feat!: replace traefik with nginx ingress (#388)

* feat: remove traefik crds Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: change variable names in config sample env Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: change variable names in configure Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: change variable names in cluster-settings Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: change variable names in configure Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: change README.md to ingress-nginx Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: remove traefik helm release Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: remove traefik helm repo Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: remove error-pages Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: remove other traefik references Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: add ingress-nginx helm repo Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: add ingress-nginx helm release Signed-off-by: Devin Buhl <devin@buhl.casa>
2022-07-07 09:51:41 -04:00
1 parent bcb6f003d2
commit 6a758ee101
@@ -71,15 +71,13 @@ spec:
    ingress:
      main:
        enabled: true
-        ingressClassName: "traefik"
+        ingressClassName: "nginx"
        annotations:
          cert-manager.io/cluster-issuer: "letsencrypt-staging"
          external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
          external-dns/is-public: "true"
          hajimari.io/enable: "true"
          hajimari.io/icon: "video-input-antenna"
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
-          traefik.ingress.kubernetes.io/router.middlewares: "networking-cloudflare-only@kubernetescrd"
        hosts:
          - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
            paths:
@@ -105,13 +105,12 @@ spec:
    ingress:
      main:
        enabled: true
-        ingressClassName: "traefik"
+        ingressClassName: "nginx"
        annotations:
          cert-manager.io/cluster-issuer: "letsencrypt-staging"
          hajimari.io/enable: "true"
          hajimari.io/icon: "weather-sunset"
-          traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
-          traefik.ingress.kubernetes.io/router.middlewares: "networking-internal-only@kubernetescrd"
+          nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
        hosts:
          - host: "hajimari.${SECRET_DOMAIN}"
            paths:
@@ -1,40 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: error-pages
-  namespace: networking
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: error-pages
-      version: 1.1.2
-      sourceRef:
-        kind: HelmRepository
-        name: k8s-at-home
-        namespace: flux-system
-      interval: 15m
-  install:
-    createNamespace: true
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      retries: 5
-  dependsOn:
-    - name: traefik
-      namespace: networking
-  values:
-    image:
-      repository: ghcr.io/tarampampam/error-pages
-      tag: 2.16.0
-    env:
-      TEMPLATE_NAME: lost-in-space
-      SHOW_DETAILS: "false"
-    resources:
-      requests:
-        memory: 100Mi
-        cpu: 100m
-      limits:
-        memory: 250Mi
@@ -1,19 +0,0 @@
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: error-pages
-  namespace: networking
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - kind: Rule
-      match: HostRegexp(`{host:.+}`)
-      priority: 1
-      services:
-        - kind: Service
-          name: error-pages
-          port: 8080
-  tls:
-    secretName: error-pages-tls
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helm-release.yaml
-  - ingress-route.yaml
@@ -0,0 +1 @@
+173.245.48.0/20\,103.21.244.0/22\,103.22.200.0/22\,103.31.4.0/22\,141.101.64.0/18\,108.162.192.0/18\,190.93.240.0/20\,188.114.96.0/20\,197.234.240.0/22\,198.41.128.0/17\,162.158.0.0/15\,104.16.0.0/13\,104.24.0.0/14\,172.64.0.0/13\,131.0.72.0/22\,2400:cb00::/32\,2606:4700::/32\,2803:f800::/32\,2405:b500::/32\,2405:8100::/32\,2a06:98c0::/29\,2c0f:f248::/32
@@ -0,0 +1,84 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: networking
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: ingress-nginx
+      version: 4.1.4
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+        namespace: flux-system
+      interval: 15m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: cert-manager
+      namespace: kube-system
+  values:
+    controller:
+      replicaCount: 1
+      extraEnvs:
+        - name: TZ
+          value: "${TIMEZONE}"
+      service:
+        annotations:
+          metallb.universe.tf/loadBalancerIPs: |-
+            ${METALLB_INGRESS_ADDR}
+        externalTrafficPolicy: Local
+      publishService:
+        enabled: true
+      ingressClassResource:
+        default: true
+      config:
+        client-header-timeout: 120
+        client-body-buffer-size: "100M"
+        client-body-timeout: 120
+        custom-http-errors: |-
+          401,403,404,500,501,502,503
+        enable-brotli: "true"
+        forwarded-for-header: "CF-Connecting-IP"
+        hsts-max-age: "31449600"
+        keep-alive: 120
+        keep-alive-requests: 10000
+        proxy-body-size: "100M"
+        ssl-protocols: "TLSv1.3 TLSv1.2"
+        use-forwarded-headers: "true"
+      metrics:
+        enabled: false
+      podAnnotations:
+        configmap.reloader.stakater.com/reload: "cloudflare-proxied-networks"
+      resources:
+        requests:
+          cpu: 10m
+          memory: 250Mi
+        limits:
+          memory: 500Mi
+    defaultBackend:
+      enabled: true
+      image:
+        repository: ghcr.io/tarampampam/error-pages
+        tag: 2.16.0
+      replicaCount: 1
+      extraEnvs:
+        - name: TEMPLATE_NAME
+          value: lost-in-space
+        - name: SHOW_DETAILS
+          value: "false"
+  valuesFrom:
+    # Cloudflare Networks
+    # https://www.cloudflare.com/ips/
+    - targetPath: controller.config.proxy-real-ip-cidr
+      kind: ConfigMap
+      name: cloudflare-proxied-networks
+      valuesKey: cloudflare-proxied-networks.txt
@@ -0,0 +1,12 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: networking
+resources:
+  - helm-release.yaml
+configMapGenerator:
+  - name: cloudflare-proxied-networks
+    files:
+      - cloudflare-proxied-networks.txt
+generatorOptions:
+  disableNameSuffixHash: true
@@ -3,9 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - namespace.yaml
-  - error-pages
  - cloudflare-ddns
  - external-dns
+  - ingress-nginx
  - metallb
  - k8s-gateway
-  - traefik
@@ -1,30 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: traefik-dashboard
-  namespace: networking
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-staging"
-    hajimari.io/appName: "traefik"
-    hajimari.io/enable: "true"
-    hajimari.io/icon: "web"
-    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
-    traefik.ingress.kubernetes.io/router.middlewares: "networking-internal-only@kubernetescrd"
-spec:
-  ingressClassName: "traefik"
-  tls:
-    - hosts:
-        - "traefik.${SECRET_DOMAIN}"
-      secretName: "traefik-dashboard-tls"
-  rules:
-    - host: "traefik.${SECRET_DOMAIN}"
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: traefik
-                port:
-                  number: 9000
@@ -1,5 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ingress.yaml
@@ -1,95 +0,0 @@
---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: traefik
-  namespace: networking
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: traefik
-      version: 10.22.0
-      sourceRef:
-        kind: HelmRepository
-        name: traefik
-        namespace: flux-system
-      interval: 15m
-  install:
-    createNamespace: true
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      retries: 5
-  dependsOn:
-    - name: cert-manager
-      namespace: kube-system
-    - name: metallb
-      namespace: networking
-  values:
-    deployment:
-      kind: Deployment
-      replicas: 1
-    service:
-      enabled: true
-      type: LoadBalancer
-      annotations:
-        metallb.universe.tf/loadBalancerIPs: |-
-          ${METALLB_TRAEFIK_ADDR}
-      spec:
-        externalTrafficPolicy: Local
-    logs:
-      general:
-        format: json
-        level: DEBUG
-      access:
-        enabled: true
-        format: json
-    ingressClass:
-      enabled: true
-      isDefaultClass: true
-      fallbackApiVersion: v1
-    ingressRoute:
-      dashboard:
-        enabled: false
-    globalArguments:
-      - "--api.insecure=true"
-      - "--serverstransport.insecureskipverify=true"
-      - "--providers.kubernetesingress.ingressclass=traefik"
-      - "--metrics.prometheus=true"
-      - "--metrics.prometheus.entryPoint=metrics"
-      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=10.0.0.0/8,192.168.0.0/16,172.16.0.0/12,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,104.16.0.0/13,104.24.0.0/14,108.162.192.0/18,131.0.72.0/22,141.101.64.0/18,162.158.0.0/15,172.64.0.0/13,173.245.48.0/20,188.114.96.0/20,190.93.240.0/20,197.234.240.0/22,198.41.128.0/17,2400:cb00::/32,2606:4700::/32,2803:f800::/32,2405:b500::/32,2405:8100::/32,2a06:98c0::/29,2c0f:f248::/32"
-    additionalArguments:
-      - "--providers.kubernetesingress.ingressendpoint.ip=${METALLB_TRAEFIK_ADDR}"
-      - "--providers.kubernetesingress.allowexternalnameservices=true"
-      - "--providers.kubernetescrd.allowexternalnameservices=true"
-    ports:
-      traefik:
-        expose: true
-      web:
-        redirectTo: websecure
-      websecure:
-        tls:
-          enabled: true
-          options: "default"
-      metrics:
-        port: 8082
-        expose: true
-        exposedPort: 8082
-    tlsOptions:
-      default:
-        minVersion: VersionTLS12
-        maxVersion: VersionTLS13
-        sniStrict: true
-    pilot:
-      enabled: false
-    experimental:
-      plugins:
-        enabled: false
-    resources:
-      requests:
-        memory: 100Mi
-        cpu: 500m
-      limits:
-        memory: 500Mi
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helm-release.yaml
-  - dashboard
-  - middlewares
@@ -1,47 +0,0 @@
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: cloudflare-ips
-  namespace: networking
-spec:
-  # https://www.cloudflare.com/ips/
-  ipWhiteList:
-    sourceRange:
-      - 173.245.48.0/20
-      - 103.21.244.0/22
-      - 103.22.200.0/22
-      - 103.31.4.0/22
-      - 141.101.64.0/18
-      - 108.162.192.0/18
-      - 190.93.240.0/20
-      - 188.114.96.0/20
-      - 197.234.240.0/22
-      - 198.41.128.0/17
-      - 162.158.0.0/15
-      - 104.16.0.0/13
-      - 104.24.0.0/14
-      - 172.64.0.0/13
-      - 131.0.72.0/22
-      - 2400:cb00::/32
-      - 2606:4700::/32
-      - 2803:f800::/32
-      - 2405:b500::/32
-      - 2405:8100::/32
-      - 2a06:98c0::/29
-      - 2c0f:f248::/32
-      # include rfc1918 ranges since traefik chains do not support OR operations
-      # https://github.com/traefik/traefik/issues/6007
-      - 10.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: cloudflare-only
-  namespace: networking
-spec:
-  chain:
-    middlewares:
-      - name: cloudflare-ips
@@ -1,14 +0,0 @@
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: error-pages
-  namespace: networking
-spec:
-  errors:
-    status:
-      - "400-599"
-    query: /{status}.html
-    service:
-      name: error-pages
-      port: 8080
@@ -1,22 +0,0 @@
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: internal-ips
-  namespace: networking
-spec:
-  ipWhiteList:
-    sourceRange:
-      - 10.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: internal-only
-  namespace: networking
-spec:
-  chain:
-    middlewares:
-      - name: internal-ips
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - error-pages.yaml
-  - cloudflare-only.yaml
-  - internal-only.yaml
@@ -2,8 +2,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
-  name: traefik
+  name: ingress-nginx
  namespace: flux-system
 spec:
  interval: 1h
-  url: https://helm.traefik.io/traefik
+  url: https://kubernetes.github.io/ingress-nginx
@@ -5,11 +5,11 @@ resources:
  - emberstack.yaml
  - external-dns.yaml
  - hajimari.yaml
+  - ingress-nginx.yaml
  - jetstack.yaml
  - k8s-at-home.yaml
  - k8s-gateway.yaml
  - metallb.yaml
  - metrics-server.yaml
  - stakater.yaml
-  - traefik.yaml
  - weaveworks-kured.yaml
@@ -4,4 +4,3 @@ kind: Kustomization
 resources:
  - cert-manager
  - system-upgrade-controller
-  - traefik
@@ -1,30 +0,0 @@
---
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: traefik-crd-source
-  namespace: flux-system
-spec:
-  interval: 30m
-  url: https://github.com/traefik/traefik-helm-chart.git
-  ref:
-    # renovate: registryUrl=https://helm.traefik.io/traefik chart=traefik
-    tag: v10.22.0
-  ignore: |
-    # exclude all
-    /*
-    # path to crds
-    !/traefik/crds/
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: traefik-crds
-  namespace: flux-system
-spec:
-  interval: 30m
-  prune: false
-  wait: true
-  sourceRef:
-    kind: GitRepository
-    name: traefik-crd-source
@@ -1,5 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - crds.yaml
				`@@ -0,0 +1 @@`
				`173.245.48.0/20\,103.21.244.0/22\,103.22.200.0/22\,103.31.4.0/22\,141.101.64.0/18\,108.162.192.0/18\,190.93.240.0/20\,188.114.96.0/20\,197.234.240.0/22\,198.41.128.0/17\,162.158.0.0/15\,104.16.0.0/13\,104.24.0.0/14\,172.64.0.0/13\,131.0.72.0/22\,2400:cb00::/32\,2606:4700::/32\,2803:f800::/32\,2405:b500::/32\,2405:8100::/32\,2a06:98c0::/29\,2c0f:f248::/32`