name: metallb
namespace: kube-system
values:
resources:
- apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
name: l2-ip
namespace: kube-system
spec:
ipAddressPools:
- default-pool
- apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
name: default-pool
namespace: kube-system
spec:
addresses:
- "${METALLB_LB_RANGE}"
cluster/apps/kube-system/metallb/config/kustomization.yaml
-4
View File
@@ -1,4 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
cluster/apps/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./default
- ./kube-system
# - ./system-upgrade
cluster/apps/system-upgrade/kured/helm-release.yaml
-32
View File
@@ -1,32 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: kured
namespace: system-upgrade
spec:
interval: 15m
chart:
spec:
chart: kured
version: 4.2.0
sourceRef:
kind: HelmRepository
name: kubereboot
namespace: flux-system
interval: 15m
install:
createNamespace: true
remediation:
retries: 5
upgrade:
remediation:
retries: 5
values:
configuration:
startTime: "10pm"
endTime: "2am"
logFormat: "json"
timeZone: "${TIMEZONE}"
rebootSentinelCommand: |-
sh -c "! needs-restarting --reboothint"
cluster/apps/system-upgrade/kured/kustomization.yaml
-5
View File
@@ -1,5 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-release.yaml
cluster/apps/system-upgrade/kustomization.yaml
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
# renovate: datasource=docker image=rancher/system-upgrade-controller
- https://github.com/rancher/system-upgrade-controller/releases/download/v0.9.1/crd.yaml
- ./system-upgrade-controller
- ./kured
cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml
-27
View File
@@ -1,27 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- github.com/rancher/system-upgrade-controller?ref=v0.10.0
- ./plans
images:
- name: rancher/system-upgrade-controller
newTag: v0.10.0
patchesStrategicMerge:
# Delete namespace resource
- |
$patch: delete
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
# Add labels
- |-
apiVersion: apps/v1
kind: Deployment
metadata:
name: system-upgrade-controller
namespace: system-upgrade
labels:
app.kubernetes.io/name: system-upgrade-controller
app.kubernetes.io/instance: system-upgrade-controller
cluster/flux/config/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./flux-installation.yaml
- ./flux-cluster.yaml
cluster/flux/repositories/helm/kubereboot-charts.yaml
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: kubereboot
namespace: flux-system
spec:
interval: 1h
url: https://kubereboot.github.io/charts
cluster/flux/repositories/helm/kustomization.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./bitnami-charts.yaml
- ./bjw-s-charts.yaml
- ./dysnix-charts.yaml
- ./external-dns-charts.yaml
- ./hajimari-charts.yaml
- ./ingress-nginx-charts.yaml
- ./jetstack-charts.yaml
- ./kubereboot-charts.yaml
- ./k8s-gateway-charts.yaml
- ./metallb-charts.yaml
- ./metrics-server-charts.yaml
- ./stakater-charts.yaml
configure
Vendored
+65 -44
View File
@@ -40,39 +40,44 @@ main() {
# generate sops configuration file # generate sops configuration file
envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \ envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \
> "${PROJECT_DIR}/.sops.yaml" > "${PROJECT_DIR}/.sops.yaml"
# generate cluster settings # generate cluster settings
envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-settings.yaml" \ envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster-settings.yaml" \
> "${PROJECT_DIR}/cluster/flux/vars/cluster-settings.yaml" > "${PROJECT_DIR}/kubernetes/flux/vars/cluster-settings.yaml"
envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \
> "${PROJECT_DIR}/cluster/flux/config/flux-cluster.yaml" envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster.yaml" \
envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \ > "${PROJECT_DIR}/kubernetes/flux/config/cluster.yaml"
> "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml"
# generate cluster secrets # generate secrets
envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \ envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cluster-secrets.sops.yaml" \
> "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml" > "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \ sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
> "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \ envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cert-manager-secret.sops.yaml" \
> "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml" > "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \ sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
> "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
# encrypt cluster secrets envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml" \
sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml" > "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml" sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml" envsubst < "${PROJECT_DIR}/tmpl/kubernetes/external-dns-secret.sops.yaml" \
# generate terraform secrets > "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
envsubst < "${PROJECT_DIR}/tmpl/terraform/secret.sops.yaml" \ envsubst < "${PROJECT_DIR}/tmpl/terraform/secret.sops.yaml" \
> "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml" > "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml"
# encrypt terraform secrets sops --encrypt --in-place "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml"
# generate ansible settings # generate ansible settings
envsubst < "${PROJECT_DIR}/tmpl/ansible/kube-vip.yml" \ envsubst < "${PROJECT_DIR}/tmpl/ansible/kube-vip.yml" \
> "${PROJECT_DIR}/provision/ansible/inventory/group_vars/kubernetes/kube-vip.yml" > "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/kube-vip.yml"
# generate ansible hosts file and secrets # generate ansible hosts file and secrets
generate_ansible_hosts generate_ansible_hosts
generate_ansible_host_secrets generate_ansible_host_secrets
setup_github_webhook setup_github_webhook
setup_weave_gitops
success success
fi fi
} }
@@ -236,6 +241,7 @@ verify_binaries() {
_has_binary "helm" _has_binary "helm"
_has_binary "ipcalc" _has_binary "ipcalc"
_has_binary "jq" _has_binary "jq"
_has_binary "gitops"
_has_binary "yq" _has_binary "yq"
_has_binary "sops" _has_binary "sops"
_has_binary "ssh" _has_binary "ssh"
@@ -289,25 +295,40 @@ verify_git_repository() {
} }
setup_github_webhook() { setup_github_webhook() {
WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET:-ignored}" _has_envar "BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET"
if [[ "${WEBHOOK_SECRET}" != "ignored" ]]; then WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}"
if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
WEBHOOK_SECRET="$(openssl rand -base64 30)"
fi
export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}" if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
_log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux" WEBHOOK_SECRET="$(openssl rand -base64 30)"
mkdir -p "${PROJECT_DIR}/cluster/flux/add-ons"
cp -rf "${PROJECT_DIR}/tmpl/cluster/flux/webhooks" "${PROJECT_DIR}/cluster/flux/add-ons"
cp -rf "${PROJECT_DIR}/tmpl/cluster/flux/kustomization.yaml" "${PROJECT_DIR}/cluster/flux/add-ons"
envsubst < "${PROJECT_DIR}/tmpl/cluster/flux/webhooks/github/secret.sops.yaml" \
> "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml"
fi fi
export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
_log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/github-webhook-token-secret.sops.yaml" \
> "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
}
setup_weave_gitops() {
_has_envar "BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD"
WEAVE_GITOPS_ADMIN_PASSWORD="${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}"
if [[ "${WEAVE_GITOPS_ADMIN_PASSWORD}" == "generated" ]]; then
WEAVE_GITOPS_ADMIN_PASSWORD="$(openssl rand -base64 30)"
fi
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="${WEAVE_GITOPS_ADMIN_PASSWORD}"
_log "INFO" "Using admin password '${WEAVE_GITOPS_ADMIN_PASSWORD}' for Weave Gitops"
# Convert password to bcrypt hash
export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="$(echo -n "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" | gitops get bcrypt-hash)"
envsubst < "${PROJECT_DIR}/tmpl/kubernetes/weave-gitops-secret.sops.yaml" \
> "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
} }
verify_cloudflare() { verify_cloudflare() {
@@ -426,8 +447,8 @@ generate_ansible_host_secrets() {
printf "kind: Secret\n" printf "kind: Secret\n"
printf "ansible_user: %s\n" "${!node_username}" printf "ansible_user: %s\n" "${!node_username}"
printf "ansible_become_pass: %s\n" "${!node_password}" printf "ansible_become_pass: %s\n" "${!node_password}"
} > "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml" } > "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
sops --encrypt --in-place "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml" sops --encrypt --in-place "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
done done
} }
@@ -480,7 +501,7 @@ generate_ansible_hosts() {
fi fi
done done
fi fi
} > "${PROJECT_DIR}/provision/ansible/inventory/hosts.yml" } > "${PROJECT_DIR}/ansible/inventory/hosts.yml"
} }
success() { success() {
cluster/apps/kube-system/cert-manager/helm-release.yaml → kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
+13 -7
View File
@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease kind: HelmRelease
metadata: metadata:
name: cert-manager name: cert-manager
namespace: kube-system namespace: cert-manager
spec: spec:
interval: 15m interval: 15m
chart: chart:
@@ -14,24 +14,30 @@ spec:
kind: HelmRepository kind: HelmRepository
name: jetstack name: jetstack
namespace: flux-system namespace: flux-system
interval: 15m
install: install:
createNamespace: true createNamespace: true
remediation: remediation:
retries: 5 retries: 3
upgrade: upgrade:
remediation: remediation:
retries: 5 retries: 3
values: values:
installCRDs: true installCRDs: true
replicaCount: 3
webhook: webhook:
enabled: true replicaCount: 3
cainjector:
replicaCount: 3
extraArgs: extraArgs:
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53 - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
- --dns01-recursive-nameservers-only - --dns01-recursive-nameservers-only
replicaCount: 1 podDnsPolicy: None
podDnsPolicy: "None"
podDnsConfig: podDnsConfig:
nameservers: nameservers:
- "1.1.1.1" - "1.1.1.1"
- "9.9.9.9" - "9.9.9.9"
prometheus:
enabled: true
servicemonitor:
enabled: true
prometheusInstance: monitoring
kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml
+17
View File
@@ -0,0 +1,17 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-manager
resources:
- ./helmrelease.yaml
- ./prometheusrule.yaml
configMapGenerator:
- name: cert-manager-dashboard
files:
- cert-manager-dashboard.json=https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
generatorOptions:
disableNameSuffixHash: true
annotations:
kustomize.toolkit.fluxcd.io/substitute: disabled
labels:
grafana_dashboard: "true"
kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml
+68
View File
@@ -0,0 +1,68 @@
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-manager.rules
namespace: cert-manager
spec:
groups:
- name: cert-manager
rules:
- alert: CertManagerAbsent
expr: |
absent(up{job="cert-manager"})
for: 15m
labels:
severity: critical
annotations:
description:
"New certificates will not be able to be minted, and existing
ones can't be renewed until cert-manager is back."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
summary: "Cert Manager has dissapeared from Prometheus service discovery."
- name: certificates
rules:
- alert: CertManagerCertExpirySoon
expr: |
avg by (exported_namespace, namespace, name) (
certmanager_certificate_expiration_timestamp_seconds - time())
< (21 * 24 * 3600)
for: 15m
labels:
severity: warning
annotations:
description:
"The domain that this cert covers will be unavailable after
{{ $value | humanizeDuration }}. Clients using endpoints that this cert
protects will start to fail in {{ $value | humanizeDuration }}."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
summary:
"The cert {{ $labels.name }} is {{ $value | humanizeDuration }}
from expiry, it should have renewed over a week ago."
- alert: CertManagerCertNotReady
expr: |
max by (name, exported_namespace, namespace, condition) (
certmanager_certificate_ready_status{condition!="True"} == 1)
for: 15m
labels:
severity: critical
annotations:
description:
"This certificate has not been ready to serve traffic for at least
10m. If the cert is being renewed or there is another valid cert, the ingress
controller _may_ be able to serve that instead."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
summary: "The cert {{ $labels.name }} is not ready to serve traffic."
- alert: CertManagerHittingRateLimits
expr: |
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m]))
> 0
for: 15m
labels:
severity: critical
annotations:
description:
"Depending on the rate limit, cert-manager may be unable to generate
certificates for up to a week."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
summary: "Cert manager hitting LetsEncrypt rate limits."
kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml
+41
View File
@@ -0,0 +1,41 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: "${SECRET_CLOUDFLARE_EMAIL}"
privateKeySecretRef:
name: letsencrypt-production
solvers:
- dns01:
cloudflare:
email: "${SECRET_CLOUDFLARE_EMAIL}"
apiKeySecretRef:
name: cert-manager-secret
key: api-key
selector:
dnsZones:
- "${SECRET_DOMAIN}"
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: "${SECRET_CLOUDFLARE_EMAIL}"
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- dns01:
cloudflare:
email: "${SECRET_CLOUDFLARE_EMAIL}"
apiKeySecretRef:
name: cert-manager-secret
key: api-key
selector:
dnsZones:
- "${SECRET_DOMAIN}"
cluster/apps/kube-system/external-dns/kustomization.yaml → kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml
+1 -1
View File
@@ -2,5 +2,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./helm-release.yaml
- ./secret.sops.yaml - ./secret.sops.yaml
- ./issuers.yaml
kubernetes/apps/cert-manager/cert-manager/ks.yaml
+41
View File
@@ -0,0 +1,41 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-cert-manager
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/cert-manager/cert-manager/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: cert-manager
namespace: cert-manager
interval: 30m
retryInterval: 1m
timeout: 3m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-cert-manager-issuers
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-cert-manager
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
interval: 30m
retryInterval: 1m
timeout: 3m
cluster/apps/default/kustomization.yaml → kubernetes/apps/cert-manager/kustomization.yaml
+1 -2
View File
@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./namespace.yaml - ./namespace.yaml
- ./echo-server - ./cert-manager/ks.yaml
- ./hajimari
kubernetes/apps/cert-manager/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
cluster/apps/default/echo-server/helm-release.yaml → kubernetes/apps/default/echo-server/app/helmrelease.yaml
+16 -13
View File
@@ -2,7 +2,7 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta1 apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease kind: HelmRelease
metadata: metadata:
name: echo-server name: &app echo-server
namespace: default namespace: default
spec: spec:
interval: 15m interval: 15m
@@ -17,10 +17,10 @@ spec:
install: install:
createNamespace: true createNamespace: true
remediation: remediation:
retries: 5 retries: 3
upgrade: upgrade:
remediation: remediation:
retries: 5 retries: 3
values: values:
controller: controller:
replicas: 3 replicas: 3
@@ -51,25 +51,28 @@ spec:
ingress: ingress:
main: main:
enabled: true enabled: true
ingressClassName: "nginx" ingressClassName: nginx
annotations: annotations:
cert-manager.io/cluster-issuer: "letsencrypt-staging" external-dns.home.arpa/enabled: "true"
external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
external-dns/is-public: "true"
hajimari.io/enable: "true"
hajimari.io/icon: "video-input-antenna" hajimari.io/icon: "video-input-antenna"
hosts: hosts:
- host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}" - host: &host "{{ .Release.Name }}.devbu.io"
paths: paths:
- path: / - path: /
pathType: Prefix pathType: Prefix
tls: tls:
- hosts: - hosts:
- *host - *host
secretName: "echo-server-tls" topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: *app
resources: resources:
requests: requests:
cpu: 50m cpu: 5m
memory: 64Mi memory: 10Mi
limits: limits:
memory: 96Mi memory: 50Mi
cluster/apps/kube-system/metrics-server/kustomization.yaml → kubernetes/apps/default/echo-server/app/kustomization.yaml
+2 -1
View File
@@ -1,5 +1,6 @@
--- ---
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
namespace: default
resources: resources:
- ./helm-release.yaml - ./helmrelease.yaml
kubernetes/apps/default/echo-server/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-echo-server
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/default/echo-server/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: echo-server
namespace: default
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/default/hajimari/app/helmrelease.yaml
+62
View File
@@ -0,0 +1,62 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: hajimari
namespace: default
spec:
interval: 15m
chart:
spec:
chart: hajimari
version: 2.0.2
sourceRef:
kind: HelmRepository
name: hajimari
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
hajimari:
title: Apps
darkTheme: espresso
alwaysTargetBlank: true
showGreeting: false
showAppGroups: false
showAppStatus: false
showBookmarkGroups: false
showGlobalBookmarks: false
showAppUrls: false
defaultEnable: true
namespaceSelector:
matchNames:
- default
ingress:
main:
enabled: true
ingressClassName: nginx
annotations:
hajimari.io/enable: "false"
hosts:
- host: &host "${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
podAnnotations:
configmap.reloader.stakater.com/reload: "hajimari-settings"
persistence:
data:
enabled: true
type: emptyDir
resources:
requests:
cpu: 100m
memory: 128M
cluster/apps/default/echo-server/kustomization.yaml → kubernetes/apps/default/hajimari/app/kustomization.yaml
+2 -1
View File
@@ -1,5 +1,6 @@
--- ---
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
namespace: default
resources: resources:
- ./helm-release.yaml - ./helmrelease.yaml
kubernetes/apps/default/hajimari/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-hajimari
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/default/hajimari/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: hajimari
namespace: default
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/default/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./echo-server/ks.yaml
- ./hajimari/ks.yaml
cluster/apps/default/namespace.yaml → kubernetes/apps/default/namespace.yaml
View File
File renamed without changes.
kubernetes/apps/flux-system/addons/ks.yaml
+18
View File
@@ -0,0 +1,18 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-flux-webhooks
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/flux-system/addons/webhooks
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 3m
tmpl/cluster/flux/webhooks/github/ingress.yaml → kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
+2 -2
View File
@@ -11,7 +11,7 @@ metadata:
spec: spec:
ingressClassName: nginx ingressClassName: nginx
rules: rules:
- host: "flux-receiver.${SECRET_DOMAIN}" - host: &host "flux-receiver.${SECRET_DOMAIN}"
http: http:
paths: paths:
- path: /hook/ - path: /hook/
@@ -23,5 +23,5 @@ spec:
number: 80 number: 80
tls: tls:
- hosts: - hosts:
- "flux-receiver.${SECRET_DOMAIN}" - *host
secretName: flux-receiver-tls secretName: flux-receiver-tls
tmpl/cluster/flux/webhooks/github/kustomization.yaml → kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml
+1 -1
View File
@@ -2,6 +2,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./secret.sops.yaml
- ./ingress.yaml - ./ingress.yaml
- ./receiver.yaml - ./receiver.yaml
- ./secret.sops.yaml
tmpl/cluster/flux/webhooks/github/receiver.yaml → kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml
+4 -12
View File
@@ -10,25 +10,17 @@ spec:
- ping - ping
- push - push
secretRef: secretRef:
name: github-webhook-secret name: github-webhook-token-secret
resources: resources:
- apiVersion: source.toolkit.fluxcd.io/v1beta2 - apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository kind: GitRepository
name: flux-cluster name: home-kubernetes
namespace: flux-system namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization kind: Kustomization
name: apps name: cluster
namespace: flux-system namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization kind: Kustomization
name: charts name: cluster-apps
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
name: config
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
name: flux-cluster
namespace: flux-system namespace: flux-system
tmpl/cluster/flux/webhooks/kustomization.yaml → kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml
View File
File renamed without changes.
kubernetes/apps/flux-system/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./addons/ks.yaml
- ./weave-gitops/ks.yaml
kubernetes/apps/flux-system/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
+54
View File
@@ -0,0 +1,54 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: weave-gitops
namespace: flux-system
spec:
interval: 15m
chart:
spec:
chart: weave-gitops
version: 4.0.9
sourceRef:
kind: HelmRepository
name: weave-gitops
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
adminUser:
create: true
username: admin
ingress:
enabled: true
className: nginx
annotations:
hajimari.io/icon: "sawtooth-wave"
hosts:
- host: &host "gitops.${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
networkPolicy:
create: false
metrics:
enabled: true
rbac:
create: true
impersonationResourceNames: ["admin"]
podAnnotations:
secret.reloader.stakater.com/reload: weave-gitops-secret
valuesFrom:
- kind: Secret
name: weave-gitops-secret
valuesKey: adminPassword
targetPath: adminUser.passwordHash
kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: flux-system
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/flux-system/weave-gitops/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-weave-gitops
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/flux-system/weave-gitops/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: weave-gitops
namespace: flux-system
interval: 30m
retryInterval: 1m
timeout: 3m
tmpl/cluster/kube-vip-daemonset.yaml → kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml
+3 -6
View File
@@ -22,8 +22,7 @@ spec:
- name: kube-vip - name: kube-vip
image: ghcr.io/kube-vip/kube-vip:v0.5.7 image: ghcr.io/kube-vip/kube-vip:v0.5.7
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
args: args: ["manager"]
- manager
env: env:
- name: vip_arp - name: vip_arp
value: "true" value: "true"
@@ -46,12 +45,10 @@ spec:
- name: vip_retryperiod - name: vip_retryperiod
value: "2" value: "2"
- name: address - name: address
value: "${BOOTSTRAP_KUBE_VIP_ADDR}" value: "${KUBE_VIP_ADDR}"
securityContext: securityContext:
capabilities: capabilities:
add: add: ["NET_ADMIN", "NET_RAW"]
- NET_ADMIN
- NET_RAW
hostAliases: hostAliases:
- hostnames: - hostnames:
- kubernetes - kubernetes
cluster/apps/kube-system/kube-vip/kustomization.yaml → kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml
+1
View File
@@ -1,6 +1,7 @@
--- ---
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
namespace: kube-system
resources: resources:
- ./rbac.yaml - ./rbac.yaml
- ./daemon-set.yaml - ./daemon-set.yaml
cluster/apps/kube-system/kube-vip/rbac.yaml → kubernetes/apps/kube-system/kube-vip/app/rbac.yaml
View File
File renamed without changes.
kubernetes/apps/kube-system/kube-vip/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-kube-vip
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/kube-system/kube-vip/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: apps/v1
kind: DaemonSet
name: kube-vip
namespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 3m
kubernetes/apps/kube-system/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./kube-vip/ks.yaml
- ./metrics-server/ks.yaml
- ./reloader/ks.yaml
cluster/apps/kube-system/metrics-server/helm-release.yaml → kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
+6 -3
View File
@@ -14,17 +14,20 @@ spec:
kind: HelmRepository kind: HelmRepository
name: metrics-server name: metrics-server
namespace: flux-system namespace: flux-system
interval: 15m
install: install:
createNamespace: true createNamespace: true
remediation: remediation:
retries: 5 retries: 3
upgrade: upgrade:
remediation: remediation:
retries: 5 retries: 3
values: values:
args: args:
- --kubelet-insecure-tls - --kubelet-insecure-tls
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port - --kubelet-use-node-status-port
- --metric-resolution=15s - --metric-resolution=15s
metrics:
enabled: true
serviceMonitor:
enabled: true
cluster/apps/default/hajimari/kustomization.yaml → kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
+2 -2
View File
@@ -1,6 +1,6 @@
--- ---
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
namespace: kube-system
resources: resources:
- ./config-pvc.yaml - ./helmrelease.yaml
- ./helm-release.yaml
kubernetes/apps/kube-system/metrics-server/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-metrics-server
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/kube-system/metrics-server/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: metrics-server
namespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 3m
cluster/apps/kube-system/namespace.yaml → kubernetes/apps/kube-system/namespace.yaml
View File
File renamed without changes.
cluster/apps/kube-system/reloader/helm-release.yaml → kubernetes/apps/kube-system/reloader/app/helmrelease.yaml
+12 -4
View File
@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease kind: HelmRelease
metadata: metadata:
name: reloader name: reloader
namespace: kube-system namespace: &namespace kube-system
spec: spec:
interval: 15m interval: 15m
chart: chart:
@@ -14,13 +14,21 @@ spec:
kind: HelmRepository kind: HelmRepository
name: stakater name: stakater
namespace: flux-system namespace: flux-system
interval: 15m
install: install:
createNamespace: true createNamespace: true
remediation: remediation:
retries: 5 retries: 3
upgrade: upgrade:
remediation: remediation:
retries: 5 retries: 3
values: values:
fullnameOverride: reloader fullnameOverride: reloader
reloader:
enableHA: true
deployment:
replicas: 3
reloadStrategy: annotations
reloadOnCreate: false
podMonitor:
enabled: true
namespace: *namespace
kubernetes/apps/kube-system/reloader/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/reloader/ks.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-reloader
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
path: ./kubernetes/apps/kube-system/reloader/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
healthChecks:
- apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
name: reloader
namespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 3m
cluster/apps/kube-system/cloudflare-ddns/cloudflare-ddns.sh → kubernetes/apps/networking/cloudflare-ddns/app/cloudflare-ddns.sh
View File
File renamed without changes.
kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml
+49
View File
@@ -0,0 +1,49 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cloudflare-ddns
namespace: networking
spec:
interval: 15m
chart:
spec:
chart: app-template
version: 1.2.0
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
controller:
type: cronjob
cronjob:
concurrencyPolicy: Forbid
schedule: "@hourly"
restartPolicy: OnFailure
image:
repository: ghcr.io/onedr0p/kubernetes-kubectl
tag: 1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d
command: ["/bin/bash", "/app/cloudflare-ddns.sh"]
envFrom:
- secretRef:
name: cloudflare-ddns-secret
service:
main:
enabled: false
persistence:
config:
enabled: true
type: configMap
name: cloudflare-ddns-configmap
subPath: cloudflare-ddns.sh
mountPath: /app/cloudflare-ddns.sh
defaultMode: 0775
readOnly: true
Loaded 100 of 163 files, more files were not shown because too many files have changed in this diff. Show more