From 6a758ee101ccf7908b35939b949dee45ac5896c4 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 7 Jul 2022 09:51:41 -0400 Subject: [PATCH] feat!: replace traefik with nginx ingress (#388) * feat: remove traefik crds Signed-off-by: Devin Buhl * feat: change variable names in config sample env Signed-off-by: Devin Buhl * feat: change variable names in configure Signed-off-by: Devin Buhl * feat: change variable names in cluster-settings Signed-off-by: Devin Buhl * feat: change variable names in configure Signed-off-by: Devin Buhl * feat: change README.md to ingress-nginx Signed-off-by: Devin Buhl * feat: remove traefik helm release Signed-off-by: Devin Buhl * feat: remove traefik helm repo Signed-off-by: Devin Buhl * feat: remove error-pages Signed-off-by: Devin Buhl * feat: remove other traefik references Signed-off-by: Devin Buhl * feat: add ingress-nginx helm repo Signed-off-by: Devin Buhl * feat: add ingress-nginx helm release Signed-off-by: Devin Buhl --- .config.sample.env | 4 +- README.md | 6 +- .../default/echo-server/helm-release.yaml | 4 +- .../apps/default/hajimari/helm-release.yaml | 5 +- .../networking/error-pages/helm-release.yaml | 40 -------- .../networking/error-pages/ingress-route.yaml | 19 ---- .../networking/error-pages/kustomization.yaml | 6 -- .../cloudflare-proxied-networks.txt | 1 + .../ingress-nginx/helm-release.yaml | 84 ++++++++++++++++ .../ingress-nginx/kustomization.yaml | 12 +++ cluster/apps/networking/kustomization.yaml | 3 +- .../networking/traefik/dashboard/ingress.yaml | 30 ------ .../traefik/dashboard/kustomization.yaml | 5 - .../apps/networking/traefik/helm-release.yaml | 95 ------------------- .../networking/traefik/kustomization.yaml | 7 -- .../traefik/middlewares/cloudflare-only.yaml | 47 --------- .../traefik/middlewares/error-pages.yaml | 14 --- .../traefik/middlewares/internal-only.yaml | 22 ----- .../traefik/middlewares/kustomization.yaml | 7 -- .../{traefik.yaml => ingress-nginx.yaml} | 4 +- cluster/charts/kustomization.yaml | 2 +- cluster/crds/kustomization.yaml | 1 - cluster/crds/traefik/crds.yaml | 30 ------ cluster/crds/traefik/kustomization.yaml | 5 - configure | 22 ++--- .../inventory/group_vars/master/k3s.yml | 2 +- tmpl/cluster/cluster-settings.yaml | 2 +- .../flux-system/webhooks/github/ingress.yaml | 3 +- .../flux-system/webhooks/github/receiver.yaml | 5 - 29 files changed, 123 insertions(+), 364 deletions(-) delete mode 100644 cluster/apps/networking/error-pages/helm-release.yaml delete mode 100644 cluster/apps/networking/error-pages/ingress-route.yaml delete mode 100644 cluster/apps/networking/error-pages/kustomization.yaml create mode 100644 cluster/apps/networking/ingress-nginx/cloudflare-proxied-networks.txt create mode 100644 cluster/apps/networking/ingress-nginx/helm-release.yaml create mode 100644 cluster/apps/networking/ingress-nginx/kustomization.yaml delete mode 100644 cluster/apps/networking/traefik/dashboard/ingress.yaml delete mode 100644 cluster/apps/networking/traefik/dashboard/kustomization.yaml delete mode 100644 cluster/apps/networking/traefik/helm-release.yaml delete mode 100644 cluster/apps/networking/traefik/kustomization.yaml delete mode 100644 cluster/apps/networking/traefik/middlewares/cloudflare-only.yaml delete mode 100644 cluster/apps/networking/traefik/middlewares/error-pages.yaml delete mode 100644 cluster/apps/networking/traefik/middlewares/internal-only.yaml delete mode 100644 cluster/apps/networking/traefik/middlewares/kustomization.yaml rename cluster/charts/{traefik.yaml => ingress-nginx.yaml} (63%) delete mode 100644 cluster/crds/traefik/crds.yaml delete mode 100644 cluster/crds/traefik/kustomization.yaml diff --git a/.config.sample.env b/.config.sample.env index 71ff16bb..9fcea47b 100644 --- a/.config.sample.env +++ b/.config.sample.env @@ -27,10 +27,10 @@ export BOOTSTRAP_METALLB_LB_RANGE="" # The load balancer IP for k8s_gateway, choose from one of the available IPs above # e.g. 192.168.1.220 export BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR="" -# The load balancer IP for traefik, choose from one of the available IPs above +# The load balancer IP for the ingress controller, choose from one of the available IPs above # that doesn't conflict with any other IP addresses here # e.g. 192.168.1.221 -export BOOTSTRAP_METALLB_TRAEFIK_ADDR="" +export BOOTSTRAP_METALLB_INGRESS_ADDR="" # Age Public Key - string should start with age # e.g. age15uzrw396e67z9wdzsxzdk7ka0g2gr3l460e0slaea563zll3hdfqwqxdta diff --git a/README.md b/README.md index 44ee92c1..c6eb7c8c 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ The following components will be installed in your [k3s](https://k3s.io/) cluste - [calico](https://www.tigera.io/project-calico/) - Container networking interface for inter pod and service networking - [external-dns](https://github.com/kubernetes-sigs/external-dns) - Operator to publish DNS records to Cloudflare (and other providers) based on Kubernetes ingresses - [k8s_gateway](https://github.com/ori-edge/k8s_gateway) - DNS resolver that provides local DNS to your Kubernetes ingresses -- [traefik](https://traefik.io) - Kubernetes ingress controller used for a HTTP reverse proxy of Kubernetes ingresses +- [ingress-nginx](https://kubernetes.github.io/ingress-nginx/) - Kubernetes ingress controller used for a HTTP reverse proxy of Kubernetes ingresses - [local-path-provisioner](https://github.com/rancher/local-path-provisioner) - provision persistent local storage with Kubernetes _Additional applications include [hajimari](https://github.com/toboshii/hajimari), [error-pages](https://github.com/tarampampam/error-pages), [echo-server](https://github.com/Ealenn/Echo-Server), [system-upgrade-controller](https://github.com/rancher/system-upgrade-controller), [reflector](https://github.com/emberstack/kubernetes-reflector), [reloader](https://github.com/stakater/Reloader), and [kured](https://github.com/weaveworks/kured)_ @@ -384,11 +384,11 @@ task cluster:resources [k8s_gateway](https://github.com/ori-edge/k8s_gateway) is deployed on the IP choosen for `${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}`. Inorder to test DNS you can point your clients DNS to the `${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}` IP address and load `https://hajimari.${BOOTSTRAP_CLOUDFLARE_DOMAIN}` in your browser. -You can also try debugging with the command `dig`, e.g. `dig @${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR} hajimari.${BOOTSTRAP_CLOUDFLARE_DOMAIN}` and you should get a valid answer containing your `${BOOTSTRAP_METALLB_TRAEFIK_ADDR}` IP address. +You can also try debugging with the command `dig`, e.g. `dig @${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR} hajimari.${BOOTSTRAP_CLOUDFLARE_DOMAIN}` and you should get a valid answer containing your `${BOOTSTRAP_METALLB_INGRESS_ADDR}` IP address. If your router (or Pi-Hole, Adguard Home or whatever) supports conditional DNS forwarding (also know as split-horizon DNS) you may have DNS requests for `${SECRET_DOMAIN}` only point to the `${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}` IP address. This will ensure only DNS requests for `${SECRET_DOMAIN}` will only get routed to your [k8s_gateway](https://github.com/ori-edge/k8s_gateway) service thus providing DNS resolution to your cluster applications/ingresses. -To access services from the outside world port forwarded `80` and `443` in your router to the `${BOOTSTRAP_METALLB_TRAEFIK_ADDR}` IP, in a few moments head over to your browser and you _should_ be able to access `https://echo-server.${BOOTSTRAP_CLOUDFLARE_DOMAIN}` from a device outside your LAN. +To access services from the outside world port forwarded `80` and `443` in your router to the `${BOOTSTRAP_METALLB_INGRESS_ADDR}` IP, in a few moments head over to your browser and you _should_ be able to access `https://echo-server.${BOOTSTRAP_CLOUDFLARE_DOMAIN}` from a device outside your LAN. Now if nothing is working, that is expected. This is DNS after all! diff --git a/cluster/apps/default/echo-server/helm-release.yaml b/cluster/apps/default/echo-server/helm-release.yaml index 5510128c..9933a7b4 100644 --- a/cluster/apps/default/echo-server/helm-release.yaml +++ b/cluster/apps/default/echo-server/helm-release.yaml @@ -71,15 +71,13 @@ spec: ingress: main: enabled: true - ingressClassName: "traefik" + ingressClassName: "nginx" annotations: cert-manager.io/cluster-issuer: "letsencrypt-staging" external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" external-dns/is-public: "true" hajimari.io/enable: "true" hajimari.io/icon: "video-input-antenna" - traefik.ingress.kubernetes.io/router.entrypoints: "websecure" - traefik.ingress.kubernetes.io/router.middlewares: "networking-cloudflare-only@kubernetescrd" hosts: - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}" paths: diff --git a/cluster/apps/default/hajimari/helm-release.yaml b/cluster/apps/default/hajimari/helm-release.yaml index cc5ac396..97f65c9f 100644 --- a/cluster/apps/default/hajimari/helm-release.yaml +++ b/cluster/apps/default/hajimari/helm-release.yaml @@ -105,13 +105,12 @@ spec: ingress: main: enabled: true - ingressClassName: "traefik" + ingressClassName: "nginx" annotations: cert-manager.io/cluster-issuer: "letsencrypt-staging" hajimari.io/enable: "true" hajimari.io/icon: "weather-sunset" - traefik.ingress.kubernetes.io/router.entrypoints: "websecure" - traefik.ingress.kubernetes.io/router.middlewares: "networking-internal-only@kubernetescrd" + nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" hosts: - host: "hajimari.${SECRET_DOMAIN}" paths: diff --git a/cluster/apps/networking/error-pages/helm-release.yaml b/cluster/apps/networking/error-pages/helm-release.yaml deleted file mode 100644 index 2691ee7b..00000000 --- a/cluster/apps/networking/error-pages/helm-release.yaml +++ /dev/null @@ -1,40 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: error-pages - namespace: networking -spec: - interval: 15m - chart: - spec: - chart: error-pages - version: 1.1.2 - sourceRef: - kind: HelmRepository - name: k8s-at-home - namespace: flux-system - interval: 15m - install: - createNamespace: true - remediation: - retries: 5 - upgrade: - remediation: - retries: 5 - dependsOn: - - name: traefik - namespace: networking - values: - image: - repository: ghcr.io/tarampampam/error-pages - tag: 2.16.0 - env: - TEMPLATE_NAME: lost-in-space - SHOW_DETAILS: "false" - resources: - requests: - memory: 100Mi - cpu: 100m - limits: - memory: 250Mi diff --git a/cluster/apps/networking/error-pages/ingress-route.yaml b/cluster/apps/networking/error-pages/ingress-route.yaml deleted file mode 100644 index fc38a059..00000000 --- a/cluster/apps/networking/error-pages/ingress-route.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: error-pages - namespace: networking -spec: - entryPoints: - - websecure - routes: - - kind: Rule - match: HostRegexp(`{host:.+}`) - priority: 1 - services: - - kind: Service - name: error-pages - port: 8080 - tls: - secretName: error-pages-tls diff --git a/cluster/apps/networking/error-pages/kustomization.yaml b/cluster/apps/networking/error-pages/kustomization.yaml deleted file mode 100644 index c9804eed..00000000 --- a/cluster/apps/networking/error-pages/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - helm-release.yaml - - ingress-route.yaml diff --git a/cluster/apps/networking/ingress-nginx/cloudflare-proxied-networks.txt b/cluster/apps/networking/ingress-nginx/cloudflare-proxied-networks.txt new file mode 100644 index 00000000..d6e3abd1 --- /dev/null +++ b/cluster/apps/networking/ingress-nginx/cloudflare-proxied-networks.txt @@ -0,0 +1 @@ +173.245.48.0/20\,103.21.244.0/22\,103.22.200.0/22\,103.31.4.0/22\,141.101.64.0/18\,108.162.192.0/18\,190.93.240.0/20\,188.114.96.0/20\,197.234.240.0/22\,198.41.128.0/17\,162.158.0.0/15\,104.16.0.0/13\,104.24.0.0/14\,172.64.0.0/13\,131.0.72.0/22\,2400:cb00::/32\,2606:4700::/32\,2803:f800::/32\,2405:b500::/32\,2405:8100::/32\,2a06:98c0::/29\,2c0f:f248::/32 diff --git a/cluster/apps/networking/ingress-nginx/helm-release.yaml b/cluster/apps/networking/ingress-nginx/helm-release.yaml new file mode 100644 index 00000000..44f1446a --- /dev/null +++ b/cluster/apps/networking/ingress-nginx/helm-release.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: ingress-nginx + namespace: networking +spec: + interval: 15m + chart: + spec: + chart: ingress-nginx + version: 4.1.4 + sourceRef: + kind: HelmRepository + name: ingress-nginx + namespace: flux-system + interval: 15m + install: + createNamespace: true + remediation: + retries: 5 + upgrade: + remediation: + retries: 5 + dependsOn: + - name: cert-manager + namespace: kube-system + values: + controller: + replicaCount: 1 + extraEnvs: + - name: TZ + value: "${TIMEZONE}" + service: + annotations: + metallb.universe.tf/loadBalancerIPs: |- + ${METALLB_INGRESS_ADDR} + externalTrafficPolicy: Local + publishService: + enabled: true + ingressClassResource: + default: true + config: + client-header-timeout: 120 + client-body-buffer-size: "100M" + client-body-timeout: 120 + custom-http-errors: |- + 401,403,404,500,501,502,503 + enable-brotli: "true" + forwarded-for-header: "CF-Connecting-IP" + hsts-max-age: "31449600" + keep-alive: 120 + keep-alive-requests: 10000 + proxy-body-size: "100M" + ssl-protocols: "TLSv1.3 TLSv1.2" + use-forwarded-headers: "true" + metrics: + enabled: false + podAnnotations: + configmap.reloader.stakater.com/reload: "cloudflare-proxied-networks" + resources: + requests: + cpu: 10m + memory: 250Mi + limits: + memory: 500Mi + defaultBackend: + enabled: true + image: + repository: ghcr.io/tarampampam/error-pages + tag: 2.16.0 + replicaCount: 1 + extraEnvs: + - name: TEMPLATE_NAME + value: lost-in-space + - name: SHOW_DETAILS + value: "false" + valuesFrom: + # Cloudflare Networks + # https://www.cloudflare.com/ips/ + - targetPath: controller.config.proxy-real-ip-cidr + kind: ConfigMap + name: cloudflare-proxied-networks + valuesKey: cloudflare-proxied-networks.txt diff --git a/cluster/apps/networking/ingress-nginx/kustomization.yaml b/cluster/apps/networking/ingress-nginx/kustomization.yaml new file mode 100644 index 00000000..9304637e --- /dev/null +++ b/cluster/apps/networking/ingress-nginx/kustomization.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: networking +resources: + - helm-release.yaml +configMapGenerator: + - name: cloudflare-proxied-networks + files: + - cloudflare-proxied-networks.txt +generatorOptions: + disableNameSuffixHash: true diff --git a/cluster/apps/networking/kustomization.yaml b/cluster/apps/networking/kustomization.yaml index c7ec460b..9bb6f0d5 100644 --- a/cluster/apps/networking/kustomization.yaml +++ b/cluster/apps/networking/kustomization.yaml @@ -3,9 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - namespace.yaml - - error-pages - cloudflare-ddns - external-dns + - ingress-nginx - metallb - k8s-gateway - - traefik diff --git a/cluster/apps/networking/traefik/dashboard/ingress.yaml b/cluster/apps/networking/traefik/dashboard/ingress.yaml deleted file mode 100644 index 9ec9ecae..00000000 --- a/cluster/apps/networking/traefik/dashboard/ingress.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: traefik-dashboard - namespace: networking - annotations: - cert-manager.io/cluster-issuer: "letsencrypt-staging" - hajimari.io/appName: "traefik" - hajimari.io/enable: "true" - hajimari.io/icon: "web" - traefik.ingress.kubernetes.io/router.entrypoints: "websecure" - traefik.ingress.kubernetes.io/router.middlewares: "networking-internal-only@kubernetescrd" -spec: - ingressClassName: "traefik" - tls: - - hosts: - - "traefik.${SECRET_DOMAIN}" - secretName: "traefik-dashboard-tls" - rules: - - host: "traefik.${SECRET_DOMAIN}" - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: traefik - port: - number: 9000 diff --git a/cluster/apps/networking/traefik/dashboard/kustomization.yaml b/cluster/apps/networking/traefik/dashboard/kustomization.yaml deleted file mode 100644 index afec11c2..00000000 --- a/cluster/apps/networking/traefik/dashboard/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ingress.yaml diff --git a/cluster/apps/networking/traefik/helm-release.yaml b/cluster/apps/networking/traefik/helm-release.yaml deleted file mode 100644 index ff34a86b..00000000 --- a/cluster/apps/networking/traefik/helm-release.yaml +++ /dev/null @@ -1,95 +0,0 @@ ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: traefik - namespace: networking -spec: - interval: 15m - chart: - spec: - chart: traefik - version: 10.22.0 - sourceRef: - kind: HelmRepository - name: traefik - namespace: flux-system - interval: 15m - install: - createNamespace: true - remediation: - retries: 5 - upgrade: - remediation: - retries: 5 - dependsOn: - - name: cert-manager - namespace: kube-system - - name: metallb - namespace: networking - values: - deployment: - kind: Deployment - replicas: 1 - service: - enabled: true - type: LoadBalancer - annotations: - metallb.universe.tf/loadBalancerIPs: |- - ${METALLB_TRAEFIK_ADDR} - spec: - externalTrafficPolicy: Local - logs: - general: - format: json - level: DEBUG - access: - enabled: true - format: json - ingressClass: - enabled: true - isDefaultClass: true - fallbackApiVersion: v1 - ingressRoute: - dashboard: - enabled: false - globalArguments: - - "--api.insecure=true" - - "--serverstransport.insecureskipverify=true" - - "--providers.kubernetesingress.ingressclass=traefik" - - "--metrics.prometheus=true" - - "--metrics.prometheus.entryPoint=metrics" - - "--entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32" - additionalArguments: - - "--providers.kubernetesingress.ingressendpoint.ip=${METALLB_TRAEFIK_ADDR}" - - "--providers.kubernetesingress.allowexternalnameservices=true" - - "--providers.kubernetescrd.allowexternalnameservices=true" - ports: - traefik: - expose: true - web: - redirectTo: websecure - websecure: - tls: - enabled: true - options: "default" - metrics: - port: 8082 - expose: true - exposedPort: 8082 - tlsOptions: - default: - minVersion: VersionTLS12 - maxVersion: VersionTLS13 - sniStrict: true - pilot: - enabled: false - experimental: - plugins: - enabled: false - resources: - requests: - memory: 100Mi - cpu: 500m - limits: - memory: 500Mi diff --git a/cluster/apps/networking/traefik/kustomization.yaml b/cluster/apps/networking/traefik/kustomization.yaml deleted file mode 100644 index 077d2653..00000000 --- a/cluster/apps/networking/traefik/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - helm-release.yaml - - dashboard - - middlewares diff --git a/cluster/apps/networking/traefik/middlewares/cloudflare-only.yaml b/cluster/apps/networking/traefik/middlewares/cloudflare-only.yaml deleted file mode 100644 index 96d04c56..00000000 --- a/cluster/apps/networking/traefik/middlewares/cloudflare-only.yaml +++ /dev/null @@ -1,47 +0,0 @@ ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: cloudflare-ips - namespace: networking -spec: - # https://www.cloudflare.com/ips/ - ipWhiteList: - sourceRange: - - 173.245.48.0/20 - - 103.21.244.0/22 - - 103.22.200.0/22 - - 103.31.4.0/22 - - 141.101.64.0/18 - - 108.162.192.0/18 - - 190.93.240.0/20 - - 188.114.96.0/20 - - 197.234.240.0/22 - - 198.41.128.0/17 - - 162.158.0.0/15 - - 104.16.0.0/13 - - 104.24.0.0/14 - - 172.64.0.0/13 - - 131.0.72.0/22 - - 2400:cb00::/32 - - 2606:4700::/32 - - 2803:f800::/32 - - 2405:b500::/32 - - 2405:8100::/32 - - 2a06:98c0::/29 - - 2c0f:f248::/32 - # include rfc1918 ranges since traefik chains do not support OR operations - # https://github.com/traefik/traefik/issues/6007 - - 10.0.0.0/8 - - 172.16.0.0/12 - - 192.168.0.0/16 ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: cloudflare-only - namespace: networking -spec: - chain: - middlewares: - - name: cloudflare-ips diff --git a/cluster/apps/networking/traefik/middlewares/error-pages.yaml b/cluster/apps/networking/traefik/middlewares/error-pages.yaml deleted file mode 100644 index e8c8fe1f..00000000 --- a/cluster/apps/networking/traefik/middlewares/error-pages.yaml +++ /dev/null @@ -1,14 +0,0 @@ ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: error-pages - namespace: networking -spec: - errors: - status: - - "400-599" - query: /{status}.html - service: - name: error-pages - port: 8080 diff --git a/cluster/apps/networking/traefik/middlewares/internal-only.yaml b/cluster/apps/networking/traefik/middlewares/internal-only.yaml deleted file mode 100644 index bf3bf88a..00000000 --- a/cluster/apps/networking/traefik/middlewares/internal-only.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: internal-ips - namespace: networking -spec: - ipWhiteList: - sourceRange: - - 10.0.0.0/8 - - 172.16.0.0/12 - - 192.168.0.0/16 ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: internal-only - namespace: networking -spec: - chain: - middlewares: - - name: internal-ips diff --git a/cluster/apps/networking/traefik/middlewares/kustomization.yaml b/cluster/apps/networking/traefik/middlewares/kustomization.yaml deleted file mode 100644 index 6de78198..00000000 --- a/cluster/apps/networking/traefik/middlewares/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - error-pages.yaml - - cloudflare-only.yaml - - internal-only.yaml diff --git a/cluster/charts/traefik.yaml b/cluster/charts/ingress-nginx.yaml similarity index 63% rename from cluster/charts/traefik.yaml rename to cluster/charts/ingress-nginx.yaml index 416f9b33..4dcf5eea 100644 --- a/cluster/charts/traefik.yaml +++ b/cluster/charts/ingress-nginx.yaml @@ -2,8 +2,8 @@ apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository metadata: - name: traefik + name: ingress-nginx namespace: flux-system spec: interval: 1h - url: https://helm.traefik.io/traefik + url: https://kubernetes.github.io/ingress-nginx diff --git a/cluster/charts/kustomization.yaml b/cluster/charts/kustomization.yaml index ec53e792..43afd97f 100644 --- a/cluster/charts/kustomization.yaml +++ b/cluster/charts/kustomization.yaml @@ -5,11 +5,11 @@ resources: - emberstack.yaml - external-dns.yaml - hajimari.yaml + - ingress-nginx.yaml - jetstack.yaml - k8s-at-home.yaml - k8s-gateway.yaml - metallb.yaml - metrics-server.yaml - stakater.yaml - - traefik.yaml - weaveworks-kured.yaml diff --git a/cluster/crds/kustomization.yaml b/cluster/crds/kustomization.yaml index 8b0a42ba..b9674345 100644 --- a/cluster/crds/kustomization.yaml +++ b/cluster/crds/kustomization.yaml @@ -4,4 +4,3 @@ kind: Kustomization resources: - cert-manager - system-upgrade-controller - - traefik diff --git a/cluster/crds/traefik/crds.yaml b/cluster/crds/traefik/crds.yaml deleted file mode 100644 index 9788fc40..00000000 --- a/cluster/crds/traefik/crds.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: GitRepository -metadata: - name: traefik-crd-source - namespace: flux-system -spec: - interval: 30m - url: https://github.com/traefik/traefik-helm-chart.git - ref: - # renovate: registryUrl=https://helm.traefik.io/traefik chart=traefik - tag: v10.22.0 - ignore: | - # exclude all - /* - # path to crds - !/traefik/crds/ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 -kind: Kustomization -metadata: - name: traefik-crds - namespace: flux-system -spec: - interval: 30m - prune: false - wait: true - sourceRef: - kind: GitRepository - name: traefik-crd-source diff --git a/cluster/crds/traefik/kustomization.yaml b/cluster/crds/traefik/kustomization.yaml deleted file mode 100644 index 7d6dc05e..00000000 --- a/cluster/crds/traefik/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - crds.yaml diff --git a/configure b/configure index 5a2b0cdd..b8d2b22d 100755 --- a/configure +++ b/configure @@ -48,7 +48,7 @@ main() { if [[ "${BOOTSTRAP_KUBE_VIP_ENABLED}" == "true" ]]; then envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \ > "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml" - fi + fi # generate cluster secrets envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \ > "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml" @@ -83,7 +83,7 @@ main() { yq --inplace '.k3s_server_manifests_urls += [{"url": "https://kube-vip.io/manifests/rbac.yaml", "filename": "kube-vip-rbac.yaml"}]' "${PROJECT_DIR}/provision/ansible/inventory/group_vars/kubernetes/k3s.yml" fi fi - # generate ansible hosts file and secrets + # generate ansible hosts file and secrets generate_ansible_hosts generate_ansible_host_secrets setup_github_webhook @@ -157,7 +157,7 @@ _has_valid_ip() { verify_addressing() { local found_kube_vip="false" local found_k8s_gateway="false" - local found_traefik="false" + local found_ingress="false" # Verify the metallb min and metallb ceiling are in the same network metallb_subnet_min=$(echo "${BOOTSTRAP_METALLB_LB_RANGE}" | cut -d- -f1 | cut -d. -f1,2,3) @@ -194,8 +194,8 @@ verify_addressing() { if [[ "${addr}" == "${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}" ]]; then found_k8s_gateway="true" fi - if [[ "${addr}" == "${BOOTSTRAP_METALLB_TRAEFIK_ADDR}" ]]; then - found_traefik="true" + if [[ "${addr}" == "${BOOTSTRAP_METALLB_INGRESS_ADDR}" ]]; then + found_ingress="true" fi for var in "${!BOOTSTRAP_ANSIBLE_HOST_ADDR_@}"; do @@ -216,8 +216,8 @@ verify_addressing() { exit 1 fi - if [[ "${found_traefik}" == "false" ]]; then - _log "ERROR" "The IP for traefik '${BOOTSTRAP_METALLB_TRAEFIK_ADDR}' should be in the provided metallb range '${BOOTSTRAP_METALLB_LB_RANGE}'" + if [[ "${found_ingress}" == "false" ]]; then + _log "ERROR" "The IP for ingress '${BOOTSTRAP_METALLB_INGRESS_ADDR}' should be in the provided metallb range '${BOOTSTRAP_METALLB_LB_RANGE}'" exit 1 fi } @@ -267,7 +267,7 @@ verify_metallb() { local ip_ceil= _has_envar "BOOTSTRAP_METALLB_LB_RANGE" _has_envar "BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR" - _has_envar "BOOTSTRAP_METALLB_TRAEFIK_ADDR" + _has_envar "BOOTSTRAP_METALLB_INGRESS_ADDR" ip_floor=$(echo "${BOOTSTRAP_METALLB_LB_RANGE}" | cut -d- -f1) ip_ceil=$(echo "${BOOTSTRAP_METALLB_LB_RANGE}" | cut -d- -f2) @@ -275,7 +275,7 @@ verify_metallb() { _has_valid_ip "${ip_floor}" "BOOTSTRAP_METALLB_LB_RANGE" _has_valid_ip "${ip_ceil}" "BOOTSTRAP_METALLB_LB_RANGE" _has_valid_ip "${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}" "BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR" - _has_valid_ip "${BOOTSTRAP_METALLB_TRAEFIK_ADDR}" "BOOTSTRAP_METALLB_TRAEFIK_ADDR" + _has_valid_ip "${BOOTSTRAP_METALLB_INGRESS_ADDR}" "BOOTSTRAP_METALLB_INGRESS_ADDR" } verify_git_repository() { @@ -377,8 +377,8 @@ verify_ansible_hosts() { exit 1 fi - if [[ "${!node_addr}" == "${BOOTSTRAP_METALLB_TRAEFIK_ADDR}" ]]; then - _log "ERROR" "The traefik load balancer IP '${BOOTSTRAP_METALLB_TRAEFIK_ADDR}' should not be the same as the IP for node '${!node_addr}'" + if [[ "${!node_addr}" == "${BOOTSTRAP_METALLB_INGRESS_ADDR}" ]]; then + _log "ERROR" "The ingress load balancer IP '${BOOTSTRAP_METALLB_INGRESS_ADDR}' should not be the same as the IP for node '${!node_addr}'" exit 1 fi diff --git a/provision/ansible/inventory/group_vars/master/k3s.yml b/provision/ansible/inventory/group_vars/master/k3s.yml index 1cba8004..21e8d6b4 100644 --- a/provision/ansible/inventory/group_vars/master/k3s.yml +++ b/provision/ansible/inventory/group_vars/master/k3s.yml @@ -17,7 +17,7 @@ k3s_server: disable: # Disable flannel - replaced with Calico - flannel - # Disable traefik - installed with Flux + # Disable traefik - replaced with ingress-nginx - traefik # Disable servicelb - replaced with metallb and install with Flux - servicelb diff --git a/tmpl/cluster/cluster-settings.yaml b/tmpl/cluster/cluster-settings.yaml index af7be379..e055b0b4 100644 --- a/tmpl/cluster/cluster-settings.yaml +++ b/tmpl/cluster/cluster-settings.yaml @@ -8,4 +8,4 @@ data: TIMEZONE: ${BOOTSTRAP_TIMEZONE} METALLB_LB_RANGE: ${BOOTSTRAP_METALLB_LB_RANGE} METALLB_K8S_GATEWAY_ADDR: ${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR} - METALLB_TRAEFIK_ADDR: ${BOOTSTRAP_METALLB_TRAEFIK_ADDR} + METALLB_INGRESS_ADDR: ${BOOTSTRAP_METALLB_INGRESS_ADDR} diff --git a/tmpl/cluster/flux-system/webhooks/github/ingress.yaml b/tmpl/cluster/flux-system/webhooks/github/ingress.yaml index 3a3b4762..ca4b6a77 100644 --- a/tmpl/cluster/flux-system/webhooks/github/ingress.yaml +++ b/tmpl/cluster/flux-system/webhooks/github/ingress.yaml @@ -8,9 +8,8 @@ metadata: cert-manager.io/cluster-issuer: "letsencrypt-staging" external-dns/is-public: "true" external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" - traefik.ingress.kubernetes.io/router.middlewares: "networking-cloudflare-only@kubernetescrd" spec: - ingressClassName: traefik + ingressClassName: nginx rules: - host: "flux-receiver.${SECRET_DOMAIN}" http: diff --git a/tmpl/cluster/flux-system/webhooks/github/receiver.yaml b/tmpl/cluster/flux-system/webhooks/github/receiver.yaml index 5472c091..16be5f16 100644 --- a/tmpl/cluster/flux-system/webhooks/github/receiver.yaml +++ b/tmpl/cluster/flux-system/webhooks/github/receiver.yaml @@ -36,8 +36,3 @@ spec: kind: Kustomization name: flux-system namespace: flux-system - - - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 - kind: Kustomization - name: traefik-crds - namespace: flux-system