feat!: Update Flux ks names and add volsync and snapshot-controller (#1036)

2023-11-23 17:49:40 -05:00
1 parent fc3c7b56af
commit 84574b2f64
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: cert-manager
-  namespace: cert-manager
 spec:
  interval: 30m
  chart:
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: cert-manager
 resources:
  - ./helmrelease.yaml
  - ./prometheusrule.yaml
@@ -4,7 +4,6 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
  name: cert-manager.rules
-  namespace: cert-manager
 spec:
  groups:
    - name: cert-manager
@@ -3,6 +3,5 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: cert-manager-secret
-  namespace: cert-manager
 stringData:
  api-token: "{{ bootstrap_cloudflare_token }}"
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cert-manager
+  name: &app cert-manager
  namespace: flux-system
 spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/cert-manager/cert-manager/app
  prune: true
  sourceRef:
@@ -18,11 +22,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cert-manager-issuers
+  name: &app cert-manager-issuers
  namespace: flux-system
 spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  dependsOn:
-    - name: cluster-apps-cert-manager
+    - name: cert-manager
  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
  prune: true
  sourceRef:
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-flux-webhooks
+  name: &app flux-webhooks
  namespace: flux-system
 spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/flux-system/addons/webhooks
  prune: true
  sourceRef:
@@ -3,7 +3,6 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: flux-webhook
-  namespace: flux-system
  annotations:
    external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
    hajimari.io/enable: "false"
@@ -3,7 +3,6 @@ apiVersion: notification.toolkit.fluxcd.io/v1
 kind: Receiver
 metadata:
  name: github-receiver
-  namespace: flux-system
 spec:
  type: github
  events:
@@ -3,6 +3,5 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: github-webhook-token-secret
-  namespace: flux-system
 stringData:
  token: "{{ bootstrap_flux_github_webhook_token }}"
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: cilium
-  namespace: kube-system
 spec:
  interval: 30m
  chart:
@@ -4,7 +4,6 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  name: cilium-values
-  namespace: kube-system
 data:
  values.yaml: |
    autoDirectNodeRoutes: true
@@ -2,7 +2,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
  {% if not bootstrap_ipv6_enabled | default(false) %}
  - ./cilium-l2.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cilium
+  name: &app cilium
  namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/kube-system/cilium/app
  prune: false # never should be deleted
  sourceRef:
@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: coredns
-  namespace: kube-system
 spec:
  interval: 30m
  chart:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
  - ./helmrelease.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-coredns
+  name: &app coredns
  namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/kube-system/coredns/app
  prune: false # never should be deleted
  sourceRef:
@@ -9,6 +9,7 @@ resources:
  - ./local-path-provisioner/ks.yaml
  - ./metrics-server/ks.yaml
  - ./reloader/ks.yaml
+  - ./snapshot-controller/ks.yaml
  {% if csi_driver_nfs.enabled | default(false) %}
  - ./csi-driver-nfs/ks.yaml
  {% endif %}
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: local-path-provisioner
-  namespace: kube-system
 spec:
  interval: 30m
  chart:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
  - ./helmrelease.yaml
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-local-path-provisioner
+  name: &app local-path-provisioner
  namespace: flux-system
  labels:
    substitution.flux.home.arpa/disabled: "true"
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/kube-system/local-path-provisioner/app
  prune: true
  sourceRef:
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: metrics-server
-  namespace: kube-system
 spec:
  interval: 30m
  chart:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
  - ./helmrelease.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-metrics-server
+  name: &app metrics-server
  namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/kube-system/metrics-server/app
  prune: true
  sourceRef:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: kube-system
 resources:
  - ./helmrelease.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-reloader
+  name: &app reloader
  namespace: flux-system
 spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/kube-system/reloader/app
  prune: true
  sourceRef:
@@ -0,0 +1,33 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: snapshot-controller
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: snapshot-controller
+      version: 2.0.2
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    controller:
+      serviceMonitor:
+        create: true
+    webhook:
+      enabled: false
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app snapshot-controller
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/kube-system/snapshot-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -3,7 +3,6 @@ apiVersion: externaldns.k8s.io/v1alpha1
 kind: DNSEndpoint
 metadata:
  name: cloudflared
-  namespace: networking
 spec:
  endpoints:
    - dnsName: "external.${SECRET_DOMAIN}"
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: cloudflared
-  namespace: networking
 spec:
  interval: 30m
  chart:
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
  - ./dnsendpoint.yaml
  - ./secret.sops.yaml
@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: cloudflared-secret
-  namespace: networking
 stringData:
  TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
  credentials.json: |
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-cloudflared
+  name: &app cloudflared
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  dependsOn:
-    - name: cluster-apps-external-dns
+    - name: external-dns
  path: ./kubernetes/apps/networking/cloudflared/app
  prune: true
  sourceRef:
@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: echo-server
-  namespace: networking
 spec:
  interval: 30m
  chart:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
  - ./helmrelease.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-echo-server
+  name: &app echo-server
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/networking/echo-server/app
  prune: true
  sourceRef:
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: &app external-dns
-  namespace: networking
 spec:
  interval: 30m
  chart:
@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
  - ./dnsendpoint-crd.yaml
  - ./secret.sops.yaml
@@ -3,6 +3,5 @@ apiVersion: v1
 kind: Secret
 metadata:
  name: external-dns-secret
-  namespace: networking
 stringData:
  api-token: "{{ bootstrap_cloudflare_token }}"
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-external-dns
+  name: &app external-dns
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/networking/external-dns/app
  prune: true
  sourceRef:
@@ -3,7 +3,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: k8s-gateway
-  namespace: networking
 spec:
  interval: 30m
  chart:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
  - ./helmrelease.yaml
@@ -2,9 +2,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-k8s-gateway
+  name: &app k8s-gateway
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  path: ./kubernetes/apps/networking/k8s-gateway/app
  prune: true
  sourceRef:
@@ -3,7 +3,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: "${SECRET_DOMAIN/./-}-production"
-  namespace: networking
 spec:
  secretName: "${SECRET_DOMAIN/./-}-production-tls"
  issuerRef:
@@ -3,7 +3,6 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: "${SECRET_DOMAIN/./-}-staging"
-  namespace: networking
 spec:
  secretName: "${SECRET_DOMAIN/./-}-staging-tls"
  issuerRef:
@@ -4,7 +4,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: nginx-external
-  namespace: networking
+  namespace: &namespace networking
 spec:
  interval: 30m
  chart:
@@ -70,7 +70,7 @@ spec:
        enabled: true
        serviceMonitor:
          enabled: true
-          namespace: networking
+          namespace: *namespace
          namespaceSelector:
            any: true
      extraArgs:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
  - ./helmrelease.yaml
@@ -4,7 +4,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: nginx-internal
-  namespace: networking
+  namespace: &namespace networking
 spec:
  interval: 30m
  chart:
@@ -67,7 +67,7 @@ spec:
        enabled: true
        serviceMonitor:
          enabled: true
-          namespace: networking
+          namespace: *namespace
          namespaceSelector:
            any: true
      extraArgs:
@@ -1,6 +1,5 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
 resources:
  - ./helmrelease.yaml
@@ -2,11 +2,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-nginx-certificates
+  name: &app nginx-certificates
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  dependsOn:
-    - name: cluster-apps-cert-manager-issuers
+    - name: cert-manager-issuers
  path: ./kubernetes/apps/networking/nginx/certificates
  prune: true
  sourceRef:
@@ -20,11 +24,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-nginx-external
+  name: &app nginx-external
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  dependsOn:
-    - name: cluster-apps-nginx-certificates
+    - name: nginx-certificates
  path: ./kubernetes/apps/networking/nginx/external
  prune: true
  sourceRef:
@@ -38,11 +46,15 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cluster-apps-nginx-internal
+  name: &app nginx-internal
  namespace: flux-system
 spec:
+  targetNamespace: networking
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
  dependsOn:
-    - name: cluster-apps-nginx-certificates
+    - name: nginx-certificates
  path: ./kubernetes/apps/networking/nginx/internal
  prune: true
  sourceRef:
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Pre Flux-Kustomizations
+  - ./namespace.yaml
+  # Flux-Kustomizations
+  - ./volsync/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: volsync
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,42 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: volsync
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: volsync
+      version: 0.8.0
+      sourceRef:
+        kind: HelmRepository
+        name: backube
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  dependsOn:
+    - name: snapshot-controller
+      namespace: kube-system
+  values:
+    manageCRDs: true
+    image:
+      # https://github.com/backube/volsync/issues/828
+      repository: &image ghcr.io/onedr0p/volsync
+      tag: &tag 0.8.0
+    rclone:
+      repository: *image
+      tag: *tag
+    restic:
+      repository: *image
+      tag: *tag
+    metrics:
+      disableAuth: true
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./prometheusrule.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: volsync
+spec:
+  groups:
+    - name: volsync.rules
+      rules:
+        - alert: VolSyncComponentAbsent
+          annotations:
+            summary: VolSync component has disappeared from Prometheus target discovery.
+          expr: |
+            absent(up{job="volsync-metrics"})
+          for: 15m
+          labels:
+            severity: critical
+        - alert: VolSyncVolumeOutOfSync
+          annotations:
+            summary: >-
+              {{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume
+              is out of sync.
+          expr: |
+            volsync_volume_out_of_sync == 1
+          for: 15m
+          labels:
+            severity: critical
@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app volsync
+  namespace: flux-system
+spec:
+  targetNamespace: volsync
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/volsync/volsync/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: backube
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://backube.github.io/helm-charts/
@@ -2,6 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ./backube.yaml
  - ./bitnami.yaml
  - ./bjw-s.yaml
  - ./cilium.yaml
@@ -15,6 +16,7 @@ resources:
  - ./k8s-gateway.yaml
  - ./kubernetes-dashboard.yaml
  - ./metrics-server.yaml
+  - ./piraeus.yaml
  - ./prometheus-community.yaml
  - ./stakater.yaml
  - ./weave-gitops.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: piraeus
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://piraeus.io/helm-charts/