From 889ca076927205167f8947e964ef2d1b41cd50b5 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Sun, 28 Jan 2024 12:41:31 -0500 Subject: [PATCH] feat: refactor config file (#1267) Signed-off-by: Devin Buhl --- .github/tests/config-k0s.yaml | 96 ++++--- .github/tests/config-k3s-ipv4.yaml | 96 ++++--- .github/tests/config-k3s-ipv6.yaml | 99 ++++--- .github/tests/config-talos.yaml | 96 ++++--- .github/workflows/e2e.yaml | 4 +- .gitignore | 2 + .taskfiles/K0s/Taskfile.yaml | 6 +- .taskfiles/Repository/Taskfile.yaml | 1 + .taskfiles/Sops/Taskfile.yaml | 5 +- .taskfiles/Talos/Taskfile.yaml | 4 + README.md | 122 ++++----- Taskfile.yaml | 2 +- bootstrap/scripts/validation.py | 250 ++++-------------- bootstrap/templates/.sops.yaml.j2 | 12 +- bootstrap/templates/ansible/.mjfilter.py | 2 +- .../templates/ansible/inventory/.mjfilter.py | 2 +- .../group_vars/kubernetes/.mjfilter.py | 2 +- .../group_vars/kubernetes/main.yaml.j2 | 2 +- .../inventory/group_vars/master/.mjfilter.py | 2 +- .../inventory/group_vars/master/main.yaml.j2 | 16 +- .../inventory/group_vars/worker/.mjfilter.py | 2 +- .../inventory/group_vars/worker/main.yaml.j2 | 2 +- .../templates/ansible/inventory/hosts.yaml.j2 | 18 +- .../playbooks/cluster-installation.yaml.j2 | 2 +- .../playbooks/cluster-kube-vip.yaml.j2 | 6 +- .../ansible/playbooks/cluster-nuke.yaml.j2 | 4 +- .../ansible/playbooks/cluster-prepare.yaml.j2 | 14 +- .../ansible/playbooks/cluster-reboot.yaml.j2 | 2 +- .../playbooks/cluster-rollout-update.yaml.j2 | 16 +- .../ansible/playbooks/tasks/.mjfilter.py | 2 +- .../ansible/playbooks/templates/.mjfilter.py | 2 +- .../templates/ansible/requirements.yaml.j2 | 2 +- .../templates/kubernetes/apps/.mjfilter.py | 1 + .../cert-manager-issuers/ks.yaml.j2 | 23 -- .../cert-manager/app/helmrelease.yaml.j2 | 5 - .../cert-manager/issuers/.mjfilter.py | 1 + .../issuers}/issuers.yaml.j2 | 0 .../issuers}/kustomization.yaml.j2 | 0 .../issuers}/secret.sops.yaml.j2 | 2 +- .../apps/cert-manager/cert-manager/ks.yaml.j2 | 24 ++ .../apps/cert-manager/kustomization.yaml.j2 | 1 - .../kubernetes/apps/flux-system/.mjfilter.py | 1 + .../apps/flux-system/kustomization.yaml.j2 | 2 +- .../app}/github/ingress.yaml.j2 | 2 + .../app}/github/kustomization.yaml.j2 | 2 + .../app}/github/receiver.yaml.j2 | 0 .../app}/github/secret.sops.yaml.j2 | 2 +- .../app}/kustomization.yaml.j2 | 0 .../{addons => webhooks}/ks.yaml.j2 | 2 +- .../kube-system/cilium/app/cilium-l2.yaml.j2 | 2 +- .../cilium/app/kustomization.yaml.j2 | 2 +- .../kubelet-csr-approver/.mjfilter.py | 2 +- .../apps/kube-system/kustomization.yaml.j2 | 4 +- .../metrics-server/app/helmrelease.yaml.j2 | 4 - .../reloader/app/helmrelease.yaml.j2 | 3 - .../apps/kube-system/spegel/.mjfilter.py | 2 +- .../spegel/app/helmrelease.yaml.j2 | 6 +- .../kubernetes/apps/network/.mjfilter.py | 1 + .../apps/network/certificates/ks.yaml.j2 | 22 -- .../cloudflared/app/helmrelease.yaml.j2 | 3 - .../cloudflared/app/secret.sops.yaml.j2 | 8 +- .../apps/network/cloudflared/ks.yaml.j2 | 1 - .../echo-server/app/helmrelease.yaml.j2 | 2 - .../external-dns/app/helmrelease.yaml.j2 | 2 - .../external-dns/app/secret.sops.yaml.j2 | 2 +- .../certificates}/kustomization.yaml.j2 | 2 +- .../certificates}/production.yaml.j2 | 0 .../certificates}/staging.yaml.j2 | 0 .../external}/helmrelease.yaml.j2 | 16 +- .../external}/kustomization.yaml.j2 | 0 .../internal}/helmrelease.yaml.j2 | 16 +- .../internal}/kustomization.yaml.j2 | 0 .../apps/network/ingress-nginx/ks.yaml.j2 | 66 +++++ .../k8s-gateway/app/helmrelease.yaml.j2 | 2 +- .../apps/network/kustomization.yaml.j2 | 4 +- .../apps/network/nginx-external/ks.yaml.j2 | 22 -- .../apps/network/nginx-internal/ks.yaml.j2 | 22 -- .../kubernetes/bootstrap/.mjfilter.py | 1 + .../templates/kubernetes/flux/.mjfilter.py | 1 + .../kubernetes/flux/config/cluster.yaml.j2 | 10 +- .../flux/repositories/helm/backube.yaml.j2 | 9 - .../flux/repositories/helm/bitnami.yaml.j2 | 10 - .../flux/repositories/helm/coredns.yaml.j2 | 9 - .../repositories/helm/csi-driver-nfs.yaml.j2 | 9 - .../repositories/helm/csi-driver-smb.yaml.j2 | 9 - .../repositories/helm/descheduler.yaml.j2 | 9 - .../repositories/helm/external-dns.yaml.j2 | 2 + .../flux/repositories/helm/grafana.yaml.j2 | 9 - .../repositories/helm/ingress-nginx.yaml.j2 | 2 + .../repositories/helm/k8s-gateway.yaml.j2 | 2 + .../helm/kubernetes-dashboard.yaml.j2 | 9 - .../repositories/helm/kustomization.yaml.j2 | 20 +- .../flux/repositories/helm/longhorn.yaml.j2 | 9 - .../flux/repositories/helm/piraeus.yaml.j2 | 9 - .../repositories/helm/postfinance.yaml.j2 | 2 + .../helm/prometheus-community.yaml.j2 | 10 - .../repositories/helm/weave-gitops.yaml.j2 | 10 - .../flux/repositories/helm/xenitab.yaml.j2 | 2 + .../flux/vars/cluster-secrets.sops.yaml.j2 | 9 +- .../flux/vars/cluster-settings.yaml.j2 | 14 +- .../templates/kubernetes/k0s/.mjfilter.py | 2 +- .../templates/kubernetes/k0s/k0sctl.yaml.j2 | 46 ++-- .../kubernetes/k0s/scripts/apply-system.sh.j2 | 10 +- .../templates/kubernetes/talos/.mjfilter.py | 2 +- .../kubernetes/talos/talconfig.yaml.j2 | 56 ++-- .../cilium-values-full.partial.yaml.j2 | 36 +-- .../cilium-values-init.partial.yaml.j2 | 18 +- .../partials/kube-vip-ds.partial.yaml.j2 | 2 +- ...ubelet-csr-approver-values.partial.yaml.j2 | 2 +- bootstrap/vars/.gitignore | 4 - bootstrap/vars/config.sample.yaml | 111 -------- config.sample.yaml | 115 ++++++++ makejinja.toml | 2 +- scripts/kubeconform.sh | 4 +- 114 files changed, 721 insertions(+), 1042 deletions(-) create mode 100644 bootstrap/templates/kubernetes/apps/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/ks.yaml.j2 create mode 100644 bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py rename bootstrap/templates/kubernetes/apps/cert-manager/{cert-manager-issuers/app => cert-manager/issuers}/issuers.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/cert-manager/{cert-manager-issuers/app => cert-manager/issuers}/kustomization.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/cert-manager/{cert-manager-issuers/app => cert-manager/issuers}/secret.sops.yaml.j2 (63%) create mode 100644 bootstrap/templates/kubernetes/apps/flux-system/.mjfilter.py rename bootstrap/templates/kubernetes/apps/flux-system/{addons/webhooks => webhooks/app}/github/ingress.yaml.j2 (92%) rename bootstrap/templates/kubernetes/apps/flux-system/{addons/webhooks => webhooks/app}/github/kustomization.yaml.j2 (76%) rename bootstrap/templates/kubernetes/apps/flux-system/{addons/webhooks => webhooks/app}/github/receiver.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/flux-system/{addons/webhooks => webhooks/app}/github/secret.sops.yaml.j2 (62%) rename bootstrap/templates/kubernetes/apps/flux-system/{addons/webhooks => webhooks/app}/kustomization.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/flux-system/{addons => webhooks}/ks.yaml.j2 (87%) create mode 100644 bootstrap/templates/kubernetes/apps/network/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/apps/network/certificates/ks.yaml.j2 rename bootstrap/templates/kubernetes/apps/network/{certificates/app => ingress-nginx/certificates}/kustomization.yaml.j2 (74%) rename bootstrap/templates/kubernetes/apps/network/{certificates/app => ingress-nginx/certificates}/production.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/network/{certificates/app => ingress-nginx/certificates}/staging.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/network/{nginx-external/app => ingress-nginx/external}/helmrelease.yaml.j2 (87%) rename bootstrap/templates/kubernetes/apps/network/{nginx-external/app => ingress-nginx/external}/kustomization.yaml.j2 (100%) rename bootstrap/templates/kubernetes/apps/network/{nginx-internal/app => ingress-nginx/internal}/helmrelease.yaml.j2 (86%) rename bootstrap/templates/kubernetes/apps/network/{nginx-internal/app => ingress-nginx/internal}/kustomization.yaml.j2 (100%) create mode 100644 bootstrap/templates/kubernetes/apps/network/ingress-nginx/ks.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/apps/network/nginx-external/ks.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/apps/network/nginx-internal/ks.yaml.j2 create mode 100644 bootstrap/templates/kubernetes/bootstrap/.mjfilter.py create mode 100644 bootstrap/templates/kubernetes/flux/.mjfilter.py delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/bitnami.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-smb.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/descheduler.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/grafana.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/kubernetes-dashboard.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/longhorn.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2 delete mode 100644 bootstrap/templates/kubernetes/flux/repositories/helm/weave-gitops.yaml.j2 delete mode 100644 bootstrap/vars/.gitignore delete mode 100644 bootstrap/vars/config.sample.yaml create mode 100644 config.sample.yaml diff --git a/.github/tests/config-k0s.yaml b/.github/tests/config-k0s.yaml index a14748a0..c3e0acea 100644 --- a/.github/tests/config-k0s.yaml +++ b/.github/tests/config-k0s.yaml @@ -1,52 +1,50 @@ --- skip_tests: true -bootstrap_distribution: k0s -bootstrap_github_username: onedr0p -bootstrap_github_repository_name: flux-cluster-template -bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY -bootstrap_timezone: Etc/UTC -bootstrap_acme_email: fake@example.com -bootstrap_acme_production_enabled: false -bootstrap_flux_github_webhook_token: fake -bootstrap_cloudflare_domain: fake -bootstrap_cloudflare_token: fake -bootstrap_cloudflare_account_tag: fake -bootstrap_cloudflare_tunnel_secret: fake -bootstrap_cloudflare_tunnel_id: fake -bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kube_api_addr: 10.10.10.254 -bootstrap_kube_additional_tls_sans: ["fake"] -bootstrap_k8s_gateway_addr: 10.10.10.253 -bootstrap_external_ingress_addr: 10.10.10.252 -bootstrap_internal_ingress_addr: 10.10.10.251 -bootstrap_dns_server: 1.1.1.1 -bootstrap_cluster_cidr: 10.42.0.0/16 -bootstrap_service_cidr: 10.43.0.0/16 -bootstrap_nodes: - master: - - name: k8s-0 - address: 10.10.10.100 - ssh: - username: fake - - name: k8s-1 - address: 10.10.10.101 - ssh: - username: fake - - name: k8s-2 - address: 10.10.10.102 - ssh: - username: fake - worker: - - name: k8s-3 - address: 10.10.10.103 - ssh: - username: fake - - name: k8s-4 - address: 10.10.10.104 - ssh: - username: fake - - name: k8s-5 - address: 10.10.10.105 - ssh: - username: fake +distribution: k0s +timezone: Etc/UTC + +cluster: + nodes: + host_network: 10.10.10.0/24 + dns_servers: ["1.1.1.1"] + search_domain: "fake" + inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + ssh_username: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + ssh_username: fake + pod_network: 10.69.0.0/16 + service_network: 10.96.0.0/16 + endpoint_vip: 10.10.10.254 + tls_sans: ["fake"] + +flux: + enabled: true + github: + username: onedr0p + address: https://github.com/onedr0p/flux-cluster-template + branch: main + webhook: + enabled: true + token: fake + sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY + +cloudflare: + enabled: true + domain: fake + token: take + acme: + email: fake@example.com + production: false + tunnel: + account_id: fake + id: fake + secret: fake + ingress_vip: 10.10.10.252 + ingress_vip: 10.10.10.251 + gateway_vip: 10.10.10.253 diff --git a/.github/tests/config-k3s-ipv4.yaml b/.github/tests/config-k3s-ipv4.yaml index af0d9909..53ca1437 100644 --- a/.github/tests/config-k3s-ipv4.yaml +++ b/.github/tests/config-k3s-ipv4.yaml @@ -1,52 +1,50 @@ --- skip_tests: true -bootstrap_distribution: k3s -bootstrap_github_username: onedr0p -bootstrap_github_repository_name: flux-cluster-template -bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY -bootstrap_timezone: Etc/UTC -bootstrap_acme_email: fake@example.com -bootstrap_acme_production_enabled: false -bootstrap_flux_github_webhook_token: fake -bootstrap_cloudflare_domain: fake -bootstrap_cloudflare_token: fake -bootstrap_cloudflare_account_tag: fake -bootstrap_cloudflare_tunnel_secret: fake -bootstrap_cloudflare_tunnel_id: fake -bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kube_api_addr: 10.10.10.254 -bootstrap_kube_additional_tls_sans: ["fake"] -bootstrap_k8s_gateway_addr: 10.10.10.253 -bootstrap_external_ingress_addr: 10.10.10.252 -bootstrap_internal_ingress_addr: 10.10.10.251 -bootstrap_dns_server: 1.1.1.1 -bootstrap_cluster_cidr: 10.42.0.0/16 -bootstrap_service_cidr: 10.43.0.0/16 -bootstrap_nodes: - master: - - name: k8s-0 - address: 10.10.10.100 - ssh: - username: fake - - name: k8s-1 - address: 10.10.10.101 - ssh: - username: fake - - name: k8s-2 - address: 10.10.10.102 - ssh: - username: fake - worker: - - name: k8s-3 - address: 10.10.10.103 - ssh: - username: fake - - name: k8s-4 - address: 10.10.10.104 - ssh: - username: fake - - name: k8s-5 - address: 10.10.10.105 - ssh: - username: fake +distribution: k3s +timezone: Etc/UTC + +cluster: + nodes: + host_network: 10.10.10.0/24 + dns_servers: ["1.1.1.1"] + search_domain: "fake" + inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + ssh_username: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + ssh_username: fake + pod_network: 10.69.0.0/16 + service_network: 10.96.0.0/16 + endpoint_vip: 10.10.10.254 + tls_sans: ["fake"] + +flux: + enabled: true + github: + username: onedr0p + address: https://github.com/onedr0p/flux-cluster-template + branch: main + webhook: + enabled: true + token: fake + sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY + +cloudflare: + enabled: true + domain: fake + token: take + acme: + email: fake@example.com + production: false + tunnel: + account_id: fake + id: fake + secret: fake + ingress_vip: 10.10.10.252 + ingress_vip: 10.10.10.251 + gateway_vip: 10.10.10.253 diff --git a/.github/tests/config-k3s-ipv6.yaml b/.github/tests/config-k3s-ipv6.yaml index c77d3f81..4d87d8f1 100644 --- a/.github/tests/config-k3s-ipv6.yaml +++ b/.github/tests/config-k3s-ipv6.yaml @@ -1,54 +1,53 @@ --- skip_tests: true -bootstrap_distribution: k3s -bootstrap_github_username: onedr0p -bootstrap_github_repository_name: flux-cluster-template -bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY -bootstrap_timezone: Etc/UTC -bootstrap_acme_email: fake@example.com -bootstrap_acme_production_enabled: false -bootstrap_flux_github_webhook_token: fake -bootstrap_cloudflare_domain: fake -bootstrap_cloudflare_token: fake -bootstrap_cloudflare_account_tag: fake -bootstrap_cloudflare_tunnel_secret: fake -bootstrap_cloudflare_tunnel_id: fake -bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kube_api_addr: 10.10.10.254 -bootstrap_kube_additional_tls_sans: ["fake"] -bootstrap_k8s_gateway_addr: 10.10.10.253 -bootstrap_external_ingress_addr: 10.10.10.252 -bootstrap_internal_ingress_addr: 10.10.10.251 -bootstrap_dns_server: 1.1.1.1 -bootstrap_advanced_flags: +distribution: k3s +timezone: Etc/UTC + +cluster: + nodes: + host_network: 10.10.10.0/24 + dns_servers: ["1.1.1.1"] + search_domain: "fake" + inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + ssh_username: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + ssh_username: fake + pod_network: 10.42.0.0/16,fd7f:8f5:e87c:a::/64 + service_network: 10.43.0.0/16,fd7f:8f5:e87c:e::/112 + endpoint_vip: 10.10.10.254 + tls_sans: ["fake"] + +flux: + enabled: true + github: + username: onedr0p + address: https://github.com/onedr0p/flux-cluster-template + branch: main + webhook: + enabled: true + token: fake + sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY + +cloudflare: + enabled: true + domain: fake + token: take + acme: + email: fake@example.com + production: false + tunnel: + account_id: fake + id: fake + secret: fake + ingress_vip: 10.10.10.252 + ingress_vip: 10.10.10.251 + gateway_vip: 10.10.10.253 + +feature_gates: dual_stack_ipv4_first: true -bootstrap_cluster_cidr: 10.42.0.0/16,fd7f:8f5:e87c:a::/64 -bootstrap_service_cidr: 10.43.0.0/16,fd7f:8f5:e87c:e::/112 -bootstrap_nodes: - master: - - name: k8s-0 - address: 10.10.10.100 - ssh: - username: fake - - name: k8s-1 - address: 10.10.10.101 - ssh: - username: fake - - name: k8s-2 - address: 10.10.10.102 - ssh: - username: fake - worker: - - name: k8s-3 - address: 10.10.10.103 - ssh: - username: fake - - name: k8s-4 - address: 10.10.10.104 - ssh: - username: fake - - name: k8s-5 - address: 10.10.10.105 - ssh: - username: fake diff --git a/.github/tests/config-talos.yaml b/.github/tests/config-talos.yaml index 3e3e41fb..2c5b66e2 100644 --- a/.github/tests/config-talos.yaml +++ b/.github/tests/config-talos.yaml @@ -1,52 +1,50 @@ --- skip_tests: true -bootstrap_distribution: talos -bootstrap_github_username: onedr0p -bootstrap_github_repository_name: flux-cluster-template -bootstrap_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY -bootstrap_timezone: Etc/UTC -bootstrap_acme_email: fake@example.com -bootstrap_acme_production_enabled: false -bootstrap_flux_github_webhook_token: fake -bootstrap_cloudflare_domain: fake -bootstrap_cloudflare_token: fake -bootstrap_cloudflare_account_tag: fake -bootstrap_cloudflare_tunnel_secret: fake -bootstrap_cloudflare_tunnel_id: fake -bootstrap_node_cidr: 10.10.10.0/24 -bootstrap_kube_api_addr: 10.10.10.254 -bootstrap_kube_additional_tls_sans: ["fake"] -bootstrap_k8s_gateway_addr: 10.10.10.253 -bootstrap_external_ingress_addr: 10.10.10.252 -bootstrap_internal_ingress_addr: 10.10.10.251 -bootstrap_dns_server: 1.1.1.1 -bootstrap_cluster_cidr: 10.42.0.0/16 -bootstrap_service_cidr: 10.43.0.0/16 -bootstrap_nodes: - master: - - name: k8s-0 - address: 10.10.10.100 - talos: - disk_device: fake - - name: k8s-1 - address: 10.10.10.101 - talos: - disk_device: fake - - name: k8s-2 - address: 10.10.10.102 - talos: - disk_device: fake - worker: - - name: k8s-3 - address: 10.10.10.103 - talos: - disk_device: fake - - name: k8s-4 - address: 10.10.10.104 - talos: - disk_device: fake - - name: k8s-5 - address: 10.10.10.105 - talos: - disk_device: fake +distribution: talos +timezone: Etc/UTC + +cluster: + nodes: + host_network: 10.10.10.0/24 + dns_servers: ["1.1.1.1"] + search_domain: "fake" + inventory: + - name: k8s-controller-0 + address: 10.10.10.100 + controller: true + talos_disk_device: fake + - name: k8s-worker-0 + address: 10.10.10.101 + controller: false + talos_disk_device: fake + pod_network: 10.69.0.0/16 + service_network: 10.96.0.0/16 + endpoint_vip: 10.10.10.254 + tls_sans: ["fake"] + +flux: + enabled: true + github: + username: onedr0p + address: https://github.com/onedr0p/flux-cluster-template + branch: main + webhook: + enabled: true + token: fake + sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY + +cloudflare: + enabled: true + domain: fake + token: take + acme: + email: fake@example.com + production: false + tunnel: + account_id: fake + id: fake + secret: fake + ingress_vip: 10.10.10.252 + ingress_vip: 10.10.10.251 + gateway_vip: 10.10.10.253 diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 3680a4e4..311d4f05 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -77,9 +77,9 @@ jobs: shell: bash run: | task init - cp ./.github/tests/config-${{ matrix.config-files }}.yaml ./bootstrap/vars/config.yaml + cp ./.github/tests/config-${{ matrix.config-files }}.yaml ./config.yaml export BOOTSTRAP_AGE_PUBLIC_KEY=$(sed -n 's/# public key: //gp' age.key) - envsubst < ./bootstrap/vars/config.yaml | sponge ./bootstrap/vars/config.yaml + envsubst < ./config.yaml | sponge ./config.yaml - name: Run configure task shell: bash diff --git a/.gitignore b/.gitignore index 5b63c724..538c6483 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,5 @@ Brewfile.lock.json .idea # wiki wiki +# Bootstrap +/config.yaml diff --git a/.taskfiles/K0s/Taskfile.yaml b/.taskfiles/K0s/Taskfile.yaml index c1f8eeff..551273e9 100644 --- a/.taskfiles/K0s/Taskfile.yaml +++ b/.taskfiles/K0s/Taskfile.yaml @@ -34,10 +34,10 @@ tasks: prompt: This will overwrite the existing kubeconfig... continue? cmds: - k0sctl kubeconfig --config {{.K0S_CONFIG_FILE}} > {{.KUBECONFIG_FILE}} - - sed -i {{if eq OS "darwin"}}''{{end}} 's|https://.+:6443|https://{{.kube_api_addr}}:6443|g' {{.KUBECONFIG_FILE}} + - sed -i {{if eq OS "darwin"}}''{{end}} 's|https://.+:6443|https://{{.endpoint}}:6443|g' {{.KUBECONFIG_FILE}} vars: - kube_api_addr: - sh: "yq '.bootstrap_kube_api_addr' {{.BOOTSTRAP_CONFIG_FILE}}" + endpoint: + sh: "yq '.cluster.endpoint_vip' {{.BOOTSTRAP_CONFIG_FILE}}" preconditions: - { msg: "Missing K0s config file", sh: "test -f {{.K0S_CONFIG_FILE}}" } diff --git a/.taskfiles/Repository/Taskfile.yaml b/.taskfiles/Repository/Taskfile.yaml index 0b020436..a68c4dca 100644 --- a/.taskfiles/Repository/Taskfile.yaml +++ b/.taskfiles/Repository/Taskfile.yaml @@ -28,6 +28,7 @@ tasks: - task: :k0s:.reset - task: :kubernetes:.reset - task: :sops:.reset + - task: :talos:.reset force-reset: desc: Reset repo back to HEAD diff --git a/.taskfiles/Sops/Taskfile.yaml b/.taskfiles/Sops/Taskfile.yaml index ca93faaa..37395765 100644 --- a/.taskfiles/Sops/Taskfile.yaml +++ b/.taskfiles/Sops/Taskfile.yaml @@ -22,7 +22,10 @@ tasks: file: "{{.ITEM}}" vars: file: - sh: find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \; + sh: | + if [ -d "{{.KUBERNETES_DIR}}" ]; then + find "{{.KUBERNETES_DIR}}" -type f -name "*.sops.*" -exec grep -L "ENC\[AES256_GCM" {} \; + fi .encrypt-file: internal: true diff --git a/.taskfiles/Talos/Taskfile.yaml b/.taskfiles/Talos/Taskfile.yaml index 594b150b..035b3ab1 100644 --- a/.taskfiles/Talos/Taskfile.yaml +++ b/.taskfiles/Talos/Taskfile.yaml @@ -77,3 +77,7 @@ tasks: vars: ["node", "to"] preconditions: - { msg: "Node not found", sh: "talosctl --nodes {{.node}} get machineconfig" } + + .reset: + internal: true + cmd: rm -rf {{.TALOS_DIR}} diff --git a/README.md b/README.md index e1067e24..bcd604ee 100644 --- a/README.md +++ b/README.md @@ -1,18 +1,21 @@ -# Deploy a Kubernetes cluster backed by Flux +# Deploy a Kubernetes cluster -Welcome to my opinionated and extendable template for deploying a single Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos) backed by [Flux](https://fluxcd.io/flux/) to manage its state. +Welcome to my opinionated and extensible template for deploying a single Kubernetes cluster. The goal of this project is to make it easier for people interested in using Kubernetes to deploy a cluster at home on bare-metal or VMs. ## 👋 Introduction -The goal of this project is to make it easy for people interested in learning Kubernetes to deploy a cluster at home and become familiar with the GitOps tool Flux. +There are currently 3 different types of configuration available with this template: -This template implements Flux in a way that promotes legibility and ease of use for those who are new (or relatively new) to the technology and GitOps in general. - -If you are new to Flux and GitOps it is important to understand that **all changes** you want made to your Kubernetes cluster should be **commited to your Git repository** which Flux will pick up and attempt to apply. You're still free to make _dirty_ edits using `kubectl` but keep in mind that Flux might revert them once its reconcilation loop happens. +1. "**Bare cluster**" - a distrubition of your choosing ([k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos)) that comes with only [kube-vip](https://github.com/kube-vip/kube-vip) and [Cilium](https://github.com/cilium/cilium) installed with the cluster. +2. "**Flux cluster**" - Add-on to the "**Bare cluster**" to deploy an opinionated implementation of [Flux](https://github.com/fluxcd/flux2) using [GitHub](https://github.com/) as the SCM tool. +3. "**Flux cluster w/ Cloudflare**" - Add-on to the "**Flux cluster**" that provides DNS and SSL with [Cloudflare](https://www.cloudflare.com/). [Cloudflare Tunnel](https://www.cloudflare.com/products/tunnel/) is also included to provide external access to certain applications deployed in your cluster. ## ✨ Features -- Build a Kubernetes cluster with either [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos) +> [!NOTE] +> Features will vary depending on what type of configuration you choose, listed below is an overview of the full "**Flux cluster w/ Cloudflare**" setup. + +- Build a Kubernetes cluster with either [k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos) - Automated, reproducible, customizable setup through templates - Opinionated implementation of Flux with [strong community support](https://github.com/onedr0p/flux-cluster-template/tree/main#-help) - Encrypted secrets thanks to [SOPS](https://github.com/getsops/sops) and [Age](https://github.com/FiloSottile/age) @@ -26,8 +29,8 @@ If you are new to Flux and GitOps it is important to understand that **all chang ## 📝 Pre-start checklist -> [!IMPORTANT] -> Before we get started everything below must be taken into consideration, you must... +> [!NOTE] +> Pre-start checklist items will vary depending on what type of configuration you choose, listed below is an overview of the full "**Flux cluster w/ Cloudflare**" setup. - [ ] have some experience with the following: Git/SCM, containers, networking and scripting. - [ ] bring a **positive attitude** and be ready to learn and fail a lot. _The more you fail, the more you can learn from._ @@ -41,7 +44,7 @@ If you are new to Flux and GitOps it is important to understand that **all chang Hopefully some of this peeked your interests! -If you are marching forward, now is a good time to choose whether you will deploy a Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://k3s.io) or [Talos](https://github.com/siderolabs/talos). Talos and k0s support was recently added so I would advise using k3s until those have been tested more however feel free to use Talos or k0s and report any issues that you find. Keep the one you decide in mind as you continue along, some steps may vary on what you choose. +If you are marching forward, now is a good time to choose whether you will deploy a Kubernetes cluster with [k0s](https://github.com/k0sproject/k0s), [k3s](https://github.com/k3s-io/k3s) or [Talos](https://github.com/siderolabs/talos). Talos and k0s support was recently added so I would advise using k3s until those have been tested more however feel free to use Talos or k0s and report any issues that you find. Keep the one you decide in mind as you continue along, some steps may vary on what you choose. ### System requirements @@ -166,7 +169,7 @@ You have two different options for setting up your local workstation. First one 1. Start Docker and open your repository in VSCode. There will be a pop-up asking you to use the `devcontainer`, click the button to start using it. -2. Continue on to 🔧 [**Stage 3**](#-stage-3-do-bootstrap-configuration) +2. Continue on to 🔧 [**Stage 3**](#-stage-3-bootstrap-configuration) #### Non-devcontainer method @@ -199,7 +202,7 @@ You have two different options for setting up your local workstation. First one task workstation:brew # or, Arch with yay/paru task workstation:arch - # or, Generic Linux (this pulls binaires in to ./bin) + # or, Generic Linux (YMMV, this pulls binaires in to ./bin) task workstation:generic-linux ``` @@ -211,90 +214,80 @@ You have two different options for setting up your local workstation. First one task workstation:venv ``` -5. Continue on to 🔧 [**Stage 3**](#-stage-3-do-bootstrap-configuration) +5. Continue on to 🔧 [**Stage 3**](#-stage-3-bootstrap-configuration) -### 🔧 Stage 3: Do bootstrap configuration +### 🔧 Stage 3: Bootstrap configuration -📍 _The_ `bootstrap/vars/config.yaml` contain necessary information that is **vital** to the bootstrap process._ +> [!IMPORTANT] +> The [config.sample.yaml](https://github.com/onedr0p/flux-cluster-template/blob/main/config.sample.yaml) file contain necessary information that is **vital** to the bootstrap process. -1. Generate the `bootstrap/vars/config.yaml` configuration file. +1. Generate the `config.yaml` from the [config.sample.yaml](https://github.com/onedr0p/flux-cluster-template/blob/main/config.sample.yaml) configuration file. ```sh task init ``` -2. Choose between `k3s` or `k0s` for your Kubernetes distribution and fillout the appropriate vars in `bootstrap/vars/config.yaml` - -3. Setup Age private / public key +2. Setup Age private / public key (_**Skip if not using Flux**_) 📍 _Using [SOPS](https://github.com/getsops/sops) with [Age](https://github.com/FiloSottile/age) allows us to encrypt secrets and use them in Ansible and Flux._ - 3a. Create a Age private / public key (this file is gitignored) + 2a. Create a Age private / public key (this file is gitignored) ```sh task sops:age-keygen ``` - 3b. Fill out the appropriate vars in `bootstrap/vars/config.yaml` + 2b. Fill out the appropriate vars in `config.yaml` -4. Create Cloudflare API Token +3. Create Cloudflare API Token (_**Skip if not using Cloudflare**_) 📍 _To use `cert-manager` with the Cloudflare DNS challenge you will need to create a API Token._ - 4a. Head over to Cloudflare and create a API Token by going [here](https://dash.cloudflare.com/profile/api-tokens). + 1. Head over to Cloudflare and create a API Token by going [here](https://dash.cloudflare.com/profile/api-tokens). + 2. Under the `API Tokens` section click the blue `Create Token` button. + 3. Click the blue `Use template` button for the `Edit zone DNS` template. + 4. Name your token something like `home-kubernetes` + 5. Under `Permissions`, click `+ Add More` and add each permission below: - 4b. Under the `API Tokens` section click the blue `Create Token` button. + ```text + Zone - DNS - Edit + Account - Cloudflare Tunnel - Read + ``` - 4c. Click the blue `Use template` button for the `Edit zone DNS` template. + 6. Limit the permissions to a specific account and zone resources. + 7. Fill out the appropriate vars in `config.yaml` - 4d. Name your token something like `home-kubernetes` - - 4e. Under `Permissions`, click `+ Add More` and add each permission below: - - ```text - Zone - DNS - Edit - Account - Cloudflare Tunnel - Read - ``` - - 4f. Limit the permissions to a specific account and zone resources. - - 4g. Fill out the appropriate vars in `bootstrap/vars/config.yaml` - -5. Create Cloudflare Tunnel +4. Create Cloudflare Tunnel (_**Skip if not using Cloudflare**_) 📍 _To expose services to the internet you will need to create a [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/)._ - 5a. Authenticate cloudflared to your domain + 1. Authenticate cloudflared to your domain - ```sh - cloudflared tunnel login - ``` + ```sh + cloudflared tunnel login + ``` - 5b. Create the tunnel + 2. Create the tunnel - ```sh - cloudflared tunnel create k8s - ``` + ```sh + cloudflared tunnel create k8s + ``` - 5c. In the `~/.cloudflared` directory there will be a json file with details you need. Ignore the `cert.pem` file. + 3. In the `~/.cloudflared` directory there will be a json file with details you need. Ignore the `cert.pem` file. - 5d. Fill out the appropriate vars in `bootstrap/vars/config.yaml` + 4. Fill out the appropriate vars in `config.yaml` -6. Complete filling out the rest of the `bootstrap/vars/config.yaml` configuration file. +5. Complete filling out the rest of the `config.yaml` configuration file. - 6a. Ensure `bootstrap_acme_production_enabled` is set to `false`. - -7. Once done run the following command which will verify and generate all the files needed to continue. - - 📍 _The following configure task will create a `./ansible` directory for k3s or k0s and the following directories under `./kubernetes` for all distributions_ +6. Once done run the following command which will verify and generate all the files needed to continue. ```sh task configure ``` -8. Push you changes to git +7. Push you changes to git - 📍 **Verify** all the `*.sops.yaml` and `*.sops.yaml` files under the `./ansible`, and `./kubernetes` directories are **encrypted** with SOPS + 📍 **Verify** all the `*.sops.yaml` and `*.sops.yaml` files under `./kubernetes` directory is **encrypted** with SOPS ```sh git add -A @@ -302,11 +295,11 @@ You have two different options for setting up your local workstation. First one git push ``` -9. Continue on to ⚡ [**Stage 4**](#-stage-4-prepare-your-nodes-for-kubernetes) +8. Continue on to ⚡ [**Stage 4**](#-stage-4-prepare-your-nodes-for-kubernetes) ### ⚡ Stage 4: Prepare your nodes for Kubernetes -> [!NOTE] +> [!IMPORTANT] > For **Talos** or **k0s** skip ahead to ⛵ [**Stage 5**](#-stage-5-install-kubernetes) #### k3s @@ -401,7 +394,8 @@ You have two different options for setting up your local workstation. First one ### 🔹 Stage 6: Install Flux in your cluster -📍 _Here we will be installing [flux](https://fluxcd.io/flux/) after some quick bootstrap steps._ +> [!IMPORTANT] +> Skip this stage if you have **disabled** Flux in the `config.yaml` 1. Verify Flux can be installed @@ -433,7 +427,7 @@ You have two different options for setting up your local workstation. First one # source-controller-7d6875bcb4-zqw9f 1/1 Running 0 1h ``` -### 🎤 Verification Steps +### 🎤 Flux w/ Cloudflare verification Steps _Mic check, 1, 2_ - In a few moments applications should be lighting up like Christmas in July 🎄 @@ -451,7 +445,7 @@ _Mic check, 1, 2_ - In a few moments applications should be lighting up like Chr 4. 🧠 Now it's time to pause and go get some motel motor oil ☕ and admire you made it this far! -## 📣 Post installation +## 📣 Flux w/ Cloudflare post installation #### 🌐 Public DNS @@ -504,7 +498,7 @@ By default Flux will periodically check your git repository for changes. In orde 3. Navigate to the settings of your repository on Github, under "Settings/Webhooks" press the "Add webhook" button. Fill in the webhook url and your `bootstrap_flux_github_webhook_token` secret and save. -#### 💥 Nuke +## 💥 Nuke There might be a situation where you want to destroy your Kubernetes cluster. This will completely clean the OS of all traces of the Kubernetes distribution you chose and then reboot the nodes. @@ -515,7 +509,7 @@ task ansible:run playbook=cluster-nuke task k0s:reset ``` -### 🤖 Renovate +## 🤖 Renovate [Renovate](https://www.mend.io/renovate) is a tool that automates dependency management. It is designed to scan your repository around the clock and open PRs for out-of-date dependencies it finds. Common dependencies it can discover are Helm charts, container images, GitHub Actions, Ansible roles... even Flux itself! Merging a PR will cause Flux to apply the update to your cluster. diff --git a/Taskfile.yaml b/Taskfile.yaml index 9885eb28..e7dbd0a4 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -11,7 +11,7 @@ vars: SCRIPTS_DIR: "{{.ROOT_DIR}}/scripts" # Files AGE_FILE: "{{.ROOT_DIR}}/age.key" - BOOTSTRAP_CONFIG_FILE: "{{.BOOTSTRAP_DIR}}/vars/config.yaml" + BOOTSTRAP_CONFIG_FILE: "{{.ROOT_DIR}}/config.yaml" KUBECONFIG_FILE: "{{.ROOT_DIR}}/kubeconfig" MAKEJINJA_CONFIG_FILE: "{{.ROOT_DIR}}/makejinja.toml" PIP_REQUIREMENTS_FILE: "{{.ROOT_DIR}}/requirements.txt" diff --git a/bootstrap/scripts/validation.py b/bootstrap/scripts/validation.py index 7f51a06a..c050fee6 100644 --- a/bootstrap/scripts/validation.py +++ b/bootstrap/scripts/validation.py @@ -1,14 +1,8 @@ -from email_validator import validate_email, EmailNotValidError, EmailUndeliverableError from functools import wraps from shutil import which -from typing import Callable, Optional +from typing import Callable from zoneinfo import available_timezones -import CloudFlare -import json import netaddr -import re -import requests -import socket import sys DISTRIBUTIONS = ["k0s", "k3s", "talos"] @@ -25,54 +19,18 @@ def required(*keys: str): if data.get(key) is None: raise ValueError(f"Missing required key {key}") return func(*[data[key] for key in keys], **kwargs) - return wrapper - return wrapper_outter -def _validate_ip(ip: str) -> str: +def _validate_network(network: str, family: int) -> str: try: - netaddr.IPAddress(ip) - except netaddr.core.AddrFormatError as e: - raise ValueError(f"Invalid IP address {ip}") from e - return ip - - -def _validate_cidr(cidr: str, family: int) -> str: - try: - network = netaddr.IPNetwork(cidr) + network = netaddr.IPNetwork(network) if network.version != family: - raise ValueError(f"Invalid CIDR family {network.version}") + raise ValueError(f"Invalid network family {network.version}") except netaddr.core.AddrFormatError as e: - raise ValueError(f"Invalid CIDR {cidr}") from e - return cidr - - -def _validate_distribution(distribution: str) -> None: - if distribution not in DISTRIBUTIONS: - raise ValueError(f"Invalid distribution {distribution}") - return distribution - - -def _validate_node(node: dict, node_cidr: str, distribution: str) -> None: - if not node.get("name"): - raise ValueError(f"A node is missing a name") - if not node.get("ssh", {}).get("username") and distribution in ["k0s", "k3s"]: - raise ValueError(f"Node {node.get('name')} is missing a SSH username") - if not node.get("talos", {}).get("disk_device") and distribution in ["talos"]: - raise ValueError(f"Node {node.get('name')} is missing a disk device") - if not re.match(r"^[a-z0-9-\.]+$", node.get('name')): - raise ValueError(f"Node {node.get('name')} has an invalid name") - ip = _validate_ip(node.get("address")) - if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr): - raise ValueError(f"Node {node.get('name')} is not in the node CIDR {node_cidr}") - port = 50000 if distribution == "talos" else 22 - with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock: - sock.settimeout(5) - result = sock.connect_ex((ip, port)) - if result != 0: - raise ValueError(f"Node {node.get('name')} port {port} is not open") + raise ValueError(f"Invalid network {network}") from e + return network def validate_python_version() -> None: @@ -81,188 +39,76 @@ def validate_python_version() -> None: raise ValueError(f"Python version is below 3.11. Please upgrade.") -@required("bootstrap_distribution") +@required("distribution") def validate_cli_tools(distribution: str, **_) -> None: - _distribution = _validate_distribution(distribution) + if distribution not in DISTRIBUTIONS: + raise ValueError(f"Invalid distribution {distribution}") for tool in GLOBAL_CLI_TOOLS: if not which(tool): raise ValueError(f"Missing required CLI tool {tool}") - for tool in TALOS_CLI_TOOLS if _distribution in ["talos"] else []: + for tool in TALOS_CLI_TOOLS if distribution in ["talos"] else []: if not which(tool): raise ValueError(f"Missing required CLI tool {tool}") - for tool in K0S_CLI_TOOLS if _distribution in ["k0s"] else []: + for tool in K0S_CLI_TOOLS if distribution in ["k0s"] else []: if not which(tool): raise ValueError(f"Missing required CLI tool {tool}") -@required("bootstrap_distribution") +@required("distribution") def validate_distribution(distribution: str, **_) -> None: - _validate_distribution(distribution) + if distribution not in DISTRIBUTIONS: + raise ValueError(f"Invalid distribution {distribution}") -@required("bootstrap_github_username", "bootstrap_github_repository_name", "bootstrap_advanced_flags") -def validate_github(username: str, repository: str, advanced_flags: dict, **_) -> None: - try: - request = requests.get( - f"https://api.github.com/repos/{username}/{repository}/branches/{advanced_flags.get('github_repository_branch', 'main')}") - if request.status_code != 200: - raise ValueError( - f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found") - except requests.exceptions.RequestException as e: - raise ValueError( - f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found") from e - - -@required("bootstrap_age_public_key") -def validate_age(key: str, **_) -> None: - if not re.match(r"^age1[a-z0-9]{0,58}$", key): - raise ValueError(f"Invalid Age public key {key}") - - -@required("bootstrap_timezone") +@required("timezone") def validate_timezone(timezone: str, **_) -> None: if timezone not in available_timezones(): raise ValueError(f"Invalid timezone {timezone}") -@required("bootstrap_cluster_cidr", "bootstrap_service_cidr", "bootstrap_advanced_flags") -def validate_cluster_cidrs(cluster_cidr: str, service_cidr: str, advanced_flags: dict, **_) -> None: - dual_stack_ipv4_first = advanced_flags.get("dual_stack_ipv4_first", False) +@required("cluster", "feature_gates") +def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None: + dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False) + pod_network = cluster.get("pod_network") + service_network = cluster.get("service_network") - if cluster_cidr == service_cidr: - raise ValueError(f"Cluster CIDR {cluster_cidr} is the same as service CIDR {service_cidr}") + if pod_network == service_network: + raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}") if dual_stack_ipv4_first: - if len(cluster_cidr.split(",")) != 2: - raise ValueError(f"Invalid cluster CIDR {cluster_cidr}") - if len(service_cidr.split(",")) != 2: - raise ValueError(f"Invalid service CIDR {service_cidr}") - cluster_ipv4, cluster_ipv6 = cluster_cidr.split(",") - _validate_cidr(cluster_ipv4, 4) - _validate_cidr(cluster_ipv6, 6) - service_ipv4, service_ipv6 = service_cidr.split(",") - _validate_cidr(service_ipv4, 4) - _validate_cidr(service_ipv6, 6) + if len(pod_network.split(",")) != 2: + raise ValueError(f"Invalid pod network {pod_network}") + if len(service_network.split(",")) != 2: + raise ValueError(f"Invalid service network {service_network}") + cluster_ipv4, cluster_ipv6 = pod_network.split(",") + _validate_network(cluster_ipv4, 4) + _validate_network(cluster_ipv6, 6) + service_ipv4, service_ipv6 = service_network.split(",") + _validate_network(service_ipv4, 4) + _validate_network(service_ipv6, 6) return - if len(cluster_cidr.split(",")) != 1: - raise ValueError(f"Invalid cluster CIDR {cluster_cidr}") - if len(service_cidr.split(",")) != 1: - raise ValueError(f"Invalid service CIDR {service_cidr}") + if len(pod_network.split(",")) != 1: + raise ValueError(f"Invalid pod network {pod_network}") + if len(service_network.split(",")) != 1: + raise ValueError(f"Invalid service network {service_network}") - _validate_cidr(cluster_cidr, 4) - _validate_cidr(service_cidr, 4) + _validate_network(pod_network, 4) + _validate_network(service_network, 4) -@required("bootstrap_acme_email", "bootstrap_acme_production_enabled") -def validate_acme_email(email: str, acme_production: bool, **_) -> None: - try: - validate_email(email) - except EmailUndeliverableError: - pass - except EmailNotValidError as e: - raise ValueError(f"Invalid ACME email {email}") from e - - -@required("bootstrap_flux_github_webhook_token") -def validate_flux_github_webhook_token(token: str, **_) -> None: - if not re.match(r"^[a-zA-Z0-9]+$", token): - raise ValueError(f"Invalid Flux GitHub webhook token ***") - - -@required("bootstrap_cloudflare_domain", "bootstrap_cloudflare_token", "bootstrap_cloudflare_account_tag", - "bootstrap_cloudflare_tunnel_secret", "bootstrap_cloudflare_tunnel_id") -def validate_cloudflare(domain: str, token: str, account_tag: str, tunnel_secret: str, tunnel_id: str, **_) -> None: - try: - cf = CloudFlare.CloudFlare(token=token) - zones = cf.zones.get(params={"name": domain}) - if not zones: - raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it") - except CloudFlare.exceptions.CloudFlareAPIError as e: - raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it") from e - try: - request = requests.get(f"https://api.cloudflare.com/client/v4/accounts/{account_tag}/cfd_tunnel/{tunnel_id}", - headers={"Authorization": f"Bearer {token}"}) - if request.status_code != 200: - raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it") - if not json.loads(request.text)["success"]: - raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it") - except requests.exceptions.RequestException as e: - raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it") from e - - -@required("bootstrap_dns_server") -def validate_bootstrap_dns_server(dns_server: str, **_) -> None: - _validate_ip(dns_server) - - -@required("bootstrap_node_cidr", "bootstrap_kube_api_addr", "bootstrap_k8s_gateway_addr", - "bootstrap_external_ingress_addr", "bootstrap_internal_ingress_addr") -def validate_host_network(node_cidr: str, api_addr: str, gateway_addr: str, external_ingress_addr: str, - internal_ingress_addr: str, **_) -> None: - _validate_cidr(node_cidr, 4) - _validate_ip(api_addr) - _validate_ip(gateway_addr) - _validate_ip(external_ingress_addr) - _validate_ip(internal_ingress_addr) - - addrs = [api_addr, gateway_addr, external_ingress_addr, internal_ingress_addr] - unique = set(addrs) - if len(addrs) != len(unique): - raise ValueError( - f"{api_addr} and {gateway_addr} and {external_ingress_addr} and {internal_ingress_addr} are not unique") - - node_cidr = netaddr.IPNetwork(node_cidr) - if netaddr.IPAddress(api_addr) not in node_cidr: - raise ValueError(f"Kubernetes API address {api_addr} is not in the node CIDR {node_cidr}") - if netaddr.IPAddress(gateway_addr) not in node_cidr: - raise ValueError(f"Kubernetes gateway address {gateway_addr} is not in the node CIDR {node_cidr}") - if netaddr.IPAddress(external_ingress_addr) not in node_cidr: - raise ValueError( - f"Kubernetes external ingress address {external_ingress_addr} is not in the node CIDR {node_cidr}") - if netaddr.IPAddress(internal_ingress_addr) not in node_cidr: - raise ValueError( - f"Kubernetes internal ingress address {internal_ingress_addr} is not in the node CIDR {node_cidr}") - - -@required("bootstrap_node_cidr", "bootstrap_nodes", "bootstrap_distribution") -def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) -> None: - node_cidr = _validate_cidr(node_cidr, 4) - - masters = nodes.get("master", []) - if len(masters) < 1: - raise ValueError(f"Must have at least one master node") - if len(masters) % 2 == 0: - raise ValueError(f"Must have an odd number of master nodes") - for node in masters: - _validate_node(node, node_cidr, distribution) - - workers = nodes.get("worker", []) - for node in workers: - _validate_node(node, node_cidr, distribution) - - -def massage(data: dict) -> dict: - data["bootstrap_advanced_flags"] = data.get("bootstrap_advanced_flags", {}) +def massage_config(data: dict) -> dict: + data["flux"] = data.get("flux", {}) + data["cloudflare"] = data.get("cloudflare", {}) + data["feature_gates"] = data.get("feature_gates", {}) return data + def validate(data: dict) -> None: - user_data = massage(data) + user_config = massage_config(data) validate_python_version() - validate_cli_tools(user_data) - validate_distribution(user_data) - validate_age(user_data) - validate_timezone(user_data) - validate_bootstrap_dns_server(user_data) - validate_cluster_cidrs(user_data) - validate_flux_github_webhook_token(user_data) - validate_host_network(user_data) - validate_acme_email(user_data) - - if not user_data.get("bootstrap_private_github_repo"): - validate_github(user_data) - - if not user_data.get("skip_tests", False): - validate_cloudflare(user_data) - validate_nodes(user_data) + validate_cli_tools(user_config) + validate_distribution(user_config) + validate_timezone(user_config) + validate_cluster_networks(user_config) diff --git a/bootstrap/templates/.sops.yaml.j2 b/bootstrap/templates/.sops.yaml.j2 index dfd6885f..225a2153 100644 --- a/bootstrap/templates/.sops.yaml.j2 +++ b/bootstrap/templates/.sops.yaml.j2 @@ -1,20 +1,22 @@ +#% if flux.enabled %# --- creation_rules: - #% if bootstrap_distribution in ['talos'] %# + #% if distribution in ['talos'] %# - # IMPORTANT: This rule MUST be above the others path_regex: talos/.*\.sops\.ya?ml key_groups: - age: - - "#{ bootstrap_age_public_key }#" + - "#{ flux.sops_age_public_key }#" #% endif %# - path_regex: kubernetes/.*\.sops\.ya?ml encrypted_regex: "^(data|stringData)$" key_groups: - age: - - "#{ bootstrap_age_public_key }#" - #% if bootstrap_distribution in ['k0s', 'k3s'] %# + - "#{ flux.sops_age_public_key }#" + #% if distribution in ['k0s', 'k3s'] %# - path_regex: ansible/.*\.sops\.ya?ml key_groups: - age: - - "#{ bootstrap_age_public_key }#" + - "#{ flux.sops_age_public_key }#" #% endif %# +#% endif %# diff --git a/bootstrap/templates/ansible/.mjfilter.py b/bootstrap/templates/ansible/.mjfilter.py index 9ba2f8d0..1731d858 100644 --- a/bootstrap/templates/ansible/.mjfilter.py +++ b/bootstrap/templates/ansible/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s'] +main = lambda data: data.get("distribution") in ['k0s', 'k3s'] diff --git a/bootstrap/templates/ansible/inventory/.mjfilter.py b/bootstrap/templates/ansible/inventory/.mjfilter.py index 9ba2f8d0..1731d858 100644 --- a/bootstrap/templates/ansible/inventory/.mjfilter.py +++ b/bootstrap/templates/ansible/inventory/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s'] +main = lambda data: data.get("distribution") in ['k0s', 'k3s'] diff --git a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py index c30f515e..c42606ee 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k3s'] +main = lambda data: data.get("distribution") in ['k3s'] diff --git a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 index eef11a47..1a40bf9c 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2 @@ -2,7 +2,7 @@ k3s_become: true k3s_etcd_datastore: true k3s_install_hard_links: true -k3s_registration_address: "#{ bootstrap_kube_api_addr }#" +k3s_registration_address: "#{ cluster.endpoint_vip }#" # renovate: datasource=github-releases depName=k3s-io/k3s k3s_release_version: v1.29.0+k3s1 k3s_server_manifests_templates: diff --git a/bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py b/bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py index c30f515e..c42606ee 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py +++ b/bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k3s'] +main = lambda data: data.get("distribution") in ['k3s'] diff --git a/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 index 2cc1a415..885e3af2 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2 @@ -1,12 +1,12 @@ --- k3s_control_node: true k3s_server: - #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %# - cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#" - service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#" + #% if feature_gates.dual_stack_ipv4_first %# + cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#" + service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#" #% else %# - cluster-cidr: "#{ bootstrap_cluster_cidr }#" - service-cidr: "#{ bootstrap_service_cidr }#" + cluster-cidr: "#{ cluster.pod_network }#" + service-cidr: "#{ cluster.service_network }#" #% endif %# disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"] disable-cloud-controller: true @@ -24,7 +24,7 @@ k3s_server: kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" - #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %# + #% if feature_gates.dual_stack_ipv4_first %# node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" #% else %# node-ip: "{{ ansible_host }}" @@ -32,8 +32,8 @@ k3s_server: pause-image: registry.k8s.io/pause:3.9 secrets-encryption: true tls-san: - - "#{ bootstrap_kube_api_addr }#" - #% for item in bootstrap_kube_additional_tls_sans %# + - "#{ cluster.endpoint_vip }#" + #% for item in cluster.tls_sans %# - "{{ item }}" #% endfor %# write-kubeconfig-mode: "644" diff --git a/bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py b/bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py index c30f515e..c42606ee 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py +++ b/bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k3s'] +main = lambda data: data.get("distribution") in ['k3s'] diff --git a/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 b/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 index 181dc1c7..b372aca9 100644 --- a/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2 @@ -4,7 +4,7 @@ k3s_agent: kubelet-arg: - "image-gc-high-threshold=55" - "image-gc-low-threshold=50" - #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %# + #% if feature_gates.dual_stack_ipv4_first %# node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" #% else %# node-ip: "{{ ansible_host }}" diff --git a/bootstrap/templates/ansible/inventory/hosts.yaml.j2 b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 index aa092f49..b8d5b1c9 100644 --- a/bootstrap/templates/ansible/inventory/hosts.yaml.j2 +++ b/bootstrap/templates/ansible/inventory/hosts.yaml.j2 @@ -3,17 +3,21 @@ kubernetes: children: master: hosts: - #% for item in bootstrap_nodes.master %# + #% for item in cluster.nodes.inventory %# + #% if item.controller %# "#{ item.name }#": - ansible_user: "#{ item.ssh.username }#" + ansible_user: "#{ item.ssh_username }#" ansible_host: "#{ item.address }#" - #% endfor %# - #% if bootstrap_nodes.worker|length > 0 %# + #% endif %# + #% endfor %# + #% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %# worker: hosts: - #% for item in bootstrap_nodes.worker %# + #% for item in cluster.nodes.inventory %# + #% if not item.controller %# "#{ item.name }#": - ansible_user: "#{ item.ssh.username }#" + ansible_user: "#{ item.ssh_username }#" ansible_host: "#{ item.address }#" - #% endfor %# + #% endif %# + #% endfor %# #% endif %# diff --git a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 index 65732202..3a8259f1 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2 @@ -1,4 +1,4 @@ -#% if bootstrap_distribution in ['k3s'] %# +#% if distribution in ['k3s'] %# --- - name: Cluster Installation hosts: kubernetes diff --git a/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 index 075fc7b4..8de99d0d 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2 @@ -10,7 +10,7 @@ ansible.builtin.pause: seconds: 5 tasks: - #% if bootstrap_distribution in ['k3s'] %# + #% if distribution in ['k3s'] %# - name: Ensure Kubernetes is running ansible.builtin.include_role: name: xanmanning.k3s @@ -21,9 +21,9 @@ - name: Upgrade kube-vip ansible.builtin.template: src: templates/kube-vip-ds.yaml.j2 - #% if bootstrap_distribution in ['k3s'] %# + #% if distribution in ['k3s'] %# dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml" - #% elif bootstrap_distribution in ['k0s'] %# + #% elif distribution in ['k0s'] %# dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml" #% endif %# mode: preserve diff --git a/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 index 9762d93a..d1e0e91f 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2 @@ -1,4 +1,4 @@ -#% if bootstrap_distribution in ['k3s'] %# +#% if distribution in ['k3s'] %# --- - name: Cluster Nuke hosts: kubernetes @@ -98,6 +98,6 @@ - name: Reboot ansible.builtin.reboot: - msg: Rebooting nodes + msg: Rebooting hosts reboot_timeout: 3600 #% endif %# diff --git a/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 index ee4cb1c0..92688cc2 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2 @@ -1,4 +1,4 @@ -#% if bootstrap_distribution in ['k3s'] %# +#% if distribution in ['k3s'] %# --- - name: Prepare System hosts: kubernetes @@ -16,7 +16,7 @@ block: - name: Locale | Set timezone community.general.timezone: - name: "#{ bootstrap_timezone }#" + name: "#{ timezone }#" - name: Packages block: @@ -46,7 +46,6 @@ ff02::2 ip6-allrouters dest: /etc/hosts mode: preserve - #% if bootstrap_advanced_flags.update_resolv_conf|default(true) %# # https://github.com/onedr0p/flux-cluster-template/discussions/635 - name: Network Configuration | Remove immutable flag from /etc/resolv.conf ansible.builtin.file: @@ -63,9 +62,10 @@ mode: '0644' dest: /etc/resolv.conf content: | - search . - nameserver #{ bootstrap_dns_server }# - #% endif %# + search #{ cluster.nodes.search_domain|default('.', true) }# + #% for item in cluster.nodes.dns_servers %# + nameserver #{ item }# + #% endfor %# - name: System Configuration notify: Reboot @@ -110,6 +110,6 @@ handlers: - name: Reboot ansible.builtin.reboot: - msg: Rebooting nodes + msg: Rebooting hosts reboot_timeout: 3600 #% endif %# diff --git a/bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2 index 07ae62a8..6fe1fd0d 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2 @@ -11,5 +11,5 @@ tasks: - name: Reboot ansible.builtin.reboot: - msg: Rebooting nodes + msg: Rebooting hosts reboot_timeout: 3600 diff --git a/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 index 1f3e8cfa..66624177 100644 --- a/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 +++ b/bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2 @@ -12,9 +12,9 @@ seconds: 5 tasks: - name: Details - #% if bootstrap_distribution in ['k3s'] %# + #% if distribution in ['k3s'] %# ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json" - #% elif bootstrap_distribution in ['k0s'] %# + #% elif distribution in ['k0s'] %# ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json" #% endif %# register: kubectl_get_node @@ -32,9 +32,9 @@ - name: Cordon kubernetes.core.k8s_drain: name: "{{ inventory_hostname }}" - #% if bootstrap_distribution in ['k3s'] %# + #% if distribution in ['k3s'] %# kubeconfig: /etc/rancher/k3s/k3s.yaml - #% elif bootstrap_distribution in ['k0s'] %# + #% elif distribution in ['k0s'] %# kubeconfig: /var/lib/k0s/pki/admin.conf #% endif %# state: cordon @@ -43,9 +43,9 @@ - name: Drain kubernetes.core.k8s_drain: name: "{{ inventory_hostname }}" - #% if bootstrap_distribution in ['k3s'] %# + #% if distribution in ['k3s'] %# kubeconfig: /etc/rancher/k3s/k3s.yaml - #% elif bootstrap_distribution in ['k0s'] %# + #% elif distribution in ['k0s'] %# kubeconfig: /var/lib/k0s/pki/admin.conf #% endif %# state: drain @@ -78,9 +78,9 @@ - name: Uncordon kubernetes.core.k8s_drain: name: "{{ inventory_hostname }}" - #% if bootstrap_distribution in ['k3s'] %# + #% if distribution in ['k3s'] %# kubeconfig: /etc/rancher/k3s/k3s.yaml - #% elif bootstrap_distribution in ['k0s'] %# + #% elif distribution in ['k0s'] %# kubeconfig: /var/lib/k0s/pki/admin.conf #% endif %# state: uncordon diff --git a/bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py b/bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py index c30f515e..c42606ee 100644 --- a/bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py +++ b/bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k3s'] +main = lambda data: data.get("distribution") in ['k3s'] diff --git a/bootstrap/templates/ansible/playbooks/templates/.mjfilter.py b/bootstrap/templates/ansible/playbooks/templates/.mjfilter.py index c30f515e..c42606ee 100644 --- a/bootstrap/templates/ansible/playbooks/templates/.mjfilter.py +++ b/bootstrap/templates/ansible/playbooks/templates/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k3s'] +main = lambda data: data.get("distribution") in ['k3s'] diff --git a/bootstrap/templates/ansible/requirements.yaml.j2 b/bootstrap/templates/ansible/requirements.yaml.j2 index f0c7e28e..389e8a5f 100644 --- a/bootstrap/templates/ansible/requirements.yaml.j2 +++ b/bootstrap/templates/ansible/requirements.yaml.j2 @@ -8,7 +8,7 @@ collections: version: 8.2.0 - name: kubernetes.core version: 3.0.0 -#% if bootstrap_distribution in ['k3s'] %# +#% if distribution in ['k3s'] %# roles: - name: xanmanning.k3s src: https://github.com/PyratLabs/ansible-role-k3s diff --git a/bootstrap/templates/kubernetes/apps/.mjfilter.py b/bootstrap/templates/kubernetes/apps/.mjfilter.py new file mode 100644 index 00000000..c4c61ac7 --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("flux").get("enabled") == True diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/ks.yaml.j2 deleted file mode 100644 index c473bd3a..00000000 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/ks.yaml.j2 +++ /dev/null @@ -1,23 +0,0 @@ - ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app cert-manager-issuers - namespace: flux-system -spec: - targetNamespace: cert-manager - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: cert-manager - path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app - prune: true - sourceRef: - kind: GitRepository - name: home-kubernetes - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 index 49b4b707..0164d921 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 @@ -32,8 +32,3 @@ spec: nameservers: - "1.1.1.1" - "9.9.9.9" - prometheus: - enabled: true - servicemonitor: - enabled: true - prometheusInstance: observability diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py new file mode 100644 index 00000000..4d67a00b --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("cloudflare").get("enabled") == True diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/issuers.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/issuers.yaml.j2 rename to bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 similarity index 63% rename from bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/secret.sops.yaml.j2 rename to bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 index 51e4c5df..16e7020f 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: cert-manager-secret stringData: - api-token: "#{ bootstrap_cloudflare_token }#" + api-token: "#{ cloudflare.token }#" diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 index 43cdf52e..8a42981b 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 @@ -18,3 +18,27 @@ spec: interval: 30m retryInterval: 1m timeout: 5m +#% if cloudflare.enabled %# +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app cert-manager-issuers + namespace: flux-system +spec: + targetNamespace: cert-manager + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: cert-manager + path: ./kubernetes/apps/cert-manager/cert-manager/issuers + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m +#% endif %# diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/kustomization.yaml.j2 index 6b5358a8..a0a3e5ed 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/kustomization.yaml.j2 @@ -4,4 +4,3 @@ kind: Kustomization resources: - ./namespace.yaml - ./cert-manager/ks.yaml - - ./cert-manager-issuers/ks.yaml diff --git a/bootstrap/templates/kubernetes/apps/flux-system/.mjfilter.py b/bootstrap/templates/kubernetes/apps/flux-system/.mjfilter.py new file mode 100644 index 00000000..239b5e99 --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/flux-system/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True diff --git a/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 index e979b370..10587f8c 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2 @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - - ./addons/ks.yaml + - ./webhooks/ks.yaml diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 similarity index 92% rename from bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 index 74c0a0a6..1bc3dd3f 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2 @@ -1,3 +1,4 @@ +#% if cloudflare.enabled %# --- apiVersion: networking.k8s.io/v1 kind: Ingress @@ -21,3 +22,4 @@ spec: tls: - hosts: - *host +#% endif %# diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 similarity index 76% rename from bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 index 786e654a..95c9dfe5 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2 @@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./secret.sops.yaml + #% if cloudflare.enabled %# - ./ingress.yaml + #% endif %# - ./receiver.yaml diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/receiver.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/receiver.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 similarity index 62% rename from bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 index 6f6c7f97..29fdfdd0 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: github-webhook-token-secret stringData: - token: "#{ bootstrap_flux_github_webhook_token }#" + token: "#{ flux.github.webhook.token }#" diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/ks.yaml.j2 similarity index 87% rename from bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2 rename to bootstrap/templates/kubernetes/apps/flux-system/webhooks/ks.yaml.j2 index 84f17e56..e80c50b2 100644 --- a/bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/flux-system/webhooks/ks.yaml.j2 @@ -9,7 +9,7 @@ spec: commonMetadata: labels: app.kubernetes.io/name: *app - path: ./kubernetes/apps/flux-system/addons/webhooks + path: ./kubernetes/apps/flux-system/webhooks/app prune: true sourceRef: kind: GitRepository diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml.j2 index e8eba26e..caa35cab 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml.j2 @@ -6,7 +6,7 @@ metadata: name: policy spec: loadBalancerIPs: true - # NOTE: This might need to be set if you have more than one active NIC on your nodes + # NOTE: This might need to be set if you have more than one active NIC on your hosts # interfaces: # - ^eno[0-9]+ nodeSelector: diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 index abfe4b79..e20faf1f 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 @@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %# + #% if not feature_gates.dual_stack_ipv4_first %# - ./cilium-l2.yaml #% endif %# - ./helmrelease.yaml diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py index c8c1546d..3f1c50be 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['talos'] +main = lambda data: data.get("distribution") in ['talos'] diff --git a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 index b93c7c8a..eb1f8a4f 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2 @@ -4,11 +4,11 @@ kind: Kustomization resources: - ./namespace.yaml - ./cilium/ks.yaml - #% if bootstrap_distribution in ['talos'] %# + #% if distribution in ['talos'] %# - ./kubelet-csr-approver/ks.yaml #% endif %# - ./metrics-server/ks.yaml - #% if bootstrap_distribution in ['k0s', 'talos'] %# + #% if distribution in ['k0s', 'talos'] %# - ./spegel/ks.yaml #% endif %# - ./reloader/ks.yaml diff --git a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 index b6979d69..ffb498f8 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 @@ -28,7 +28,3 @@ spec: - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - --kubelet-use-node-status-port - --metric-resolution=15s - metrics: - enabled: true - serviceMonitor: - enabled: true diff --git a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 index a3e4d075..3da95417 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 @@ -26,6 +26,3 @@ spec: fullnameOverride: reloader reloader: readOnlyRootFileSystem: true - podMonitor: - enabled: true - namespace: "{{ .Release.Namespace }}" diff --git a/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py b/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py index 74a20e3d..874cddd0 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py +++ b/bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos'] +main = lambda data: data.get("distribution") in ['k0s', 'talos'] diff --git a/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 index fa8ea637..f0a4af49 100644 --- a/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 @@ -24,15 +24,13 @@ spec: keepHistory: false values: spegel: - #% if bootstrap_distribution in ['k0s'] %# + #% if distribution in ['k0s'] %# containerdSock: /run/k0s/containerd.sock containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d - #% elif bootstrap_distribution in ['talos'] %# + #% elif distribution in ['talos'] %# containerdSock: /run/containerd/containerd.sock containerdRegistryConfigPath: /etc/cri/conf.d/hosts #% endif %# service: registry: hostPort: 29999 - serviceMonitor: - enabled: true diff --git a/bootstrap/templates/kubernetes/apps/network/.mjfilter.py b/bootstrap/templates/kubernetes/apps/network/.mjfilter.py new file mode 100644 index 00000000..4d67a00b --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/network/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("cloudflare").get("enabled") == True diff --git a/bootstrap/templates/kubernetes/apps/network/certificates/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/certificates/ks.yaml.j2 deleted file mode 100644 index 97409a50..00000000 --- a/bootstrap/templates/kubernetes/apps/network/certificates/ks.yaml.j2 +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app certificates - namespace: flux-system -spec: - targetNamespace: network - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: cert-manager-issuers - path: ./kubernetes/apps/network/certificates/app - prune: true - sourceRef: - kind: GitRepository - name: home-kubernetes - wait: true - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 index f84a9ea0..200bf3d8 100644 --- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2 @@ -82,9 +82,6 @@ spec: ports: http: port: *port - serviceMonitor: - main: - enabled: true persistence: config: enabled: true diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 index ae71af8a..6a024e25 100644 --- a/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2 @@ -4,10 +4,10 @@ kind: Secret metadata: name: cloudflared-secret stringData: - TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#" + TUNNEL_ID: "#{ cloudflare.tunnel.id }#" credentials.json: | { - "AccountTag": "#{ bootstrap_cloudflare_account_tag }#", - "TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#", - "TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#" + "AccountTag": "#{ cloudflare.tunnel.account_id }#", + "TunnelSecret": "#{ cloudflare.tunnel.secret }#", + "TunnelID": "#{ cloudflare.tunnel.id }#" } diff --git a/bootstrap/templates/kubernetes/apps/network/cloudflared/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/cloudflared/ks.yaml.j2 index ca0995e6..eb8d8da0 100644 --- a/bootstrap/templates/kubernetes/apps/network/cloudflared/ks.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/cloudflared/ks.yaml.j2 @@ -10,7 +10,6 @@ spec: labels: app.kubernetes.io/name: *app dependsOn: - - name: certificates - name: external-dns path: ./kubernetes/apps/network/cloudflared/app prune: true diff --git a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 index fb40ca4e..37d428c9 100644 --- a/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2 @@ -65,8 +65,6 @@ spec: port: *port ingress: main: - enabled: false - external: enabled: true className: external annotations: diff --git a/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 index 76f90410..2527ad40 100644 --- a/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2 @@ -41,7 +41,5 @@ spec: txtPrefix: k8s. txtOwnerId: default domainFilters: ["${SECRET_DOMAIN}"] - serviceMonitor: - enabled: true podAnnotations: secret.reloader.stakater.com/reload: external-dns-secret diff --git a/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 index a5db14e5..4239a8b1 100644 --- a/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2 @@ -4,4 +4,4 @@ kind: Secret metadata: name: external-dns-secret stringData: - api-token: "#{ bootstrap_cloudflare_token }#" + api-token: "#{ cloudflare.token }#" diff --git a/bootstrap/templates/kubernetes/apps/network/certificates/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 similarity index 74% rename from bootstrap/templates/kubernetes/apps/network/certificates/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 index dc42bf33..570e0d8d 100644 --- a/bootstrap/templates/kubernetes/apps/network/certificates/app/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2 @@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./staging.yaml - #% if bootstrap_acme_production_enabled %# + #% if cloudflare.acme.production %# - ./production.yaml #% endif %# diff --git a/bootstrap/templates/kubernetes/apps/network/certificates/app/production.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/production.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/network/certificates/app/production.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/production.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/network/certificates/app/staging.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/staging.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/network/certificates/app/staging.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/staging.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/network/nginx-external/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 similarity index 87% rename from bootstrap/templates/kubernetes/apps/network/nginx-external/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 index 2f7860f8..1c3046c3 100644 --- a/bootstrap/templates/kubernetes/apps/network/nginx-external/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 @@ -2,7 +2,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease metadata: - name: nginx-external + name: ingress-nginx-external spec: interval: 30m chart: @@ -26,13 +26,13 @@ spec: - name: cloudflared namespace: network values: - fullnameOverride: nginx-external + fullnameOverride: ingress-nginx-external controller: replicaCount: 1 service: annotations: external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}" - io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#" + io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#" externalTrafficPolicy: Cluster ingressClassResource: name: external @@ -63,14 +63,8 @@ spec: proxy-body-size: 0 proxy-buffer-size: 16k ssl-protocols: TLSv1.3 TLSv1.2 - metrics: - enabled: true - serviceMonitor: - enabled: true - namespaceSelector: - any: true extraArgs: - #% if bootstrap_acme_production_enabled %# + #% if cloudflare.acme.production %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" #% else %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" @@ -82,7 +76,7 @@ spec: labelSelector: matchLabels: app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: nginx-external + app.kubernetes.io/instance: ingress-nginx-external app.kubernetes.io/component: controller resources: requests: diff --git a/bootstrap/templates/kubernetes/apps/network/nginx-external/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/network/nginx-external/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/network/nginx-internal/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 similarity index 86% rename from bootstrap/templates/kubernetes/apps/network/nginx-internal/app/helmrelease.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 index fa1ff8f7..355a3311 100644 --- a/bootstrap/templates/kubernetes/apps/network/nginx-internal/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 @@ -2,7 +2,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta2 kind: HelmRelease metadata: - name: nginx-internal + name: ingress-nginx-internal namespace: network spec: interval: 30m @@ -24,12 +24,12 @@ spec: uninstall: keepHistory: false values: - fullnameOverride: nginx-internal + fullnameOverride: ingress-nginx-internal controller: replicaCount: 1 service: annotations: - io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#" + io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#" externalTrafficPolicy: Cluster ingressClassResource: name: internal @@ -60,14 +60,8 @@ spec: proxy-body-size: 0 proxy-buffer-size: 16k ssl-protocols: TLSv1.3 TLSv1.2 - metrics: - enabled: true - serviceMonitor: - enabled: true - namespaceSelector: - any: true extraArgs: - #% if bootstrap_acme_production_enabled %# + #% if cloudflare.acme.production %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" #% else %# default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" @@ -79,7 +73,7 @@ spec: labelSelector: matchLabels: app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: nginx-internal + app.kubernetes.io/instance: ingress-nginx-internal app.kubernetes.io/component: controller resources: requests: diff --git a/bootstrap/templates/kubernetes/apps/network/nginx-internal/app/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/kustomization.yaml.j2 similarity index 100% rename from bootstrap/templates/kubernetes/apps/network/nginx-internal/app/kustomization.yaml.j2 rename to bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/kustomization.yaml.j2 diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/ks.yaml.j2 new file mode 100644 index 00000000..99b1abb5 --- /dev/null +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/ks.yaml.j2 @@ -0,0 +1,66 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app ingress-nginx-certificates + namespace: flux-system +spec: + targetNamespace: network + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: cert-manager-issuers + path: ./kubernetes/apps/network/ingress-nginx/certificates + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 5m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app ingress-nginx-internal + namespace: flux-system +spec: + targetNamespace: network + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: ingress-nginx-certificates + path: ./kubernetes/apps/network/ingress-nginx/internal + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: &app ingress-nginx-external + namespace: flux-system +spec: + targetNamespace: network + commonMetadata: + labels: + app.kubernetes.io/name: *app + dependsOn: + - name: ingress-nginx-certificates + path: ./kubernetes/apps/network/ingress-nginx/external + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: false + interval: 30m + retryInterval: 1m + timeout: 5m diff --git a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 index 059e72f5..5b0366ea 100644 --- a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 @@ -30,5 +30,5 @@ spec: type: LoadBalancer port: 53 annotations: - io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#" + io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#" externalTrafficPolicy: Cluster diff --git a/bootstrap/templates/kubernetes/apps/network/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/kustomization.yaml.j2 index e31d0cd8..e6f8ddc1 100644 --- a/bootstrap/templates/kubernetes/apps/network/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/kustomization.yaml.j2 @@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ./namespace.yaml - - ./certificates/ks.yaml - ./cloudflared/ks.yaml - ./echo-server/ks.yaml - ./external-dns/ks.yaml + - ./ingress-nginx/ks.yaml - ./k8s-gateway/ks.yaml - - ./nginx-external/ks.yaml - - ./nginx-internal/ks.yaml diff --git a/bootstrap/templates/kubernetes/apps/network/nginx-external/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/nginx-external/ks.yaml.j2 deleted file mode 100644 index 43a88b89..00000000 --- a/bootstrap/templates/kubernetes/apps/network/nginx-external/ks.yaml.j2 +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app nginx-external - namespace: flux-system -spec: - targetNamespace: network - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: certificates - path: ./kubernetes/apps/network/nginx-external/app - prune: true - sourceRef: - kind: GitRepository - name: home-kubernetes - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/bootstrap/templates/kubernetes/apps/network/nginx-internal/ks.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/nginx-internal/ks.yaml.j2 deleted file mode 100644 index 3a207567..00000000 --- a/bootstrap/templates/kubernetes/apps/network/nginx-internal/ks.yaml.j2 +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1 -kind: Kustomization -metadata: - name: &app nginx-internal - namespace: flux-system -spec: - targetNamespace: network - commonMetadata: - labels: - app.kubernetes.io/name: *app - dependsOn: - - name: certificates - path: ./kubernetes/apps/network/nginx-internal/app - prune: true - sourceRef: - kind: GitRepository - name: home-kubernetes - wait: false - interval: 30m - retryInterval: 1m - timeout: 5m diff --git a/bootstrap/templates/kubernetes/bootstrap/.mjfilter.py b/bootstrap/templates/kubernetes/bootstrap/.mjfilter.py new file mode 100644 index 00000000..c4c61ac7 --- /dev/null +++ b/bootstrap/templates/kubernetes/bootstrap/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("flux").get("enabled") == True diff --git a/bootstrap/templates/kubernetes/flux/.mjfilter.py b/bootstrap/templates/kubernetes/flux/.mjfilter.py new file mode 100644 index 00000000..c4c61ac7 --- /dev/null +++ b/bootstrap/templates/kubernetes/flux/.mjfilter.py @@ -0,0 +1 @@ +main = lambda data: data.get("flux").get("enabled") == True diff --git a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 index 14731981..894f7bdd 100644 --- a/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2 @@ -6,15 +6,13 @@ metadata: namespace: flux-system spec: interval: 30m - ref: - branch: "#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#" - #% if bootstrap_private_github_repo %# + url: "#{ flux.github.address }#" + #% if flux.github.address.startswith('ssh://') %# secretRef: name: github-deploy-key - url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#" - #% else %# - url: "https://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#.git" #% endif %# + ref: + branch: "#{ flux.github.branch|default('main', true) }#" ignore: | # exclude all /* diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2 deleted file mode 100644 index 9be13725..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: backube - namespace: flux-system -spec: - interval: 1h - url: https://backube.github.io/helm-charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/bitnami.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/bitnami.yaml.j2 deleted file mode 100644 index eca160a1..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/bitnami.yaml.j2 +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: bitnami - namespace: flux-system -spec: - type: oci - interval: 5m - url: oci://registry-1.docker.io/bitnamicharts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2 deleted file mode 100644 index e3a16bd1..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: coredns - namespace: flux-system -spec: - interval: 1h - url: https://coredns.github.io/helm diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 deleted file mode 100644 index b48140d7..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: csi-driver-nfs - namespace: flux-system -spec: - interval: 1h - url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-smb.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-smb.yaml.j2 deleted file mode 100644 index a35bd825..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-smb.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: csi-driver-smb - namespace: flux-system -spec: - interval: 1h - url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/descheduler.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/descheduler.yaml.j2 deleted file mode 100644 index 64d63f6e..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/descheduler.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: descheduler - namespace: flux-system -spec: - interval: 1h - url: https://kubernetes-sigs.github.io/descheduler diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 index b76b9662..7bc3d70f 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2 @@ -1,3 +1,4 @@ +#% if cloudflare.enabled %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -7,3 +8,4 @@ metadata: spec: interval: 1h url: https://kubernetes-sigs.github.io/external-dns +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/grafana.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/grafana.yaml.j2 deleted file mode 100644 index 5c3939d5..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/grafana.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: grafana - namespace: flux-system -spec: - interval: 1h - url: https://grafana.github.io/helm-charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 index 4dcf5eea..16c4d056 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2 @@ -1,3 +1,4 @@ +#% if cloudflare.enabled %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -7,3 +8,4 @@ metadata: spec: interval: 1h url: https://kubernetes.github.io/ingress-nginx +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 index 51185b6e..a71ac09c 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2 @@ -1,3 +1,4 @@ +#% if cloudflare.enabled %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -7,3 +8,4 @@ metadata: spec: interval: 1h url: https://ori-edge.github.io/k8s_gateway +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/kubernetes-dashboard.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/kubernetes-dashboard.yaml.j2 deleted file mode 100644 index 976625ce..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/kubernetes-dashboard.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: kubernetes-dashboard - namespace: flux-system -spec: - interval: 1h - url: https://kubernetes.github.io/dashboard diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 index 29df8aaa..bf327ac1 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2 @@ -2,26 +2,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ./backube.yaml - - ./bitnami.yaml - ./bjw-s.yaml - ./cilium.yaml - - ./coredns.yaml - - ./csi-driver-nfs.yaml - - ./csi-driver-smb.yaml - - ./descheduler.yaml + #% if cloudflare.enabled %# - ./external-dns.yaml - - ./grafana.yaml - ./ingress-nginx.yaml - - ./jetstack.yaml - ./k8s-gateway.yaml - - ./kubernetes-dashboard.yaml - - ./longhorn.yaml + #% endif %# + - ./jetstack.yaml - ./metrics-server.yaml - ./openebs.yaml - - ./piraeus.yaml + #% if distribution in ['talos'] %# - ./postfinance.yaml - - ./prometheus-community.yaml + #% endif %# - ./stakater.yaml - - ./weave-gitops.yaml + #% if distribution in ['k0s', 'talos'] %# - ./xenitab.yaml + #% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/longhorn.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/longhorn.yaml.j2 deleted file mode 100644 index bc41510b..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/longhorn.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: longhorn - namespace: flux-system -spec: - interval: 1h - url: https://charts.longhorn.io diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2 deleted file mode 100644 index 5fda1ea6..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: piraeus - namespace: flux-system -spec: - interval: 1h - url: https://piraeus.io/helm-charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 index 84312edd..fa7b9639 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2 @@ -1,3 +1,4 @@ +#% if distribution in ['talos'] %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -7,3 +8,4 @@ metadata: spec: interval: 1h url: https://postfinance.github.io/kubelet-csr-approver +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2 deleted file mode 100644 index a97a3d44..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2 +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: prometheus-community - namespace: flux-system -spec: - type: oci - interval: 5m - url: oci://ghcr.io/prometheus-community/charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/weave-gitops.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/weave-gitops.yaml.j2 deleted file mode 100644 index f325c18b..00000000 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/weave-gitops.yaml.j2 +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: HelmRepository -metadata: - name: weave-gitops - namespace: flux-system -spec: - type: oci - interval: 5m - url: oci://ghcr.io/weaveworks/charts diff --git a/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 b/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 index 31cb1257..6aacb0e4 100644 --- a/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2 @@ -1,3 +1,4 @@ +#% if distribution in ['k0s', 'talos'] %# --- apiVersion: source.toolkit.fluxcd.io/v1beta2 kind: HelmRepository @@ -8,3 +9,4 @@ spec: type: oci interval: 5m url: oci://ghcr.io/xenitab/helm-charts +#% endif %# diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 index c3433127..1b8b6917 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2 @@ -5,6 +5,9 @@ metadata: name: cluster-secrets namespace: flux-system stringData: - SECRET_DOMAIN: "#{ bootstrap_cloudflare_domain }#" - SECRET_ACME_EMAIL: "#{ bootstrap_acme_email }#" - SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#" + SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit... + #% if cloudflare.enabled %# + SECRET_DOMAIN: "#{ cloudflare.domain }#" + SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#" + SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#" + #% endif %# diff --git a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 index 9413471a..bfffc99f 100644 --- a/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 +++ b/bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2 @@ -5,13 +5,9 @@ metadata: name: cluster-settings namespace: flux-system data: - TIMEZONE: "#{ bootstrap_timezone }#" - COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#" - KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#" - CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#" - SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#" - NODE_CIDR: "#{ bootstrap_node_cidr }#" - #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %# - CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#" - SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#" + TIMEZONE: "#{ timezone }#" + CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#" + NODE_CIDR: "#{ cluster.nodes.host_network }#" + #% if feature_gates.dual_stack_ipv4_first %# + CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#" #% endif %# diff --git a/bootstrap/templates/kubernetes/k0s/.mjfilter.py b/bootstrap/templates/kubernetes/k0s/.mjfilter.py index bf90d81d..cd010a61 100644 --- a/bootstrap/templates/kubernetes/k0s/.mjfilter.py +++ b/bootstrap/templates/kubernetes/k0s/.mjfilter.py @@ -1 +1 @@ -main = lambda data: data.get("bootstrap_distribution") in ['k0s'] +main = lambda data: data.get("distribution") in ['k0s'] diff --git a/bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2 b/bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2 index 20d35ce1..8135b0f8 100644 --- a/bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2 +++ b/bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2 @@ -5,14 +5,20 @@ metadata: name: home-kubernetes spec: hosts: - #% for item in bootstrap_nodes.master %# + #% for item in cluster.nodes.inventory %# + #% if item.controller %# - role: controller+worker + #% else %# + - role: worker + #% endif %# ssh: address: "#{ item.address }#" - user: "#{ item.ssh.username }#" + user: "#{ item.ssh_username }#" + #% if item.controller %# installFlags: - --disable-components=metrics-server - --no-taints + #% endif %# files: - name: bootstrap-scripts src: scripts @@ -20,25 +26,9 @@ spec: apply: before: - bash apply-system.sh "#{ item.name }#" + #% if item.controller %# - bash apply-kube-vip.sh - reset: - before: - - bash reset-cilium.sh - after: - - bash reset-system.sh - #% endfor %# - #% for item in bootstrap_nodes.worker %# - - role: worker - ssh: - address: "#{ item.address }#" - user: "#{ item.ssh.username }#" - files: - - name: bootstrap-scripts - src: scripts - hooks: - apply: - before: - - bash apply-system.sh "#{ item.name }#" + #% endif %# reset: before: - bash reset-cilium.sh @@ -65,23 +55,25 @@ spec: listen-metrics-urls: http://0.0.0.0:2381 api: sans: - #% if bootstrap_kube_api_addr %# - - "#{ bootstrap_kube_api_addr }#" + #% if cluster.endpoint_vip %# + - "#{ cluster.endpoint_vip }#" #% endif %# - #% for item in bootstrap_kube_additional_tls_sans %# + #% for item in cluster.tls_sans %# - "#{ item }#" #% endfor %# - #% for item in bootstrap_nodes.master %# + #% for item in controllers %# + #% if item.controller %# - "#{ item.address }#" - "#{ item.name }#" + #% endif %# #% endfor %# network: - podCIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#" - serviceCIDR: "#{ bootstrap_service_cidr.split(',')[0] }#" + podCIDR: "#{ cluster.pod_network.split(',')[0] }#" + serviceCIDR: "#{ cluster.service_network.split(',')[0] }#" provider: custom kubeProxy: disabled: true - nodeLocalLoadBalancing: + sLocalLoadBalancing: enabled: true type: EnvoyProxy extensions: diff --git a/bootstrap/templates/kubernetes/k0s/scripts/apply-system.sh.j2 b/bootstrap/templates/kubernetes/k0s/scripts/apply-system.sh.j2 index fe4ba495..0b72818a 100755 --- a/bootstrap/templates/kubernetes/k0s/scripts/apply-system.sh.j2 +++ b/bootstrap/templates/kubernetes/k0s/scripts/apply-system.sh.j2 @@ -22,7 +22,7 @@ EOF fi # Timezone -timedatectl set-timezone "#{ bootstrap_timezone }#" +timedatectl set-timezone "#{ timezone }#" # Install Packages apt-get install -y --no-install-recommends \ @@ -31,16 +31,16 @@ apt-get install -y --no-install-recommends \ nvme-cli open-iscsi parted psmisc python3 python3-apt python3-kubernetes python3-yaml \ smartmontools socat software-properties-common unzip util-linux -#% if bootstrap_advanced_flags.update_resolv_conf|default(true) %# # Update DNS chattr -i /etc/resolv.conf rm -f /etc/resolv.conf cat >/etc/resolv.conf <