From 5d3d8bdc866205df79e711272d0e70f7bc0a5d75 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Wed, 29 Sep 2021 08:23:46 -0400 Subject: [PATCH] feat: manage lifecycle of kube-vip with flux Signed-off-by: Devin Buhl --- .envrc | 2 + .../kube-system/kube-vip/kustomization.yaml | 5 ++ cluster/core/kube-system/kube-vip/rbac.yaml | 33 +++++++++++ cluster/core/kube-system/kustomization.yaml | 4 ++ cluster/core/kustomization.yaml | 3 +- configure.sh | 6 +- tmpl/cluster/kube-vip-daemonset.yaml | 57 +++++++++++++++++++ 7 files changed, 107 insertions(+), 3 deletions(-) create mode 100644 cluster/core/kube-system/kube-vip/kustomization.yaml create mode 100644 cluster/core/kube-system/kube-vip/rbac.yaml create mode 100644 cluster/core/kube-system/kustomization.yaml create mode 100644 tmpl/cluster/kube-vip-daemonset.yaml diff --git a/.envrc b/.envrc index c6936b0e..e57ccc2f 100644 --- a/.envrc +++ b/.envrc @@ -1,2 +1,4 @@ #shellcheck disable=SC2148,SC2155 export KUBECONFIG=$(expand_path ./kubeconfig) +export ANSIBLE_CONFIG=$(expand_path ./ansible.cfg) +export GPG_TTY=$(tty) diff --git a/cluster/core/kube-system/kube-vip/kustomization.yaml b/cluster/core/kube-system/kube-vip/kustomization.yaml new file mode 100644 index 00000000..e6255de2 --- /dev/null +++ b/cluster/core/kube-system/kube-vip/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - rbac.yaml + - daemon-set.yaml diff --git a/cluster/core/kube-system/kube-vip/rbac.yaml b/cluster/core/kube-system/kube-vip/rbac.yaml new file mode 100644 index 00000000..72f6fda8 --- /dev/null +++ b/cluster/core/kube-system/kube-vip/rbac.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kube-vip + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + rbac.authorization.kubernetes.io/autoupdate: "true" + name: system:kube-vip-role +rules: + - apiGroups: [""] + resources: ["services", "services/status", "nodes"] + verbs: ["list", "get", "watch", "update"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["list", "get", "watch", "update", "create"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: system:kube-vip-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:kube-vip-role +subjects: +- kind: ServiceAccount + name: kube-vip + namespace: kube-system diff --git a/cluster/core/kube-system/kustomization.yaml b/cluster/core/kube-system/kustomization.yaml new file mode 100644 index 00000000..65ea8bdc --- /dev/null +++ b/cluster/core/kube-system/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - kube-vip diff --git a/cluster/core/kustomization.yaml b/cluster/core/kustomization.yaml index 0128d9c8..41fcb045 100644 --- a/cluster/core/kustomization.yaml +++ b/cluster/core/kustomization.yaml @@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - namespaces - - metallb-system - cert-manager + - kube-system + - metallb-system - system-upgrade diff --git a/configure.sh b/configure.sh index 14754fb6..c0403d5b 100755 --- a/configure.sh +++ b/configure.sh @@ -40,12 +40,14 @@ main() { envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \ > "${PROJECT_DIR}/.sops.yaml" # cluster - envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \ - > "${PROJECT_DIR}/cluster/base/cluster-secrets.sops.yaml" envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-settings.yaml" \ > "${PROJECT_DIR}/cluster/base/cluster-settings.yaml" envsubst < "${PROJECT_DIR}/tmpl/cluster/gotk-sync.yaml" \ > "${PROJECT_DIR}/cluster/base/flux-system/gotk-sync.yaml" + envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \ + > "${PROJECT_DIR}/cluster/core/kube-system/kube-vip/daemon-set.yaml" + envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \ + > "${PROJECT_DIR}/cluster/base/cluster-secrets.sops.yaml" envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \ > "${PROJECT_DIR}/cluster/core/cert-manager/secret.sops.yaml" sops --encrypt --in-place "${PROJECT_DIR}/cluster/base/cluster-secrets.sops.yaml" diff --git a/tmpl/cluster/kube-vip-daemonset.yaml b/tmpl/cluster/kube-vip-daemonset.yaml new file mode 100644 index 00000000..16ea38cc --- /dev/null +++ b/tmpl/cluster/kube-vip-daemonset.yaml @@ -0,0 +1,57 @@ +--- +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: kube-vip + namespace: kube-system + labels: + app.kubernetes.io/instance: kube-vip + app.kubernetes.io/name: kube-vip +spec: + selector: + matchLabels: + app.kubernetes.io/instance: kube-vip + app.kubernetes.io/name: kube-vip + template: + metadata: + labels: + app.kubernetes.io/instance: kube-vip + app.kubernetes.io/name: kube-vip + spec: + containers: + - name: kube-vip + image: ghcr.io/kube-vip/kube-vip:v0.3.8 + imagePullPolicy: IfNotPresent + args: + - manager + env: + - name: vip_arp + value: "true" + - name: vip_interface + value: "${BOOTSTRAP_ANSIBLE_KUBE_VIP_INTERFACE}" + - name: port + value: "6443" + - name: vip_cidr + value: "32" + - name: cp_enable + value: "true" + - name: cp_namespace + value: kube-system + - name: svc_enable + value: "false" + - name: vip_address + value: "${BOOTSTRAP_ANSIBLE_KUBE_VIP_ADDRESS}" + securityContext: + capabilities: + add: + - NET_ADMIN + - NET_RAW + - SYS_TIME + hostNetwork: true + nodeSelector: + node-role.kubernetes.io/master: "true" + serviceAccountName: kube-vip + tolerations: + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule