infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: refactor config file (#1267)

Browse Source 
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-28 12:41:31 -05:00
1 parent e4427a8325
commit 889ca07692
114 files changed
+721 -1042
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bootstrap/scripts/validation.py
+48 -202
View File
@@ -1,14 +1,8 @@
from email_validator import validate_email, EmailNotValidError, EmailUndeliverableError
from functools import wraps
from shutil import which
from typing import Callable, Optional
from typing import Callable
from zoneinfo import available_timezones
import CloudFlare
import json
import netaddr
import re
import requests
import socket
import sys
DISTRIBUTIONS = ["k0s", "k3s", "talos"]
@@ -25,54 +19,18 @@ def required(*keys: str):
if data.get(key) is None:
raise ValueError(f"Missing required key {key}")
return func(*[data[key] for key in keys], **kwargs)
return wrapper
return wrapper_outter
def _validate_ip(ip: str) -> str:
def _validate_network(network: str, family: int) -> str:
try:
netaddr.IPAddress(ip)
except netaddr.core.AddrFormatError as e:
raise ValueError(f"Invalid IP address {ip}") from e
return ip
def _validate_cidr(cidr: str, family: int) -> str:
try:
network = netaddr.IPNetwork(cidr)
network = netaddr.IPNetwork(network)
if network.version != family:
raise ValueError(f"Invalid CIDR family {network.version}")
raise ValueError(f"Invalid network family {network.version}")
except netaddr.core.AddrFormatError as e:
raise ValueError(f"Invalid CIDR {cidr}") from e
return cidr
def _validate_distribution(distribution: str) -> None:
if distribution not in DISTRIBUTIONS:
raise ValueError(f"Invalid distribution {distribution}")
return distribution
def _validate_node(node: dict, node_cidr: str, distribution: str) -> None:
if not node.get("name"):
raise ValueError(f"A node is missing a name")
if not node.get("ssh", {}).get("username") and distribution in ["k0s", "k3s"]:
raise ValueError(f"Node {node.get('name')} is missing a SSH username")
if not node.get("talos", {}).get("disk_device") and distribution in ["talos"]:
raise ValueError(f"Node {node.get('name')} is missing a disk device")
if not re.match(r"^[a-z0-9-\.]+$", node.get('name')):
raise ValueError(f"Node {node.get('name')} has an invalid name")
ip = _validate_ip(node.get("address"))
if netaddr.IPAddress(ip, 4) not in netaddr.IPNetwork(node_cidr):
raise ValueError(f"Node {node.get('name')} is not in the node CIDR {node_cidr}")
port = 50000 if distribution == "talos" else 22
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
sock.settimeout(5)
result = sock.connect_ex((ip, port))
if result != 0:
raise ValueError(f"Node {node.get('name')} port {port} is not open")
raise ValueError(f"Invalid network {network}") from e
return network
def validate_python_version() -> None:
@@ -81,188 +39,76 @@ def validate_python_version() -> None:
raise ValueError(f"Python version is below 3.11. Please upgrade.")
@required("bootstrap_distribution")
@required("distribution")
def validate_cli_tools(distribution: str, **_) -> None:
_distribution = _validate_distribution(distribution)
if distribution not in DISTRIBUTIONS:
raise ValueError(f"Invalid distribution {distribution}")
for tool in GLOBAL_CLI_TOOLS:
if not which(tool):
raise ValueError(f"Missing required CLI tool {tool}")
for tool in TALOS_CLI_TOOLS if _distribution in ["talos"] else []:
for tool in TALOS_CLI_TOOLS if distribution in ["talos"] else []:
if not which(tool):
raise ValueError(f"Missing required CLI tool {tool}")
for tool in K0S_CLI_TOOLS if _distribution in ["k0s"] else []:
for tool in K0S_CLI_TOOLS if distribution in ["k0s"] else []:
if not which(tool):
raise ValueError(f"Missing required CLI tool {tool}")
@required("bootstrap_distribution")
@required("distribution")
def validate_distribution(distribution: str, **_) -> None:
_validate_distribution(distribution)
if distribution not in DISTRIBUTIONS:
raise ValueError(f"Invalid distribution {distribution}")
@required("bootstrap_github_username", "bootstrap_github_repository_name", "bootstrap_advanced_flags")
def validate_github(username: str, repository: str, advanced_flags: dict, **_) -> None:
try:
request = requests.get(
f"https://api.github.com/repos/{username}/{repository}/branches/{advanced_flags.get('github_repository_branch', 'main')}")
if request.status_code != 200:
raise ValueError(
f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found")
except requests.exceptions.RequestException as e:
raise ValueError(
f"GitHub repository {username}/{repository} branch {advanced_flags.get('github_repository_branch', 'main')} not found") from e
@required("bootstrap_age_public_key")
def validate_age(key: str, **_) -> None:
if not re.match(r"^age1[a-z0-9]{0,58}$", key):
raise ValueError(f"Invalid Age public key {key}")
@required("bootstrap_timezone")
@required("timezone")
def validate_timezone(timezone: str, **_) -> None:
if timezone not in available_timezones():
raise ValueError(f"Invalid timezone {timezone}")
@required("bootstrap_cluster_cidr", "bootstrap_service_cidr", "bootstrap_advanced_flags")
def validate_cluster_cidrs(cluster_cidr: str, service_cidr: str, advanced_flags: dict, **_) -> None:
dual_stack_ipv4_first = advanced_flags.get("dual_stack_ipv4_first", False)
@required("cluster", "feature_gates")
def validate_cluster_networks(cluster: dict, feature_gates: dict, **_) -> None:
dual_stack_ipv4_first = feature_gates.get("dual_stack_ipv4_first", False)
pod_network = cluster.get("pod_network")
service_network = cluster.get("service_network")
if cluster_cidr == service_cidr:
raise ValueError(f"Cluster CIDR {cluster_cidr} is the same as service CIDR {service_cidr}")
if pod_network == service_network:
raise ValueError(f"Pod network {pod_network} is the same as service network {service_network}")
if dual_stack_ipv4_first:
if len(cluster_cidr.split(",")) != 2:
raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
if len(service_cidr.split(",")) != 2:
raise ValueError(f"Invalid service CIDR {service_cidr}")
cluster_ipv4, cluster_ipv6 = cluster_cidr.split(",")
_validate_cidr(cluster_ipv4, 4)
_validate_cidr(cluster_ipv6, 6)
service_ipv4, service_ipv6 = service_cidr.split(",")
_validate_cidr(service_ipv4, 4)
_validate_cidr(service_ipv6, 6)
if len(pod_network.split(",")) != 2:
raise ValueError(f"Invalid pod network {pod_network}")
if len(service_network.split(",")) != 2:
raise ValueError(f"Invalid service network {service_network}")
cluster_ipv4, cluster_ipv6 = pod_network.split(",")
_validate_network(cluster_ipv4, 4)
_validate_network(cluster_ipv6, 6)
service_ipv4, service_ipv6 = service_network.split(",")
_validate_network(service_ipv4, 4)
_validate_network(service_ipv6, 6)
return
if len(cluster_cidr.split(",")) != 1:
raise ValueError(f"Invalid cluster CIDR {cluster_cidr}")
if len(service_cidr.split(",")) != 1:
raise ValueError(f"Invalid service CIDR {service_cidr}")
if len(pod_network.split(",")) != 1:
raise ValueError(f"Invalid pod network {pod_network}")
if len(service_network.split(",")) != 1:
raise ValueError(f"Invalid service network {service_network}")
_validate_cidr(cluster_cidr, 4)
_validate_cidr(service_cidr, 4)
_validate_network(pod_network, 4)
_validate_network(service_network, 4)
@required("bootstrap_acme_email", "bootstrap_acme_production_enabled")
def validate_acme_email(email: str, acme_production: bool, **_) -> None:
try:
validate_email(email)
except EmailUndeliverableError:
pass
except EmailNotValidError as e:
raise ValueError(f"Invalid ACME email {email}") from e
@required("bootstrap_flux_github_webhook_token")
def validate_flux_github_webhook_token(token: str, **_) -> None:
if not re.match(r"^[a-zA-Z0-9]+$", token):
raise ValueError(f"Invalid Flux GitHub webhook token ***")
@required("bootstrap_cloudflare_domain", "bootstrap_cloudflare_token", "bootstrap_cloudflare_account_tag",
"bootstrap_cloudflare_tunnel_secret", "bootstrap_cloudflare_tunnel_id")
def validate_cloudflare(domain: str, token: str, account_tag: str, tunnel_secret: str, tunnel_id: str, **_) -> None:
try:
cf = CloudFlare.CloudFlare(token=token)
zones = cf.zones.get(params={"name": domain})
if not zones:
raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it")
except CloudFlare.exceptions.CloudFlareAPIError as e:
raise ValueError(f"Cloudflare domain {domain} not found or token does not have access to it") from e
try:
request = requests.get(f"https://api.cloudflare.com/client/v4/accounts/{account_tag}/cfd_tunnel/{tunnel_id}",
headers={"Authorization": f"Bearer {token}"})
if request.status_code != 200:
raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it")
if not json.loads(request.text)["success"]:
raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it")
except requests.exceptions.RequestException as e:
raise ValueError(f"Cloudflare tunnel for {account_tag} not found or token does not have access to it") from e
@required("bootstrap_dns_server")
def validate_bootstrap_dns_server(dns_server: str, **_) -> None:
_validate_ip(dns_server)
@required("bootstrap_node_cidr", "bootstrap_kube_api_addr", "bootstrap_k8s_gateway_addr",
"bootstrap_external_ingress_addr", "bootstrap_internal_ingress_addr")
def validate_host_network(node_cidr: str, api_addr: str, gateway_addr: str, external_ingress_addr: str,
internal_ingress_addr: str, **_) -> None:
_validate_cidr(node_cidr, 4)
_validate_ip(api_addr)
_validate_ip(gateway_addr)
_validate_ip(external_ingress_addr)
_validate_ip(internal_ingress_addr)
addrs = [api_addr, gateway_addr, external_ingress_addr, internal_ingress_addr]
unique = set(addrs)
if len(addrs) != len(unique):
raise ValueError(
f"{api_addr} and {gateway_addr} and {external_ingress_addr} and {internal_ingress_addr} are not unique")
node_cidr = netaddr.IPNetwork(node_cidr)
if netaddr.IPAddress(api_addr) not in node_cidr:
raise ValueError(f"Kubernetes API address {api_addr} is not in the node CIDR {node_cidr}")
if netaddr.IPAddress(gateway_addr) not in node_cidr:
raise ValueError(f"Kubernetes gateway address {gateway_addr} is not in the node CIDR {node_cidr}")
if netaddr.IPAddress(external_ingress_addr) not in node_cidr:
raise ValueError(
f"Kubernetes external ingress address {external_ingress_addr} is not in the node CIDR {node_cidr}")
if netaddr.IPAddress(internal_ingress_addr) not in node_cidr:
raise ValueError(
f"Kubernetes internal ingress address {internal_ingress_addr} is not in the node CIDR {node_cidr}")
@required("bootstrap_node_cidr", "bootstrap_nodes", "bootstrap_distribution")
def validate_nodes(node_cidr: str, nodes: dict[list], distribution: str, **_) -> None:
node_cidr = _validate_cidr(node_cidr, 4)
masters = nodes.get("master", [])
if len(masters) < 1:
raise ValueError(f"Must have at least one master node")
if len(masters) % 2 == 0:
raise ValueError(f"Must have an odd number of master nodes")
for node in masters:
_validate_node(node, node_cidr, distribution)
workers = nodes.get("worker", [])
for node in workers:
_validate_node(node, node_cidr, distribution)
def massage(data: dict) -> dict:
data["bootstrap_advanced_flags"] = data.get("bootstrap_advanced_flags", {})
def massage_config(data: dict) -> dict:
data["flux"] = data.get("flux", {})
data["cloudflare"] = data.get("cloudflare", {})
data["feature_gates"] = data.get("feature_gates", {})
return data
def validate(data: dict) -> None:
user_data = massage(data)
user_config = massage_config(data)
validate_python_version()
validate_cli_tools(user_data)
validate_distribution(user_data)
validate_age(user_data)
validate_timezone(user_data)
validate_bootstrap_dns_server(user_data)
validate_cluster_cidrs(user_data)
validate_flux_github_webhook_token(user_data)
validate_host_network(user_data)
validate_acme_email(user_data)
if not user_data.get("bootstrap_private_github_repo"):
validate_github(user_data)
if not user_data.get("skip_tests", False):
validate_cloudflare(user_data)
validate_nodes(user_data)
validate_cli_tools(user_config)
validate_distribution(user_config)
validate_timezone(user_config)
validate_cluster_networks(user_config)
bootstrap/templates/.sops.yaml.j2
+7 -5
View File
@@ -1,20 +1,22 @@
#% if flux.enabled %#
---
creation_rules:
#% if bootstrap_distribution in ['talos'] %#
#% if distribution in ['talos'] %#
- # IMPORTANT: This rule MUST be above the others
path_regex: talos/.*\.sops\.ya?ml
key_groups:
- age:
- "#{ bootstrap_age_public_key }#"
- "#{ flux.sops_age_public_key }#"
#% endif %#
- path_regex: kubernetes/.*\.sops\.ya?ml
encrypted_regex: "^(data|stringData)$"
key_groups:
- age:
- "#{ bootstrap_age_public_key }#"
#% if bootstrap_distribution in ['k0s', 'k3s'] %#
- "#{ flux.sops_age_public_key }#"
#% if distribution in ['k0s', 'k3s'] %#
- path_regex: ansible/.*\.sops\.ya?ml
key_groups:
- age:
- "#{ bootstrap_age_public_key }#"
- "#{ flux.sops_age_public_key }#"
#% endif %#
#% endif %#
bootstrap/templates/ansible/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
main = lambda data: data.get("distribution") in ['k0s', 'k3s']
bootstrap/templates/ansible/inventory/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'k3s']
main = lambda data: data.get("distribution") in ['k0s', 'k3s']
bootstrap/templates/ansible/inventory/group_vars/kubernetes/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k3s']
main = lambda data: data.get("distribution") in ['k3s']
bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2
+1 -1
View File
@@ -2,7 +2,7 @@
k3s_become: true
k3s_etcd_datastore: true
k3s_install_hard_links: true
k3s_registration_address: "#{ bootstrap_kube_api_addr }#"
k3s_registration_address: "#{ cluster.endpoint_vip }#"
# renovate: datasource=github-releases depName=k3s-io/k3s
k3s_release_version: v1.29.0+k3s1
k3s_server_manifests_templates:
bootstrap/templates/ansible/inventory/group_vars/master/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k3s']
main = lambda data: data.get("distribution") in ['k3s']
bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
+8 -8
View File
@@ -1,12 +1,12 @@
---
k3s_control_node: true
k3s_server:
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
cluster-cidr: "#{ bootstrap_cluster_cidr.split(',')[0] }#,#{ bootstrap_cluster_cidr.split(',')[1] }#"
service-cidr: "#{ bootstrap_service_cidr.split(',')[0] }#,#{ bootstrap_service_cidr.split(',')[1] }#"
#% if feature_gates.dual_stack_ipv4_first %#
cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#"
service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#"
#% else %#
cluster-cidr: "#{ bootstrap_cluster_cidr }#"
service-cidr: "#{ bootstrap_service_cidr }#"
cluster-cidr: "#{ cluster.pod_network }#"
service-cidr: "#{ cluster.service_network }#"
#% endif %#
disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
disable-cloud-controller: true
@@ -24,7 +24,7 @@ k3s_server:
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
#% if feature_gates.dual_stack_ipv4_first %#
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
#% else %#
node-ip: "{{ ansible_host }}"
@@ -32,8 +32,8 @@ k3s_server:
pause-image: registry.k8s.io/pause:3.9
secrets-encryption: true
tls-san:
- "#{ bootstrap_kube_api_addr }#"
#% for item in bootstrap_kube_additional_tls_sans %#
- "#{ cluster.endpoint_vip }#"
#% for item in cluster.tls_sans %#
- "{{ item }}"
#% endfor %#
write-kubeconfig-mode: "644"
bootstrap/templates/ansible/inventory/group_vars/worker/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k3s']
main = lambda data: data.get("distribution") in ['k3s']
bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2
+1 -1
View File
@@ -4,7 +4,7 @@ k3s_agent:
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
#% if feature_gates.dual_stack_ipv4_first %#
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
#% else %#
node-ip: "{{ ansible_host }}"
bootstrap/templates/ansible/inventory/hosts.yaml.j2
+11 -7
View File
@@ -3,17 +3,21 @@ kubernetes:
children:
master:
hosts:
#% for item in bootstrap_nodes.master %#
#% for item in cluster.nodes.inventory %#
#% if item.controller %#
"#{ item.name }#":
ansible_user: "#{ item.ssh.username }#"
ansible_user: "#{ item.ssh_username }#"
ansible_host: "#{ item.address }#"
#% endfor %#
#% if bootstrap_nodes.worker|length > 0 %#
#% endif %#
#% endfor %#
#% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %#
worker:
hosts:
#% for item in bootstrap_nodes.worker %#
#% for item in cluster.nodes.inventory %#
#% if not item.controller %#
"#{ item.name }#":
ansible_user: "#{ item.ssh.username }#"
ansible_user: "#{ item.ssh_username }#"
ansible_host: "#{ item.address }#"
#% endfor %#
#% endif %#
#% endfor %#
#% endif %#
bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2
+1 -1
View File
@@ -1,4 +1,4 @@
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
---
- name: Cluster Installation
hosts: kubernetes
bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2
+3 -3
View File
@@ -10,7 +10,7 @@
ansible.builtin.pause:
seconds: 5
tasks:
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
- name: Ensure Kubernetes is running
ansible.builtin.include_role:
name: xanmanning.k3s
@@ -21,9 +21,9 @@
- name: Upgrade kube-vip
ansible.builtin.template:
src: templates/kube-vip-ds.yaml.j2
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml"
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
#% endif %#
mode: preserve
bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
---
- name: Cluster Nuke
hosts: kubernetes
@@ -98,6 +98,6 @@
- name: Reboot
ansible.builtin.reboot:
msg: Rebooting nodes
msg: Rebooting hosts
reboot_timeout: 3600
#% endif %#
bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2
+7 -7
View File
@@ -1,4 +1,4 @@
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
---
- name: Prepare System
hosts: kubernetes
@@ -16,7 +16,7 @@
block:
- name: Locale | Set timezone
community.general.timezone:
name: "#{ bootstrap_timezone }#"
name: "#{ timezone }#"
- name: Packages
block:
@@ -46,7 +46,6 @@
ff02::2 ip6-allrouters
dest: /etc/hosts
mode: preserve
#% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
# https://github.com/onedr0p/flux-cluster-template/discussions/635
- name: Network Configuration | Remove immutable flag from /etc/resolv.conf
ansible.builtin.file:
@@ -63,9 +62,10 @@
mode: '0644'
dest: /etc/resolv.conf
content: |
search .
nameserver #{ bootstrap_dns_server }#
#% endif %#
search #{ cluster.nodes.search_domain|default('.', true) }#
#% for item in cluster.nodes.dns_servers %#
nameserver #{ item }#
#% endfor %#
- name: System Configuration
notify: Reboot
@@ -110,6 +110,6 @@
handlers:
- name: Reboot
ansible.builtin.reboot:
msg: Rebooting nodes
msg: Rebooting hosts
reboot_timeout: 3600
#% endif %#
bootstrap/templates/ansible/playbooks/cluster-reboot.yaml.j2
+1 -1
View File
@@ -11,5 +11,5 @@
tasks:
- name: Reboot
ansible.builtin.reboot:
msg: Rebooting nodes
msg: Rebooting hosts
reboot_timeout: 3600
bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2
+8 -8
View File
@@ -12,9 +12,9 @@
seconds: 5
tasks:
- name: Details
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json"
#% endif %#
register: kubectl_get_node
@@ -32,9 +32,9 @@
- name: Cordon
kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}"
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %#
state: cordon
@@ -43,9 +43,9 @@
- name: Drain
kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}"
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %#
state: drain
@@ -78,9 +78,9 @@
- name: Uncordon
kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}"
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %#
state: uncordon
bootstrap/templates/ansible/playbooks/tasks/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k3s']
main = lambda data: data.get("distribution") in ['k3s']
bootstrap/templates/ansible/playbooks/templates/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k3s']
main = lambda data: data.get("distribution") in ['k3s']
bootstrap/templates/ansible/requirements.yaml.j2
+1 -1
View File
@@ -8,7 +8,7 @@ collections:
version: 8.2.0
- name: kubernetes.core
version: 3.0.0
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
roles:
- name: xanmanning.k3s
src: https://github.com/PyratLabs/ansible-role-k3s
bootstrap/templates/kubernetes/apps/.mjfilter.py
+1
View File
@@ -0,0 +1 @@
main = lambda data: data.get("flux").get("enabled") == True
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/ks.yaml.j2
-23
View File
@@ -1,23 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app cert-manager-issuers
namespace: flux-system
spec:
targetNamespace: cert-manager
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: cert-manager
path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2
-5
View File
@@ -32,8 +32,3 @@ spec:
nameservers:
- "1.1.1.1"
- "9.9.9.9"
prometheus:
enabled: true
servicemonitor:
enabled: true
prometheusInstance: observability
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/.mjfilter.py
+1
View File
@@ -0,0 +1 @@
main = lambda data: data.get("cloudflare").get("enabled") == True
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/issuers.yaml.j2 → bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager-issuers/app/secret.sops.yaml.j2 → bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata:
name: cert-manager-secret
stringData:
api-token: "#{ bootstrap_cloudflare_token }#"
api-token: "#{ cloudflare.token }#"
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
+24
View File
@@ -18,3 +18,27 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
#% if cloudflare.enabled %#
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app cert-manager-issuers
namespace: flux-system
spec:
targetNamespace: cert-manager
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: cert-manager
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
#% endif %#
bootstrap/templates/kubernetes/apps/cert-manager/kustomization.yaml.j2
-1
View File
@@ -4,4 +4,3 @@ kind: Kustomization
resources:
- ./namespace.yaml
- ./cert-manager/ks.yaml
- ./cert-manager-issuers/ks.yaml
bootstrap/templates/kubernetes/apps/flux-system/.mjfilter.py
+1
View File
@@ -0,0 +1 @@
main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True
bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2
+1 -1
View File
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./addons/ks.yaml
- ./webhooks/ks.yaml
bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
#% if cloudflare.enabled %#
---
apiVersion: networking.k8s.io/v1
kind: Ingress
@@ -21,3 +22,4 @@ spec:
tls:
- hosts:
- *host
#% endif %#
bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2
+2
View File
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
#% if cloudflare.enabled %#
- ./ingress.yaml
#% endif %#
- ./receiver.yaml
bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/receiver.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata:
name: github-webhook-token-secret
stringData:
token: "#{ bootstrap_flux_github_webhook_token }#"
token: "#{ flux.github.webhook.token }#"
bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/kustomization.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/flux-system/addons/ks.yaml.j2 → bootstrap/templates/kubernetes/apps/flux-system/webhooks/ks.yaml.j2
+1 -1
View File
@@ -9,7 +9,7 @@ spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./kubernetes/apps/flux-system/addons/webhooks
path: ./kubernetes/apps/flux-system/webhooks/app
prune: true
sourceRef:
kind: GitRepository
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml.j2
+1 -1
View File
@@ -6,7 +6,7 @@ metadata:
name: policy
spec:
loadBalancerIPs: true
# NOTE: This might need to be set if you have more than one active NIC on your nodes
# NOTE: This might need to be set if you have more than one active NIC on your hosts
# interfaces:
# - ^eno[0-9]+
nodeSelector:
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
+1 -1
View File
@@ -2,7 +2,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
#% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
#% if not feature_gates.dual_stack_ipv4_first %#
- ./cilium-l2.yaml
#% endif %#
- ./helmrelease.yaml
bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['talos']
main = lambda data: data.get("distribution") in ['talos']
bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
+2 -2
View File
@@ -4,11 +4,11 @@ kind: Kustomization
resources:
- ./namespace.yaml
- ./cilium/ks.yaml
#% if bootstrap_distribution in ['talos'] %#
#% if distribution in ['talos'] %#
- ./kubelet-csr-approver/ks.yaml
#% endif %#
- ./metrics-server/ks.yaml
#% if bootstrap_distribution in ['k0s', 'talos'] %#
#% if distribution in ['k0s', 'talos'] %#
- ./spegel/ks.yaml
#% endif %#
- ./reloader/ks.yaml
bootstrap/templates/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2
-4
View File
@@ -28,7 +28,3 @@ spec:
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
metrics:
enabled: true
serviceMonitor:
enabled: true
bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2
-3
View File
@@ -26,6 +26,3 @@ spec:
fullnameOverride: reloader
reloader:
readOnlyRootFileSystem: true
podMonitor:
enabled: true
namespace: "{{ .Release.Namespace }}"
bootstrap/templates/kubernetes/apps/kube-system/spegel/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']
main = lambda data: data.get("distribution") in ['k0s', 'talos']
bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2
+2 -4
View File
@@ -24,15 +24,13 @@ spec:
keepHistory: false
values:
spegel:
#% if bootstrap_distribution in ['k0s'] %#
#% if distribution in ['k0s'] %#
containerdSock: /run/k0s/containerd.sock
containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
#% elif bootstrap_distribution in ['talos'] %#
#% elif distribution in ['talos'] %#
containerdSock: /run/containerd/containerd.sock
containerdRegistryConfigPath: /etc/cri/conf.d/hosts
#% endif %#
service:
registry:
hostPort: 29999
serviceMonitor:
enabled: true
bootstrap/templates/kubernetes/apps/network/.mjfilter.py
+1
View File
@@ -0,0 +1 @@
main = lambda data: data.get("cloudflare").get("enabled") == True
bootstrap/templates/kubernetes/apps/network/certificates/ks.yaml.j2
-22
View File
@@ -1,22 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app certificates
namespace: flux-system
spec:
targetNamespace: network
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: cert-manager-issuers
path: ./kubernetes/apps/network/certificates/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2
-3
View File
@@ -82,9 +82,6 @@ spec:
ports:
http:
port: *port
serviceMonitor:
main:
enabled: true
persistence:
config:
enabled: true
bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2
+4 -4
View File
@@ -4,10 +4,10 @@ kind: Secret
metadata:
name: cloudflared-secret
stringData:
TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
credentials.json: |
{
"AccountTag": "#{ bootstrap_cloudflare_account_tag }#",
"TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#",
"TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#"
"AccountTag": "#{ cloudflare.tunnel.account_id }#",
"TunnelSecret": "#{ cloudflare.tunnel.secret }#",
"TunnelID": "#{ cloudflare.tunnel.id }#"
}
bootstrap/templates/kubernetes/apps/network/cloudflared/ks.yaml.j2
-1
View File
@@ -10,7 +10,6 @@ spec:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: certificates
- name: external-dns
path: ./kubernetes/apps/network/cloudflared/app
prune: true
bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2
-2
View File
@@ -65,8 +65,6 @@ spec:
port: *port
ingress:
main:
enabled: false
external:
enabled: true
className: external
annotations:
bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2
-2
View File
@@ -41,7 +41,5 @@ spec:
txtPrefix: k8s.
txtOwnerId: default
domainFilters: ["${SECRET_DOMAIN}"]
serviceMonitor:
enabled: true
podAnnotations:
secret.reloader.stakater.com/reload: external-dns-secret
bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata:
name: external-dns-secret
stringData:
api-token: "#{ bootstrap_cloudflare_token }#"
api-token: "#{ cloudflare.token }#"
bootstrap/templates/kubernetes/apps/network/certificates/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2
+1 -1
View File
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./staging.yaml
#% if bootstrap_acme_production_enabled %#
#% if cloudflare.acme.production %#
- ./production.yaml
#% endif %#
bootstrap/templates/kubernetes/apps/network/certificates/app/production.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/production.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/network/certificates/app/staging.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/staging.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/network/nginx-external/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2
Vendored
+5 -11
View File
@@ -2,7 +2,7 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
name: nginx-external
name: ingress-nginx-external
spec:
interval: 30m
chart:
@@ -26,13 +26,13 @@ spec:
- name: cloudflared
namespace: network
values:
fullnameOverride: nginx-external
fullnameOverride: ingress-nginx-external
controller:
replicaCount: 1
service:
annotations:
external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#"
io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
externalTrafficPolicy: Cluster
ingressClassResource:
name: external
@@ -63,14 +63,8 @@ spec:
proxy-body-size: 0
proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2
metrics:
enabled: true
serviceMonitor:
enabled: true
namespaceSelector:
any: true
extraArgs:
#% if bootstrap_acme_production_enabled %#
#% if cloudflare.acme.production %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
#% else %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -82,7 +76,7 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/instance: nginx-external
app.kubernetes.io/instance: ingress-nginx-external
app.kubernetes.io/component: controller
resources:
requests:
bootstrap/templates/kubernetes/apps/network/nginx-external/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/kustomization.yaml.j2
Vendored
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/network/nginx-internal/app/helmrelease.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2
+5 -11
View File
@@ -2,7 +2,7 @@
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
name: nginx-internal
name: ingress-nginx-internal
namespace: network
spec:
interval: 30m
@@ -24,12 +24,12 @@ spec:
uninstall:
keepHistory: false
values:
fullnameOverride: nginx-internal
fullnameOverride: ingress-nginx-internal
controller:
replicaCount: 1
service:
annotations:
io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
externalTrafficPolicy: Cluster
ingressClassResource:
name: internal
@@ -60,14 +60,8 @@ spec:
proxy-body-size: 0
proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2
metrics:
enabled: true
serviceMonitor:
enabled: true
namespaceSelector:
any: true
extraArgs:
#% if bootstrap_acme_production_enabled %#
#% if cloudflare.acme.production %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
#% else %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -79,7 +73,7 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/instance: nginx-internal
app.kubernetes.io/instance: ingress-nginx-internal
app.kubernetes.io/component: controller
resources:
requests:
bootstrap/templates/kubernetes/apps/network/nginx-internal/app/kustomization.yaml.j2 → bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/kustomization.yaml.j2
View File
File renamed without changes.
bootstrap/templates/kubernetes/apps/network/ingress-nginx/ks.yaml.j2
+66
View File
@@ -0,0 +1,66 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app ingress-nginx-certificates
namespace: flux-system
spec:
targetNamespace: network
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: cert-manager-issuers
path: ./kubernetes/apps/network/ingress-nginx/certificates
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app ingress-nginx-internal
namespace: flux-system
spec:
targetNamespace: network
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: ingress-nginx-certificates
path: ./kubernetes/apps/network/ingress-nginx/internal
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app ingress-nginx-external
namespace: flux-system
spec:
targetNamespace: network
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: ingress-nginx-certificates
path: ./kubernetes/apps/network/ingress-nginx/external
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m
bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2
+1 -1
View File
@@ -30,5 +30,5 @@ spec:
type: LoadBalancer
port: 53
annotations:
io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#"
io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
externalTrafficPolicy: Cluster
bootstrap/templates/kubernetes/apps/network/kustomization.yaml.j2
+1 -3
View File
@@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./certificates/ks.yaml
- ./cloudflared/ks.yaml
- ./echo-server/ks.yaml
- ./external-dns/ks.yaml
- ./ingress-nginx/ks.yaml
- ./k8s-gateway/ks.yaml
- ./nginx-external/ks.yaml
- ./nginx-internal/ks.yaml
bootstrap/templates/kubernetes/apps/network/nginx-external/ks.yaml.j2
-22
View File
@@ -1,22 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app nginx-external
namespace: flux-system
spec:
targetNamespace: network
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: certificates
path: ./kubernetes/apps/network/nginx-external/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m
bootstrap/templates/kubernetes/apps/network/nginx-internal/ks.yaml.j2
-22
View File
@@ -1,22 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app nginx-internal
namespace: flux-system
spec:
targetNamespace: network
commonMetadata:
labels:
app.kubernetes.io/name: *app
dependsOn:
- name: certificates
path: ./kubernetes/apps/network/nginx-internal/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m
bootstrap/templates/kubernetes/bootstrap/.mjfilter.py
+1
View File
@@ -0,0 +1 @@
main = lambda data: data.get("flux").get("enabled") == True
bootstrap/templates/kubernetes/flux/.mjfilter.py
+1
View File
@@ -0,0 +1 @@
main = lambda data: data.get("flux").get("enabled") == True
bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2
+4 -6
View File
@@ -6,15 +6,13 @@ metadata:
namespace: flux-system
spec:
interval: 30m
ref:
branch: "#{ bootstrap_advanced_flags.github_repository_branch|default('main', true) }#"
#% if bootstrap_private_github_repo %#
url: "#{ flux.github.address }#"
#% if flux.github.address.startswith('ssh://') %#
secretRef:
name: github-deploy-key
url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#"
#% else %#
url: "https://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#.git"
#% endif %#
ref:
branch: "#{ flux.github.branch|default('main', true) }#"
ignore: |
# exclude all
/*
bootstrap/templates/kubernetes/flux/repositories/helm/backube.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: backube
namespace: flux-system
spec:
interval: 1h
url: https://backube.github.io/helm-charts
bootstrap/templates/kubernetes/flux/repositories/helm/bitnami.yaml.j2
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: bitnami
namespace: flux-system
spec:
type: oci
interval: 5m
url: oci://registry-1.docker.io/bitnamicharts
bootstrap/templates/kubernetes/flux/repositories/helm/coredns.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: coredns
namespace: flux-system
spec:
interval: 1h
url: https://coredns.github.io/helm
bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-nfs.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: csi-driver-nfs
namespace: flux-system
spec:
interval: 1h
url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
bootstrap/templates/kubernetes/flux/repositories/helm/csi-driver-smb.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: csi-driver-smb
namespace: flux-system
spec:
interval: 1h
url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
bootstrap/templates/kubernetes/flux/repositories/helm/descheduler.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: descheduler
namespace: flux-system
spec:
interval: 1h
url: https://kubernetes-sigs.github.io/descheduler
bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
#% if cloudflare.enabled %#
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
spec:
interval: 1h
url: https://kubernetes-sigs.github.io/external-dns
#% endif %#
bootstrap/templates/kubernetes/flux/repositories/helm/grafana.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: grafana
namespace: flux-system
spec:
interval: 1h
url: https://grafana.github.io/helm-charts
bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
#% if cloudflare.enabled %#
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
spec:
interval: 1h
url: https://kubernetes.github.io/ingress-nginx
#% endif %#
bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
#% if cloudflare.enabled %#
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
spec:
interval: 1h
url: https://ori-edge.github.io/k8s_gateway
#% endif %#
bootstrap/templates/kubernetes/flux/repositories/helm/kubernetes-dashboard.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: kubernetes-dashboard
namespace: flux-system
spec:
interval: 1h
url: https://kubernetes.github.io/dashboard
bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2
+7 -13
View File
@@ -2,26 +2,20 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./backube.yaml
- ./bitnami.yaml
- ./bjw-s.yaml
- ./cilium.yaml
- ./coredns.yaml
- ./csi-driver-nfs.yaml
- ./csi-driver-smb.yaml
- ./descheduler.yaml
#% if cloudflare.enabled %#
- ./external-dns.yaml
- ./grafana.yaml
- ./ingress-nginx.yaml
- ./jetstack.yaml
- ./k8s-gateway.yaml
- ./kubernetes-dashboard.yaml
- ./longhorn.yaml
#% endif %#
- ./jetstack.yaml
- ./metrics-server.yaml
- ./openebs.yaml
- ./piraeus.yaml
#% if distribution in ['talos'] %#
- ./postfinance.yaml
- ./prometheus-community.yaml
#% endif %#
- ./stakater.yaml
- ./weave-gitops.yaml
#% if distribution in ['k0s', 'talos'] %#
- ./xenitab.yaml
#% endif %#
bootstrap/templates/kubernetes/flux/repositories/helm/longhorn.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: longhorn
namespace: flux-system
spec:
interval: 1h
url: https://charts.longhorn.io
bootstrap/templates/kubernetes/flux/repositories/helm/piraeus.yaml.j2
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: piraeus
namespace: flux-system
spec:
interval: 1h
url: https://piraeus.io/helm-charts
bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
#% if distribution in ['talos'] %#
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
@@ -7,3 +8,4 @@ metadata:
spec:
interval: 1h
url: https://postfinance.github.io/kubelet-csr-approver
#% endif %#
bootstrap/templates/kubernetes/flux/repositories/helm/prometheus-community.yaml.j2
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: prometheus-community
namespace: flux-system
spec:
type: oci
interval: 5m
url: oci://ghcr.io/prometheus-community/charts
bootstrap/templates/kubernetes/flux/repositories/helm/weave-gitops.yaml.j2
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: weave-gitops
namespace: flux-system
spec:
type: oci
interval: 5m
url: oci://ghcr.io/weaveworks/charts
bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2
+2
View File
@@ -1,3 +1,4 @@
#% if distribution in ['k0s', 'talos'] %#
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
@@ -8,3 +9,4 @@ spec:
type: oci
interval: 5m
url: oci://ghcr.io/xenitab/helm-charts
#% endif %#
bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2
+6 -3
View File
@@ -5,6 +5,9 @@ metadata:
name: cluster-secrets
namespace: flux-system
stringData:
SECRET_DOMAIN: "#{ bootstrap_cloudflare_domain }#"
SECRET_ACME_EMAIL: "#{ bootstrap_acme_email }#"
SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
#% if cloudflare.enabled %#
SECRET_DOMAIN: "#{ cloudflare.domain }#"
SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#"
SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
#% endif %#
bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2
+5 -9
View File
@@ -5,13 +5,9 @@ metadata:
name: cluster-settings
namespace: flux-system
data:
TIMEZONE: "#{ bootstrap_timezone }#"
COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#"
KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#"
CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
NODE_CIDR: "#{ bootstrap_node_cidr }#"
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
TIMEZONE: "#{ timezone }#"
CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#"
NODE_CIDR: "#{ cluster.nodes.host_network }#"
#% if feature_gates.dual_stack_ipv4_first %#
CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#"
#% endif %#
bootstrap/templates/kubernetes/k0s/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['k0s']
main = lambda data: data.get("distribution") in ['k0s']
bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2
+19 -27
View File
@@ -5,14 +5,20 @@ metadata:
name: home-kubernetes
spec:
hosts:
#% for item in bootstrap_nodes.master %#
#% for item in cluster.nodes.inventory %#
#% if item.controller %#
- role: controller+worker
#% else %#
- role: worker
#% endif %#
ssh:
address: "#{ item.address }#"
user: "#{ item.ssh.username }#"
user: "#{ item.ssh_username }#"
#% if item.controller %#
installFlags:
- --disable-components=metrics-server
- --no-taints
#% endif %#
files:
- name: bootstrap-scripts
src: scripts
@@ -20,25 +26,9 @@ spec:
apply:
before:
- bash apply-system.sh "#{ item.name }#"
#% if item.controller %#
- bash apply-kube-vip.sh
reset:
before:
- bash reset-cilium.sh
after:
- bash reset-system.sh
#% endfor %#
#% for item in bootstrap_nodes.worker %#
- role: worker
ssh:
address: "#{ item.address }#"
user: "#{ item.ssh.username }#"
files:
- name: bootstrap-scripts
src: scripts
hooks:
apply:
before:
- bash apply-system.sh "#{ item.name }#"
#% endif %#
reset:
before:
- bash reset-cilium.sh
@@ -65,23 +55,25 @@ spec:
listen-metrics-urls: http://0.0.0.0:2381
api:
sans:
#% if bootstrap_kube_api_addr %#
- "#{ bootstrap_kube_api_addr }#"
#% if cluster.endpoint_vip %#
- "#{ cluster.endpoint_vip }#"
#% endif %#
#% for item in bootstrap_kube_additional_tls_sans %#
#% for item in cluster.tls_sans %#
- "#{ item }#"
#% endfor %#
#% for item in bootstrap_nodes.master %#
#% for item in controllers %#
#% if item.controller %#
- "#{ item.address }#"
- "#{ item.name }#"
#% endif %#
#% endfor %#
network:
podCIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
serviceCIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
podCIDR: "#{ cluster.pod_network.split(',')[0] }#"
serviceCIDR: "#{ cluster.service_network.split(',')[0] }#"
provider: custom
kubeProxy:
disabled: true
nodeLocalLoadBalancing:
sLocalLoadBalancing:
enabled: true
type: EnvoyProxy
extensions:
bootstrap/templates/kubernetes/k0s/scripts/apply-system.sh.j2
+5 -5
View File
@@ -22,7 +22,7 @@ EOF
fi
# Timezone
timedatectl set-timezone "#{ bootstrap_timezone }#"
timedatectl set-timezone "#{ timezone }#"
# Install Packages
apt-get install -y --no-install-recommends \
@@ -31,16 +31,16 @@ apt-get install -y --no-install-recommends \
nvme-cli open-iscsi parted psmisc python3 python3-apt python3-kubernetes python3-yaml \
smartmontools socat software-properties-common unzip util-linux
#% if bootstrap_advanced_flags.update_resolv_conf|default(true) %#
# Update DNS
chattr -i /etc/resolv.conf
rm -f /etc/resolv.conf
cat >/etc/resolv.conf <<EOF
search .
nameserver #{ bootstrap_dns_server }#
search #{ cluster.nodes.search_domain|default('.', true) }#
#% for item in cluster.nodes.dns_servers %#
nameserver #{ item }#
#% endfor %#
EOF
chattr +i /etc/resolv.conf
#% endif %#
# Kernel Modules
for module in br_netfilter ceph ip_vs ip_vs_rr nbd overlay rbd; do
bootstrap/templates/kubernetes/talos/.mjfilter.py
+1 -1
View File
@@ -1 +1 @@
main = lambda data: data.get("bootstrap_distribution") in ['talos']
main = lambda data: data.get("distribution") in ['talos']
bootstrap/templates/kubernetes/talos/talconfig.yaml.j2
+22 -34
View File
@@ -6,15 +6,15 @@ talosVersion: v1.6.3
kubernetesVersion: v1.29.1
clusterName: &cluster home-kubernetes
endpoint: https://#{ bootstrap_kube_api_addr }#:6443
endpoint: https://#{ cluster.endpoint_vip }#:6443
clusterPodNets:
- "#{ bootstrap_cluster_cidr.split(',')[0] }#"
- "#{ cluster.pod_network.split(',')[0] }#"
clusterSvcNets:
- "#{ bootstrap_service_cidr.split(',')[0] }#"
- "#{ cluster.service_network.split(',')[0] }#"
additionalApiServerCertSans: &sans
- "#{ bootstrap_kube_api_addr }#"
- "#{ cluster.endpoint_vip }#"
- 127.0.0.1
#% for item in bootstrap_kube_additional_tls_sans %#
#% for item in cluster.tls_sans %#
- "#{ item }#"
#% endfor %#
additionalMachineCertSans: *sans
@@ -22,47 +22,33 @@ cniConfig:
name: none
nodes:
#% for item in bootstrap_nodes.master %#
#% for item in cluster.nodes.inventory %#
- hostname: "#{ item.name }#"
ipAddress: "#{ item.address }#"
#% if item.talos.disk_device.startswith('/') %#
installDisk: "#{ item.talos.disk_device }#"
#% if item.talos_disk_device.startswith('/') %#
installDisk: "#{ item.talos_disk_device }#"
#% else %#
installDiskSelector:
serial: "#{ item.talos.disk_device }#"
serial: "#{ item.talos_disk_device }#"
#% endif %#
#% if item.controller %#
controlPlane: true
networkInterfaces:
- interface: eth0
dhcp: false
addresses:
- "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
mtu: 1500
routes:
- network: 0.0.0.0/0
gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
vip:
ip: "#{ bootstrap_kube_api_addr }#"
#% endfor %#
#% for item in bootstrap_nodes.worker %#
- hostname: "#{ item.name }#"
ipAddress: "#{ item.address }#"
#% if item.talos.disk_device.startswith('/') %#
installDisk: "#{ item.talos.disk_device }#"
#% else %#
installDiskSelector:
serial: "#{ item.talos.disk_device }#"
#% endif %#
controlPlane: false
#% endif %#
networkInterfaces:
- interface: eth0
dhcp: false
addresses:
- "#{ item.address }#/#{ bootstrap_node_cidr.split('/') | last }#"
- "#{ item.address }#/#{ cluster.nodes.host_network.split('/') | last }#"
mtu: 1500
routes:
- network: 0.0.0.0/0
gateway: "#{ bootstrap_node_cidr | nthhost(1) }#"
gateway: "#{ cluster.nodes.host_network | nthhost(1) }#"
#% if item.controller %#
vip:
ip: "#{ cluster.endpoint_vip }#"
#% endif %#
#% endfor %#
controlPlane:
@@ -106,7 +92,7 @@ controlPlane:
rotate-server-certificates: true
nodeIP:
validSubnets:
- "#{ bootstrap_node_cidr }#"
- "#{ cluster.nodes.host_network }#"
# Enable KubePrism
- &kubePrismPatch |-
@@ -121,7 +107,9 @@ controlPlane:
machine:
network:
nameservers:
- "#{ bootstrap_dns_server }#"
#% for item in cluster.nodes.dns_servers %#
- #{ item }#
#% endfor %#
# Configure NTP
- &ntpPatch |-
@@ -159,7 +147,7 @@ controlPlane:
extraArgs:
listen-metrics-urls: http://0.0.0.0:2381
advertisedSubnets:
- "#{ bootstrap_node_cidr }#"
- "#{ cluster.nodes.host_network }#"
# Disable default API server admission plugins.
- |-
bootstrap/templates/partials/cilium-values-full.partial.yaml.j2
+12 -24
View File
@@ -8,13 +8,14 @@ cluster:
id: 1
containerRuntime:
integration: containerd
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
socketPath: /var/run/k3s/containerd/containerd.sock
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
socketPath: /var/run/k0s/containerd.sock
#% endif %#
endpointRoutes:
enabled: true
#% if cloudflare.enabled %#
hubble:
enabled: true
metrics:
@@ -49,28 +50,32 @@ hubble:
tls:
- hosts:
- "hubble.${SECRET_DOMAIN}"
#% else %#
hubble:
enabled: false
#% endif %#
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
#% if feature_gates.dual_stack_ipv4_first %#
ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
ipv6:
enabled: true
#% endif %#
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
k8sServiceHost: 127.0.0.1
k8sServicePort: 6444
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
k8sServiceHost: localhost
k8sServicePort: 7443
#% elif bootstrap_distribution in ['talos'] %#
#% elif distribution in ['talos'] %#
k8sServiceHost: 127.0.0.1
k8sServicePort: 7445
#% endif %#
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
#% if feature_gates.dual_stack_ipv4_first %#
# https://github.com/cilium/cilium/issues/28985
enabled: false
#% else %#
@@ -87,23 +92,6 @@ localRedirectPolicy: true
operator:
replicas: 1
rollOutPods: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
prometheus:
enabled: true
serviceMonitor:
enabled: true
trustCRDsExist: true
dashboards:
enabled: true
annotations:
grafana_folder: Cilium
rollOutCiliumPods: true
routingMode: native
securityContext:
bootstrap/templates/partials/cilium-values-init.partial.yaml.j2
+9 -9
View File
@@ -8,9 +8,9 @@ cluster:
id: 1
containerRuntime:
integration: containerd
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
socketPath: /var/run/k3s/containerd/containerd.sock
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
socketPath: /var/run/k0s/containerd.sock
#% endif %#
endpointRoutes:
@@ -19,26 +19,26 @@ hubble:
enabled: false
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "#{ bootstrap_cluster_cidr }#"
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
ipv6NativeRoutingCIDR: "#{ bootstrap_cluster_cidr_v6 }#"
ipv4NativeRoutingCIDR: "#{ cluster.pod_network }#"
#% if feature_gates.dual_stack_ipv4_first %#
ipv6NativeRoutingCIDR: "#{ cluster.pod_network_v6 }#"
ipv6:
enabled: true
#% endif %#
#% if bootstrap_distribution in ['k3s'] %#
#% if distribution in ['k3s'] %#
k8sServiceHost: 127.0.0.1
k8sServicePort: 6444
#% elif bootstrap_distribution in ['k0s'] %#
#% elif distribution in ['k0s'] %#
k8sServiceHost: localhost
k8sServicePort: 7443
#% elif bootstrap_distribution in ['talos'] %#
#% elif distribution in ['talos'] %#
k8sServiceHost: 127.0.0.1
k8sServicePort: 7445
#% endif %#
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
#% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
#% if feature_gates.dual_stack_ipv4_first %#
# https://github.com/cilium/cilium/issues/28985
enabled: false
#% else %#
bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2
+1 -1
View File
@@ -21,7 +21,7 @@ spec:
args: ["manager"]
env:
- name: address
value: "#{ bootstrap_kube_api_addr }#"
value: "#{ cluster.endpoint_vip }#"
- name: vip_arp
value: "true"
- name: lb_enable
bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2
+1 -1
View File
@@ -1,2 +1,2 @@
providerRegex: ^(#{ (bootstrap_nodes.master + bootstrap_nodes.worker|default([])) | map(attribute='name') | join('|') }#)$
providerRegex: ^(#{ (nodes | map(attribute='name') | join('|')) }#)$
bypassDnsResolution: true
bootstrap/vars/.gitignore
-4
View File
@@ -1,4 +0,0 @@
# DO NOT REMOVE OR CHANGE THIS FILE
*
!addons.sample.yaml
!config.sample.yaml
bootstrap/vars/config.sample.yaml
-111
View File
@@ -1,111 +0,0 @@
---
#
# Bootstrap configuration - config.yaml is gitignored
#
# Distribution can either be 'k3s', 'k0s', or 'talos'
bootstrap_distribution: k3s
# Github username (e.g. onedr0p)
bootstrap_github_username:
# Github repository (e.g. flux-cluster-template)
bootstrap_github_repository_name:
# Age Public Key (e.g. age15uzrw396e67z9wdzsxzdk7ka0g2gr3l460e0slaea563zll3hdfqwqxdta)
bootstrap_age_public_key:
# Choose your timezone (e.g. America/New_York)
bootstrap_timezone: Etc/UTC
# Email you want to be associated with the ACME account (used for TLS certs via letsencrypt.org)
bootstrap_acme_email:
# Use the ACME production env when requesting the wildcard certificate.
# By default the ACME staging server is used. This is to prevent being rate-limited.
# Update this option to `true` when you have verified the staging certificate
# works and then re-run `task configure` and push your changes to Github.
bootstrap_acme_production_enabled: false
# Flux github webhook token (openssl rand -hex 12)
bootstrap_flux_github_webhook_token:
# Cloudflare domain
bootstrap_cloudflare_domain:
# Cloudflare API Token (NOT API Key)
bootstrap_cloudflare_token:
# Cloudflared Account Tag (cat ~/.cloudflared/*.json | jq -r .AccountTag)
bootstrap_cloudflare_account_tag:
# Cloudflared Tunnel Secret (cat ~/.cloudflared/*.json | jq -r .TunnelSecret)
bootstrap_cloudflare_tunnel_secret:
# Cloudflared Tunnel ID (cat ~/.cloudflared/*.json | jq -r .TunnelID)
bootstrap_cloudflare_tunnel_id:
# CIDR your nodes are on (e.g. 192.168.1.0/24)
bootstrap_node_cidr:
# The IP address of the Kube API, choose an available IP in your nodes
# network that is NOT being used. This is announced over L2.
bootstrap_kube_api_addr:
# The Load balancer IP for k8s_gateway, choose an available IP in your nodes
# network that is NOT being used. This is announced over L2.
bootstrap_k8s_gateway_addr:
# The Load balancer IP for external ingress, choose an available IP in your nodes
# network that is NOT being used. This is announced over L2.
bootstrap_external_ingress_addr:
# The Load balancer IP for internal ingress, choose an available IP in your nodes
# network that is NOT being used. This is announced over L2.
bootstrap_internal_ingress_addr:
# Add additional SANs to the Kube API cert, this is useful if you want
# to call the Kube API by hostname rather than IP
bootstrap_kube_additional_tls_sans: []
# The DNS server to use for the cluster, this can be an existing local DNS server or a public one
# If using a local DNS server make sure it meets the following requirements:
# 1. your nodes can reach it
# 2. it is configured to forward requests to a public DNS server
# 3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
bootstrap_dns_server: 1.1.1.1
# The pod CIDR for the cluster, this must NOT overlap with any existing networks
# If you want to use IPv6 check the advanced flags below
bootstrap_cluster_cidr: 10.42.0.0/16
# The service CIDR for the cluster, this must NOT overlap with any existing networks
# If you want to use IPv6 check the advanced flags below
bootstrap_service_cidr: 10.43.0.0/16
# Node information
bootstrap_nodes:
# Use only 1, 3 or more odd master nodes, recommended is 3
master:
# - name: # name or hostname of the node (must match [a-z0-9-\.]+)
# address: # ip address of the node
# ssh:
# username: # (Required: k3s/k0s) SSH username of the node
# talos:
# disk_device: # (Required: Talos) Device Path or Serial number of Disk for this node
# ...
worker: # set to [] or omit if no workers are needed
# - name: # name or hostname of the node (must match [a-z0-9-\.]+)
# address: # ip address of the node
# ssh:
# username: # (Required: k3s/k0s) SSH username of the node
# talos:
# disk_device: # (Required: Talos) Device Path or Serial number of Disk for this node
# ...
#
# Do not make changes below this line unless you know what you are doing
# These options are not validated and may break your cluster
#
# bootstrap_advanced_flags:
# # Change the default Github repository branch
# github_repository_branch: main
#
# # Disable to prevent changes to nodes /etc/resolv.conf
# update_resolv_conf: true
#
# # Enable Dual Stack IPv4 first
# # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
# # https://github.com/onedr0p/flux-cluster-template/issues/1148
# # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
# # Make sure you set bootstrap_cluster_cidr and bootstrap_service_cidr
# # to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
# dual_stack_ipv4_first: false