diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index b7fa73a6..20705b23 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,5 @@ blank_issues_enabled: false contact_links: -- name: Discuss on Discord - url: https://discord.com/invite/sTMX7Vh - about: Join our Discord community + - name: Discuss on Discord + url: https://discord.com/invite/sTMX7Vh + about: Join our Discord community diff --git a/.github/lint/.markdownlint.yaml b/.github/lint/.markdownlint.yaml new file mode 100644 index 00000000..3443fa75 --- /dev/null +++ b/.github/lint/.markdownlint.yaml @@ -0,0 +1,23 @@ +--- +default: true + +# MD013/line-length - Line length +MD013: + # Number of characters + line_length: 240 + # Number of characters for headings + heading_line_length: 80 + # Number of characters for code blocks + code_block_line_length: 80 + # Include code blocks + code_blocks: true + # Include tables + tables: true + # Include headings + headings: true + # Include headings + headers: true + # Strict length checking + strict: false + # Stern length checking + stern: false diff --git a/.github/lint/.prettierignore b/.github/lint/.prettierignore new file mode 100644 index 00000000..b53e9445 --- /dev/null +++ b/.github/lint/.prettierignore @@ -0,0 +1,2 @@ +*.sops.yaml +gotk-components.yaml diff --git a/.github/lint/.prettierrc.yaml b/.github/lint/.prettierrc.yaml new file mode 100644 index 00000000..e30d9f99 --- /dev/null +++ b/.github/lint/.prettierrc.yaml @@ -0,0 +1,5 @@ +--- +trailingComma: "es5" +tabWidth: 2 +semi: false +singleQuote: false diff --git a/.github/yamllint.config.yaml b/.github/lint/.yamllint.yaml similarity index 63% rename from .github/yamllint.config.yaml rename to .github/lint/.yamllint.yaml index 8d131eda..67b6e038 100644 --- a/.github/yamllint.config.yaml +++ b/.github/lint/.yamllint.yaml @@ -1,10 +1,10 @@ ignore: | - .github/ - crds.yaml + *.sops.yaml + gotk-components.yaml extends: default rules: truthy: - allowed-values: ['true', 'false', 'on', 'yes'] + allowed-values: ["true", "false", "on"] comments: min-spaces-from-content: 1 line-length: disable @@ -14,6 +14,4 @@ rules: brackets: min-spaces-inside: 0 max-spaces-inside: 0 - indentation: - spaces: 2 - indent-sequences: consistent + indentation: enable diff --git a/.github/workflows/flux-schedule.yaml b/.github/workflows/flux-schedule.yaml index 1fc4b8ac..94fbc0f6 100644 --- a/.github/workflows/flux-schedule.yaml +++ b/.github/workflows/flux-schedule.yaml @@ -1,44 +1,43 @@ --- - name: Schedule - Update Flux on: # yamllint disable-line rule:truthy workflow_dispatch: schedule: - - cron: '0 12 * * *' + - cron: "0 12 * * *" jobs: flux-upgrade: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 - with: - fetch-depth: 1 + - uses: actions/checkout@v2 + with: + fetch-depth: 1 - - name: Setup Flux CLI - uses: fluxcd/flux2/action@main + - name: Setup Flux CLI + uses: fluxcd/flux2/action@main - - name: Upgrade Flux - id: upgrade - run: | - CLI_VERSION="$(flux -v)" - VERSION="v${CLI_VERSION#*flux version }" - flux install --version="${VERSION}" \ - --network-policy=false \ - --export > ./cluster/base/flux-system/gotk-components.yaml - echo "::set-output name=flux_version::$VERSION" + - name: Upgrade Flux + id: upgrade + run: | + CLI_VERSION="$(flux -v)" + VERSION="v${CLI_VERSION#*flux version }" + flux install --version="${VERSION}" \ + --network-policy=false \ + --export > ./cluster/base/flux-system/gotk-components.yaml + echo "::set-output name=flux_version::$VERSION" - - name: Create pull request for Flux upgrade - uses: peter-evans/create-pull-request@v3 - with: - token: ${{ secrets.GITHUB_TOKEN }} - branch: "flux/upgrade-${{ steps.upgrade.outputs.flux_version }}" - delete-branch: true - title: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}" - signoff: false - committer: GitHub - author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com> - commit-message: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}" - body: | - Release notes: https://github.com/fluxcd/flux2/releases/tag/${{ steps.upgrade.outputs.flux_version }} - labels: flux/upgrade + - name: Create pull request for Flux upgrade + uses: peter-evans/create-pull-request@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: "flux/upgrade-${{ steps.upgrade.outputs.flux_version }}" + delete-branch: true + title: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}" + signoff: false + committer: GitHub + author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com> + commit-message: "chore(deps): upgrade flux components to ${{ steps.upgrade.outputs.flux_version }}" + body: | + Release notes: https://github.com/fluxcd/flux2/releases/tag/${{ steps.upgrade.outputs.flux_version }} + labels: flux/upgrade diff --git a/.github/workflows/invalid-template.yaml b/.github/workflows/invalid-template.yaml index ba17f3d4..35174316 100644 --- a/.github/workflows/invalid-template.yaml +++ b/.github/workflows/invalid-template.yaml @@ -1,24 +1,23 @@ --- - name: Invalid Template on: issues: types: - - labeled - - unlabeled - - reopened + - labeled + - unlabeled + - reopened jobs: support: runs-on: ubuntu-20.04 steps: - - uses: dessant/support-requests@v2 - with: - github-token: ${{ github.token }} - support-label: 'template-incomplete' - issue-comment: > - :wave: @{issue-author}, please follow the template provided. - close-issue: true - lock-issue: true - issue-lock-reason: 'resolved' + - uses: dessant/support-requests@v2 + with: + github-token: ${{ github.token }} + support-label: "template-incomplete" + issue-comment: > + :wave: @{issue-author}, please follow the template provided. + close-issue: true + lock-issue: true + issue-lock-reason: "resolved" diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 97546a1b..a655171b 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -1,19 +1,32 @@ --- - name: Lint on: # yamllint disable-line rule:truthy - workflow_dispatch: pull_request: jobs: - yaml: + yamllint: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 - - name: yamllint - uses: reviewdog/action-yamllint@v1 - with: - github_token: ${{ secrets.github_token }} - reporter: github-pr-review - yamllint_flags: '-c .github/yamllint.config.yaml ./cluster/' + - uses: actions/checkout@v2 + - name: yamllint + uses: reviewdog/action-yamllint@v1 + with: + yamllint_flags: "-c .github/lint/.yamllint.yaml ./cluster" + shellcheck: + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@v2 + - name: shellcheck + uses: reviewdog/action-shellcheck@v1 + with: + path: "./hack" + level: "error" + markdownlint: + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@v2 + - name: markdownlint + uses: reviewdog/action-markdownlint@v0.2 + with: + github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/renovate-schedule.yaml b/.github/workflows/renovate-schedule.yaml index ae1e40f7..7edc5020 100644 --- a/.github/workflows/renovate-schedule.yaml +++ b/.github/workflows/renovate-schedule.yaml @@ -1,38 +1,36 @@ - --- - name: Schedule - Renovate Helm Releases on: # yamllint disable-line rule:truthy workflow_dispatch: schedule: - - cron: '0 */12 * * *' + - cron: "0 */12 * * *" jobs: renovate-helm-releases: runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 - with: - token: ${{ secrets.GITHUB_TOKEN }} - fetch-depth: 1 + - uses: actions/checkout@v2 + with: + token: ${{ secrets.GITHUB_TOKEN }} + fetch-depth: 1 - - name: Renovate Helm Releases - uses: k8s-at-home/renovate-helm-releases@v1 - with: - cluster-path: "./cluster" + - name: Renovate Helm Releases + uses: k8s-at-home/renovate-helm-releases@v1 + with: + cluster-path: "./cluster" - - name: Create pull request for renovatebot helm-release annotations - uses: peter-evans/create-pull-request@v3 - with: - token: ${{ secrets.GITHUB_TOKEN }} - branch: renovate-annotations - delete-branch: true - title: "chore(deps): update renovate annotations" - signoff: false - committer: GitHub - author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com> - commit-message: "chore(deps): update renovate annotations" - body: | - Update HelmReleases inorder for Renovate to pick up new versions of Helm charts - labels: renovate/annotations + - name: Create pull request for renovatebot helm-release annotations + uses: peter-evans/create-pull-request@v3 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: renovate-annotations + delete-branch: true + title: "chore(deps): update renovate annotations" + signoff: false + committer: GitHub + author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com> + commit-message: "chore(deps): update renovate annotations" + body: | + Update HelmReleases inorder for Renovate to pick up new versions of Helm charts + labels: renovate/annotations diff --git a/.github/workflows/support.yaml b/.github/workflows/support.yaml index 3730f8fd..223a9367 100644 --- a/.github/workflows/support.yaml +++ b/.github/workflows/support.yaml @@ -1,28 +1,27 @@ --- - -name: 'Support requests' +name: "Support requests" on: issues: types: - - labeled - - unlabeled - - reopened + - labeled + - unlabeled + - reopened jobs: support: runs-on: ubuntu-20.04 steps: - - uses: dessant/support-requests@v2 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - support-label: 'support' - issue-comment: > - :wave: @{issue-author}, we use the issue tracker exclusively - for bug reports and feature requests. However, this issue appears - to be a support request. Please use our support channels - to get help with. - - [Discord](https://discord.gg/sTMX7Vh) - close-issue: true - lock-issue: false - issue-lock-reason: 'off-topic' + - uses: dessant/support-requests@v2 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + support-label: "support" + issue-comment: > + :wave: @{issue-author}, we use the issue tracker exclusively + for bug reports and feature requests. However, this issue appears + to be a support request. Please use our support channels + to get help with. + - [Discord](https://discord.gg/sTMX7Vh) + close-issue: true + lock-issue: false + issue-lock-reason: "off-topic" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 897a0e0d..ca9f7ad8 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,28 +1,29 @@ +--- fail_fast: false repos: -- repo: https://github.com/adrienverge/yamllint - rev: v1.26.2 - hooks: - - args: - - -c - - .github/yamllint.config.yaml - id: yamllint -- repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.0.1 - hooks: - - id: trailing-whitespace - - id: end-of-file-fixer - - id: mixed-line-ending -- repo: https://github.com/Lucas-C/pre-commit-hooks - rev: v1.1.10 - hooks: - - id: remove-crlf - - id: remove-tabs -- repo: https://github.com/sirosen/fix-smartquotes - rev: 0.2.0 - hooks: - - id: fix-smartquotes -- repo: https://github.com/k8s-at-home/sops-pre-commit - rev: v2.0.3 - hooks: - - id: forbid-secrets + - repo: https://github.com/adrienverge/yamllint + rev: v1.26.2 + hooks: + - args: + - --config-file + - .github/lint/.yamllint.yaml + id: yamllint + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.0.1 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: mixed-line-ending + - repo: https://github.com/Lucas-C/pre-commit-hooks + rev: v1.1.10 + hooks: + - id: remove-crlf + - id: remove-tabs + - repo: https://github.com/sirosen/fix-smartquotes + rev: 0.2.0 + hooks: + - id: fix-smartquotes + - repo: https://github.com/k8s-at-home/sops-pre-commit + rev: v2.0.3 + hooks: + - id: forbid-secrets diff --git a/.taskfiles/flux.yml b/.taskfiles/flux.yml new file mode 100644 index 00000000..a6fec400 --- /dev/null +++ b/.taskfiles/flux.yml @@ -0,0 +1,9 @@ +--- +version: "3" + +tasks: + sync: + desc: Sync flux-system with the Git Repository + cmds: + - flux reconcile source git flux-system + silent: true diff --git a/.taskfiles/format.yml b/.taskfiles/format.yml new file mode 100644 index 00000000..0689f818 --- /dev/null +++ b/.taskfiles/format.yml @@ -0,0 +1,33 @@ +--- +version: "3" + +tasks: + all: + - task: markdown + - task: yaml + markdown: + desc: Format Markdown + cmds: + - >- + prettier + --ignore-path '.github/lint/.prettierignore' + --config '.github/lint/.prettierrc.yaml' + --list-different + --ignore-unknown + --parser=markdown + --write '*.md' '**/*.md' + ignore_error: true + yaml: + desc: Format YAML + cmds: + - >- + prettier + --ignore-path '.github/lint/.prettierignore' + --config + '.github/lint/.prettierrc.yaml' + --list-different + --ignore-unknown + --parser=yaml + --write '*.y*ml' + '**/*.y*ml' + ignore_error: true diff --git a/.taskfiles/lint.yml b/.taskfiles/lint.yml new file mode 100644 index 00000000..c949d447 --- /dev/null +++ b/.taskfiles/lint.yml @@ -0,0 +1,26 @@ +--- +version: "3" + +tasks: + all: + - task: markdown + - task: yaml + - task: format + + markdown: + desc: Lint Markdown + cmds: + - markdownlint -c '.github/lint/.markdownlint.yaml' *.md **/*.md + ignore_errors: true + + yaml: + desc: Lint YAML + cmds: + - yamllint -c '.github/lint/.yamllint.yaml' . + ignore_errors: true + + format: + desc: Lint general formatting + cmds: + - prettier --ignore-path '.github/lint/.prettierignore' --config '.github/lint/.prettierrc.yaml' --check . + ignore_errors: true diff --git a/.taskfiles/pre-commit.yml b/.taskfiles/pre-commit.yml new file mode 100644 index 00000000..ecf06276 --- /dev/null +++ b/.taskfiles/pre-commit.yml @@ -0,0 +1,12 @@ +--- +version: "3" + +tasks: + init: + desc: Initialize pre-commit hooks + cmds: + - pre-commit install-hooks + run: + desc: Run pre-commit + cmds: + - pre-commit run --all-files diff --git a/README.md b/README.md index f0c74511..8a3d451e 100644 --- a/README.md +++ b/README.md @@ -50,6 +50,8 @@ Already provisioned Bare metal or VMs with any modern operating system like Ubun | [pre-commit](https://github.com/pre-commit/pre-commit) | Runs checks during `git commit` | `2.12.0` | ❌ | | [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | | [helm](https://helm.sh/) | Manage Kubernetes applications | `3.5.4` | ❌ | +| [go-task](https://github.com/go-task/task) | A task runner / simpler Make alternative written in Go | `3.7.0` | ❌ | +| [prettier](https://github.com/prettier/prettier) | Prettier is an opinionated code formatter. | `2.3.2` | ❌ | ### :warning:  pre-commit @@ -252,23 +254,23 @@ export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10" ```sh envsubst < ./tmpl/.sops.yaml > ./.sops.yaml -envsubst < ./tmpl/cluster-secrets.yaml > ./cluster/base/cluster-secrets.yaml +envsubst < ./tmpl/cluster-secrets.sops.yaml > ./cluster/base/cluster-secrets.sops.yaml envsubst < ./tmpl/cluster-settings.yaml > ./cluster/base/cluster-settings.yaml envsubst < ./tmpl/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml -envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/cert-manager/secret.enc.yaml +envsubst < ./tmpl/secret.sops.yaml > ./cluster/core/cert-manager/secret.sops.yaml ``` 6. **Verify** all the above files have the correct information present -7. Encrypt `cluster/cluster-secrets.yaml` and `cert-manager/secret.enc.yaml` with SOPS +7. Encrypt `cluster/cluster-secrets.sops.yaml` and `cert-manager/secret.sops.yaml` with SOPS ```sh export GPG_TTY=$(tty) -sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml -sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml +sops --encrypt --in-place ./cluster/base/cluster-secrets.sops.yaml +sops --encrypt --in-place ./cluster/core/cert-manager/secret.sops.yaml ``` -:round_pushpin: Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster` +:round_pushpin: Variables defined in `cluster-secrets.sops.yaml` and `cluster-settings.sops.yaml` will be usable anywhere in your YAML manifests under `./cluster` 8. **Verify** all the above files are **encrypted** with SOPS diff --git a/Taskfile.yml b/Taskfile.yml new file mode 100644 index 00000000..700f9f85 --- /dev/null +++ b/Taskfile.yml @@ -0,0 +1,16 @@ +--- +version: "3" + +vars: + PROJECT_DIR: + sh: "git rev-parse --show-toplevel" + CLUSTER_DIR: "{{.PROJECT_DIR}}/cluster" + +env: + KUBECONFIG: "{{.PROJECT_DIR}}/kubeconfig" + +includes: + flux: .taskfiles/flux.yml + format: .taskfiles/format.yml + lint: .taskfiles/lint.yml + pre-commit: .taskfiles/pre-commit.yml diff --git a/cluster/apps/default/homer/config-pvc.yaml b/cluster/apps/default/homer/config-pvc.yaml index 90321318..d3c87293 100644 --- a/cluster/apps/default/homer/config-pvc.yaml +++ b/cluster/apps/default/homer/config-pvc.yaml @@ -5,7 +5,7 @@ metadata: name: homer-config spec: accessModes: - - ReadWriteOnce + - ReadWriteOnce storageClassName: local-path resources: requests: diff --git a/cluster/apps/default/homer/helm-release.yaml b/cluster/apps/default/homer/helm-release.yaml index 8d2a3cb4..1c797352 100644 --- a/cluster/apps/default/homer/helm-release.yaml +++ b/cluster/apps/default/homer/helm-release.yaml @@ -26,13 +26,13 @@ spec: annotations: kubernetes.io/ingress.class: "nginx" hosts: - - host: "homer.${SECRET_DOMAIN}" - paths: - - path: / - pathType: Prefix + - host: "homer.${SECRET_DOMAIN}" + paths: + - path: / + pathType: Prefix tls: - - hosts: - - "homer.${SECRET_DOMAIN}" + - hosts: + - "homer.${SECRET_DOMAIN}" persistence: config: enabled: true diff --git a/cluster/apps/default/homer/kustomization.yaml b/cluster/apps/default/homer/kustomization.yaml index 97b3a7ee..d443f6cb 100644 --- a/cluster/apps/default/homer/kustomization.yaml +++ b/cluster/apps/default/homer/kustomization.yaml @@ -1,5 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- config-pvc.yaml -- helm-release.yaml + - config-pvc.yaml + - helm-release.yaml diff --git a/cluster/apps/default/kustomization.yaml b/cluster/apps/default/kustomization.yaml index 4c95e6b9..7ade7d26 100644 --- a/cluster/apps/default/kustomization.yaml +++ b/cluster/apps/default/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- homer + - homer diff --git a/cluster/apps/kustomization.yaml b/cluster/apps/kustomization.yaml index ea92692c..df6e956b 100644 --- a/cluster/apps/kustomization.yaml +++ b/cluster/apps/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- default -- networking -- system-upgrade + - default + - networking + - system-upgrade diff --git a/cluster/apps/networking/ingress-nginx/kustomization.yaml b/cluster/apps/networking/ingress-nginx/kustomization.yaml index 761d2252..34a8531c 100644 --- a/cluster/apps/networking/ingress-nginx/kustomization.yaml +++ b/cluster/apps/networking/ingress-nginx/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- helm-release.yaml + - helm-release.yaml diff --git a/cluster/apps/networking/kustomization.yaml b/cluster/apps/networking/kustomization.yaml index 6bd05c16..42673cf9 100644 --- a/cluster/apps/networking/kustomization.yaml +++ b/cluster/apps/networking/kustomization.yaml @@ -1,5 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- ingress-nginx -- wildcard-certificate + - ingress-nginx + - wildcard-certificate diff --git a/cluster/apps/networking/wildcard-certificate/certificate.yaml b/cluster/apps/networking/wildcard-certificate/certificate.yaml index 9b04a327..b877fa09 100644 --- a/cluster/apps/networking/wildcard-certificate/certificate.yaml +++ b/cluster/apps/networking/wildcard-certificate/certificate.yaml @@ -11,5 +11,5 @@ spec: kind: ClusterIssuer commonName: "${SECRET_DOMAIN}" dnsNames: - - "${SECRET_DOMAIN}" - - "*.${SECRET_DOMAIN}" + - "${SECRET_DOMAIN}" + - "*.${SECRET_DOMAIN}" diff --git a/cluster/apps/networking/wildcard-certificate/kustomization.yaml b/cluster/apps/networking/wildcard-certificate/kustomization.yaml index f1aec46e..1615af25 100644 --- a/cluster/apps/networking/wildcard-certificate/kustomization.yaml +++ b/cluster/apps/networking/wildcard-certificate/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- certificate.yaml \ No newline at end of file + - certificate.yaml diff --git a/cluster/apps/system-upgrade/kustomization.yaml b/cluster/apps/system-upgrade/kustomization.yaml index 89b664d9..6e6a74c0 100644 --- a/cluster/apps/system-upgrade/kustomization.yaml +++ b/cluster/apps/system-upgrade/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- system-upgrade-controller + - system-upgrade-controller diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/agent-plan.yaml b/cluster/apps/system-upgrade/system-upgrade-controller/agent-plan.yaml index 1fe4e33c..30cd46a0 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/agent-plan.yaml +++ b/cluster/apps/system-upgrade/system-upgrade-controller/agent-plan.yaml @@ -12,14 +12,14 @@ spec: channel: https://update.k3s.io/v1-release/channels/v1.20 nodeSelector: matchExpressions: - - key: node-role.kubernetes.io/master - operator: NotIn - values: - - "true" + - key: node-role.kubernetes.io/master + operator: NotIn + values: + - "true" prepare: image: rancher/k3s-upgrade args: - - "prepare" - - "k3s-server" + - "prepare" + - "k3s-server" upgrade: image: rancher/k3s-upgrade diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml b/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml index 10fbf1e8..d553eada 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml +++ b/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml @@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- server-plan.yaml -- agent-plan.yaml + - server-plan.yaml + - agent-plan.yaml diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/server-plan.yaml b/cluster/apps/system-upgrade/system-upgrade-controller/server-plan.yaml index a71f8954..640f4656 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/server-plan.yaml +++ b/cluster/apps/system-upgrade/system-upgrade-controller/server-plan.yaml @@ -11,12 +11,12 @@ spec: cordon: true nodeSelector: matchExpressions: - - key: node-role.kubernetes.io/master - operator: In - values: - - "true" + - key: node-role.kubernetes.io/master + operator: In + values: + - "true" tolerations: - - key: "node-role.kubernetes.io/master" - operator: "Exists" + - key: "node-role.kubernetes.io/master" + operator: "Exists" upgrade: image: rancher/k3s-upgrade diff --git a/cluster/base/apps.yaml b/cluster/base/apps.yaml index fc291d51..d0ea7ada 100644 --- a/cluster/base/apps.yaml +++ b/cluster/base/apps.yaml @@ -7,7 +7,7 @@ metadata: spec: interval: 10m0s dependsOn: - - name: core + - name: core path: ./cluster/apps prune: true sourceRef: @@ -20,7 +20,7 @@ spec: postBuild: substitute: {} substituteFrom: - - kind: ConfigMap - name: cluster-settings - - kind: Secret - name: cluster-secrets + - kind: ConfigMap + name: cluster-settings + - kind: Secret + name: cluster-secrets diff --git a/cluster/base/core.yaml b/cluster/base/core.yaml index 82b43223..22a98a6a 100644 --- a/cluster/base/core.yaml +++ b/cluster/base/core.yaml @@ -7,7 +7,7 @@ metadata: spec: interval: 10m0s dependsOn: - - name: crds + - name: crds path: ./cluster/core prune: false sourceRef: @@ -20,7 +20,7 @@ spec: postBuild: substitute: {} substituteFrom: - - kind: ConfigMap - name: cluster-settings - - kind: Secret - name: cluster-secrets + - kind: ConfigMap + name: cluster-settings + - kind: Secret + name: cluster-secrets diff --git a/cluster/base/flux-system/charts/helm/kustomization.yaml b/cluster/base/flux-system/charts/helm/kustomization.yaml index edcf5395..a48c9d82 100644 --- a/cluster/base/flux-system/charts/helm/kustomization.yaml +++ b/cluster/base/flux-system/charts/helm/kustomization.yaml @@ -1,8 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- bitnami-charts.yaml -- ingress-nginx-charts.yaml -- jetstack-charts.yaml -- k8s-at-home-charts.yaml -- metallb-charts.yaml + - bitnami-charts.yaml + - ingress-nginx-charts.yaml + - jetstack-charts.yaml + - k8s-at-home-charts.yaml + - metallb-charts.yaml diff --git a/cluster/base/flux-system/charts/kustomization.yaml b/cluster/base/flux-system/charts/kustomization.yaml index 03a36f75..0a03f298 100644 --- a/cluster/base/flux-system/charts/kustomization.yaml +++ b/cluster/base/flux-system/charts/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- helm + - helm diff --git a/cluster/base/flux-system/kustomization.yaml b/cluster/base/flux-system/kustomization.yaml index 2974f2db..3b407e72 100644 --- a/cluster/base/flux-system/kustomization.yaml +++ b/cluster/base/flux-system/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- gotk-components.yaml -- gotk-sync.yaml -- charts + - gotk-components.yaml + - gotk-sync.yaml + - charts diff --git a/cluster/core/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml index b77e097d..8597737b 100644 --- a/cluster/core/cert-manager/helm-release.yaml +++ b/cluster/core/cert-manager/helm-release.yaml @@ -20,12 +20,12 @@ spec: webhook: enabled: true extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53 - - --dns01-recursive-nameservers-only + - --dns01-recursive-nameservers=1.1.1.1:53 + - --dns01-recursive-nameservers-only cainjector: replicaCount: 1 podDnsPolicy: "None" podDnsConfig: nameservers: - - "1.1.1.1" - - "8.8.8.8" + - "1.1.1.1" + - "8.8.8.8" diff --git a/cluster/core/cert-manager/kustomization.yaml b/cluster/core/cert-manager/kustomization.yaml index 0231f584..2a0a531f 100644 --- a/cluster/core/cert-manager/kustomization.yaml +++ b/cluster/core/cert-manager/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- helm-release.yaml -- letsencrypt-production.yaml -- letsencrypt-staging.yaml -- secret.enc.yaml + - helm-release.yaml + - letsencrypt-production.yaml + - letsencrypt-staging.yaml + - secret.enc.yaml diff --git a/cluster/core/cert-manager/letsencrypt-production.yaml b/cluster/core/cert-manager/letsencrypt-production.yaml index 943854df..a41666ca 100644 --- a/cluster/core/cert-manager/letsencrypt-production.yaml +++ b/cluster/core/cert-manager/letsencrypt-production.yaml @@ -10,9 +10,9 @@ spec: privateKeySecretRef: name: letsencrypt-production solvers: - - dns01: - cloudflare: - email: "${SECRET_CLOUDFLARE_EMAIL}" - apiTokenSecretRef: - name: cloudflare-token-secret - key: cloudflare-token + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiTokenSecretRef: + name: cloudflare-token-secret + key: cloudflare-token diff --git a/cluster/core/cert-manager/letsencrypt-staging.yaml b/cluster/core/cert-manager/letsencrypt-staging.yaml index 8e074534..e7ceb8f2 100644 --- a/cluster/core/cert-manager/letsencrypt-staging.yaml +++ b/cluster/core/cert-manager/letsencrypt-staging.yaml @@ -10,9 +10,9 @@ spec: privateKeySecretRef: name: letsencrypt-staging solvers: - - dns01: - cloudflare: - email: "${SECRET_CLOUDFLARE_EMAIL}" - apiTokenSecretRef: - name: cloudflare-token-secret - key: cloudflare-token + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiTokenSecretRef: + name: cloudflare-token-secret + key: cloudflare-token diff --git a/cluster/core/cert-manager/secret.enc.yaml b/cluster/core/cert-manager/secret.enc.yaml index 6308663c..11e96053 100644 --- a/cluster/core/cert-manager/secret.enc.yaml +++ b/cluster/core/cert-manager/secret.enc.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Secret metadata: - name: cloudflare-token-secret - namespace: cert-manager + name: cloudflare-token-secret + namespace: cert-manager stringData: - cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN} + cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN} diff --git a/cluster/core/kustomization.yaml b/cluster/core/kustomization.yaml index 2ab2707b..0128d9c8 100644 --- a/cluster/core/kustomization.yaml +++ b/cluster/core/kustomization.yaml @@ -1,7 +1,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- namespaces -- metallb-system -- cert-manager -- system-upgrade + - namespaces + - metallb-system + - cert-manager + - system-upgrade diff --git a/cluster/core/metallb-system/helm-release.yaml b/cluster/core/metallb-system/helm-release.yaml index 892fbed1..a7e3ce70 100644 --- a/cluster/core/metallb-system/helm-release.yaml +++ b/cluster/core/metallb-system/helm-release.yaml @@ -18,7 +18,7 @@ spec: values: configInline: address-pools: - - name: default - protocol: layer2 - addresses: - - "${METALLB_LB_RANGE}" + - name: default + protocol: layer2 + addresses: + - "${METALLB_LB_RANGE}" diff --git a/cluster/core/metallb-system/kustomization.yaml b/cluster/core/metallb-system/kustomization.yaml index 761d2252..34a8531c 100644 --- a/cluster/core/metallb-system/kustomization.yaml +++ b/cluster/core/metallb-system/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- helm-release.yaml + - helm-release.yaml diff --git a/cluster/core/namespaces/kustomization.yaml b/cluster/core/namespaces/kustomization.yaml index 02b8b713..18a171a9 100644 --- a/cluster/core/namespaces/kustomization.yaml +++ b/cluster/core/namespaces/kustomization.yaml @@ -1,6 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- cert-manager.yaml -- metallb-system.yaml -- networking.yaml + - cert-manager.yaml + - metallb-system.yaml + - networking.yaml diff --git a/cluster/core/system-upgrade/kustomization.yaml b/cluster/core/system-upgrade/kustomization.yaml index 2cde97c1..c7d47066 100644 --- a/cluster/core/system-upgrade/kustomization.yaml +++ b/cluster/core/system-upgrade/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: system-upgrade resources: -- https://github.com/rancher/system-upgrade-controller/releases/download/v0.6.2/system-upgrade-controller.yaml + - https://github.com/rancher/system-upgrade-controller/releases/download/v0.6.2/system-upgrade-controller.yaml diff --git a/cluster/crds/cert-manager/kustomization.yaml b/cluster/crds/cert-manager/kustomization.yaml index 7cd5a1ab..ae485a4d 100644 --- a/cluster/crds/cert-manager/kustomization.yaml +++ b/cluster/crds/cert-manager/kustomization.yaml @@ -1,5 +1,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -# renovate: registryUrl=https://charts.jetstack.io chart=cert-manager -- https://github.com/jetstack/cert-manager/releases/download/v1.4.2/cert-manager.crds.yaml + # renovate: registryUrl=https://charts.jetstack.io chart=cert-manager + - https://github.com/jetstack/cert-manager/releases/download/v1.4.2/cert-manager.crds.yaml diff --git a/cluster/crds/kustomization.yaml b/cluster/crds/kustomization.yaml index 75b65cfc..2a2317b5 100644 --- a/cluster/crds/kustomization.yaml +++ b/cluster/crds/kustomization.yaml @@ -1,4 +1,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- cert-manager + - cert-manager diff --git a/tmpl/.sops.yaml b/tmpl/.sops.yaml index a2f3539e..4447bf44 100644 --- a/tmpl/.sops.yaml +++ b/tmpl/.sops.yaml @@ -1,6 +1,6 @@ --- creation_rules: -- encrypted_regex: '^(data|stringData)$' - pgp: >- - ${FLUX_KEY_FP}, - ${PERSONAL_KEY_FP} + - encrypted_regex: "^(data|stringData)$" + pgp: >- + ${FLUX_KEY_FP}, + ${PERSONAL_KEY_FP} diff --git a/tmpl/cluster-secrets.sops.yaml b/tmpl/cluster-secrets.sops.yaml new file mode 100644 index 00000000..6380718b --- /dev/null +++ b/tmpl/cluster-secrets.sops.yaml @@ -0,0 +1,9 @@ +# yamllint disable +apiVersion: v1 +kind: Secret +metadata: + name: cluster-secrets + namespace: flux-system +stringData: + SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN} + SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL} diff --git a/tmpl/cluster-secrets.yaml b/tmpl/cluster-secrets.yaml deleted file mode 100644 index d575681e..00000000 --- a/tmpl/cluster-secrets.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: cluster-secrets - namespace: flux-system -stringData: - SECRET_DOMAIN: ${BOOTSTRAP_DOMAIN} - SECRET_CLOUDFLARE_EMAIL: ${BOOTSTRAP_CLOUDFLARE_EMAIL} diff --git a/tmpl/gotk-sync.yaml b/tmpl/gotk-sync.yaml index 2ca506b0..275b7f77 100644 --- a/tmpl/gotk-sync.yaml +++ b/tmpl/gotk-sync.yaml @@ -26,4 +26,4 @@ spec: decryption: provider: sops secretRef: - name: sops-gpg \ No newline at end of file + name: sops-gpg diff --git a/tmpl/secret.enc.yaml b/tmpl/secret.enc.yaml deleted file mode 100644 index 6308663c..00000000 --- a/tmpl/secret.enc.yaml +++ /dev/null @@ -1,8 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: cloudflare-token-secret - namespace: cert-manager -stringData: - cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN} diff --git a/tmpl/secret.sops.yaml b/tmpl/secret.sops.yaml new file mode 100644 index 00000000..11e96053 --- /dev/null +++ b/tmpl/secret.sops.yaml @@ -0,0 +1,8 @@ +# yamllint disable +apiVersion: v1 +kind: Secret +metadata: + name: cloudflare-token-secret + namespace: cert-manager +stringData: + cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}