feat: refactor config file (#1267)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-28 12:41:31 -05:00
1 parent e4427a8325
commit 889ca07692
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("enabled") == True
@@ -1,23 +0,0 @@
-
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app cert-manager-issuers
-  namespace: flux-system
-spec:
-  targetNamespace: cert-manager
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-  path: ./kubernetes/apps/cert-manager/cert-manager-issuers/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -32,8 +32,3 @@ spec:
      nameservers:
        - "1.1.1.1"
        - "9.9.9.9"
-    prometheus:
-      enabled: true
-      servicemonitor:
-        enabled: true
-        prometheusInstance: observability
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: cert-manager-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -18,3 +18,27 @@ spec:
  interval: 30m
  retryInterval: 1m
  timeout: 5m
+#% if cloudflare.enabled %#
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+#% endif %#
@@ -4,4 +4,3 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cert-manager/ks.yaml
-  - ./cert-manager-issuers/ks.yaml
@@ -0,0 +1 @@
+main = lambda data: data.get("flux").get("github").get("webhook").get("enabled") == True
@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./addons/ks.yaml
+  - ./webhooks/ks.yaml
@@ -1,3 +1,4 @@
+#% if cloudflare.enabled %#
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -21,3 +22,4 @@ spec:
  tls:
    - hosts:
        - *host
+#% endif %#
@@ -3,5 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./secret.sops.yaml
+  #% if cloudflare.enabled %#
  - ./ingress.yaml
+  #% endif %#
  - ./receiver.yaml
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: github-webhook-token-secret
 stringData:
-  token: "#{ bootstrap_flux_github_webhook_token }#"
+  token: "#{ flux.github.webhook.token }#"
@@ -9,7 +9,7 @@ spec:
  commonMetadata:
    labels:
      app.kubernetes.io/name: *app
-  path: ./kubernetes/apps/flux-system/addons/webhooks
+  path: ./kubernetes/apps/flux-system/webhooks/app
  prune: true
  sourceRef:
    kind: GitRepository
@@ -6,7 +6,7 @@ metadata:
  name: policy
 spec:
  loadBalancerIPs: true
-  # NOTE: This might need to be set if you have more than one active NIC on your nodes
+  # NOTE: This might need to be set if you have more than one active NIC on your hosts
  # interfaces:
  #   - ^eno[0-9]+
  nodeSelector:
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
+  #% if not feature_gates.dual_stack_ipv4_first %#
  - ./cilium-l2.yaml
  #% endif %#
  - ./helmrelease.yaml
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['talos']
+main = lambda data: data.get("distribution") in ['talos']
@@ -4,11 +4,11 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  #% if bootstrap_distribution in ['talos'] %#
+  #% if distribution in ['talos'] %#
  - ./kubelet-csr-approver/ks.yaml
  #% endif %#
  - ./metrics-server/ks.yaml
-  #% if bootstrap_distribution in ['k0s', 'talos'] %#
+  #% if distribution in ['k0s', 'talos'] %#
  - ./spegel/ks.yaml
  #% endif %#
  - ./reloader/ks.yaml
@@ -28,7 +28,3 @@ spec:
      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
      - --kubelet-use-node-status-port
      - --metric-resolution=15s
-    metrics:
-      enabled: true
-    serviceMonitor:
-      enabled: true
@@ -26,6 +26,3 @@ spec:
    fullnameOverride: reloader
    reloader:
      readOnlyRootFileSystem: true
-      podMonitor:
-        enabled: true
-        namespace: "{{ .Release.Namespace }}"
@@ -1 +1 @@
-main = lambda data: data.get("bootstrap_distribution") in ['k0s', 'talos']
+main = lambda data: data.get("distribution") in ['k0s', 'talos']
@@ -24,15 +24,13 @@ spec:
    keepHistory: false
  values:
    spegel:
-      #% if bootstrap_distribution in ['k0s'] %#
+      #% if distribution in ['k0s'] %#
      containerdSock: /run/k0s/containerd.sock
      containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
-      #% elif bootstrap_distribution in ['talos'] %#
+      #% elif distribution in ['talos'] %#
      containerdSock: /run/containerd/containerd.sock
      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
      #% endif %#
    service:
      registry:
        hostPort: 29999
-    serviceMonitor:
-      enabled: true
@@ -0,0 +1 @@
+main = lambda data: data.get("cloudflare").get("enabled") == True
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/apps/network/certificates/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -82,9 +82,6 @@ spec:
        ports:
          http:
            port: *port
-    serviceMonitor:
-      main:
-        enabled: true
    persistence:
      config:
        enabled: true
@@ -4,10 +4,10 @@ kind: Secret
 metadata:
  name: cloudflared-secret
 stringData:
-  TUNNEL_ID: "#{ bootstrap_cloudflare_tunnel_id }#"
+  TUNNEL_ID: "#{ cloudflare.tunnel.id }#"
  credentials.json: |
    {
-      "AccountTag": "#{ bootstrap_cloudflare_account_tag }#",
-      "TunnelSecret": "#{ bootstrap_cloudflare_tunnel_secret }#",
-      "TunnelID": "#{ bootstrap_cloudflare_tunnel_id }#"
+      "AccountTag": "#{ cloudflare.tunnel.account_id }#",
+      "TunnelSecret": "#{ cloudflare.tunnel.secret }#",
+      "TunnelID": "#{ cloudflare.tunnel.id }#"
    }
@@ -10,7 +10,6 @@ spec:
    labels:
      app.kubernetes.io/name: *app
  dependsOn:
-    - name: certificates
    - name: external-dns
  path: ./kubernetes/apps/network/cloudflared/app
  prune: true
@@ -65,8 +65,6 @@ spec:
            port: *port
    ingress:
      main:
-        enabled: false
-      external:
        enabled: true
        className: external
        annotations:
@@ -41,7 +41,5 @@ spec:
    txtPrefix: k8s.
    txtOwnerId: default
    domainFilters: ["${SECRET_DOMAIN}"]
-    serviceMonitor:
-      enabled: true
    podAnnotations:
      secret.reloader.stakater.com/reload: external-dns-secret
@@ -4,4 +4,4 @@ kind: Secret
 metadata:
  name: external-dns-secret
 stringData:
-  api-token: "#{ bootstrap_cloudflare_token }#"
+  api-token: "#{ cloudflare.token }#"
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./staging.yaml
-  #% if bootstrap_acme_production_enabled %#
+  #% if cloudflare.acme.production %#
  - ./production.yaml
  #% endif %#
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-external
+  name: ingress-nginx-external
 spec:
  interval: 30m
  chart:
@@ -26,13 +26,13 @@ spec:
    - name: cloudflared
      namespace: network
  values:
-    fullnameOverride: nginx-external
+    fullnameOverride: ingress-nginx-external
    controller:
      replicaCount: 1
      service:
        annotations:
          external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
-          io.cilium/lb-ipam-ips: "#{ bootstrap_external_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: external
@@ -63,14 +63,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -82,7 +76,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-external
+              app.kubernetes.io/instance: ingress-nginx-external
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
 metadata:
-  name: nginx-internal
+  name: ingress-nginx-internal
  namespace: network
 spec:
  interval: 30m
@@ -24,12 +24,12 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    fullnameOverride: nginx-internal
+    fullnameOverride: ingress-nginx-internal
    controller:
      replicaCount: 1
      service:
        annotations:
-          io.cilium/lb-ipam-ips: "#{ bootstrap_internal_ingress_addr }#"
+          io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#"
        externalTrafficPolicy: Cluster
      ingressClassResource:
        name: internal
@@ -60,14 +60,8 @@ spec:
        proxy-body-size: 0
        proxy-buffer-size: 16k
        ssl-protocols: TLSv1.3 TLSv1.2
-      metrics:
-        enabled: true
-        serviceMonitor:
-          enabled: true
-          namespaceSelector:
-            any: true
      extraArgs:
-        #% if bootstrap_acme_production_enabled %#
+        #% if cloudflare.acme.production %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
        #% else %#
        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
@@ -79,7 +73,7 @@ spec:
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
-              app.kubernetes.io/instance: nginx-internal
+              app.kubernetes.io/instance: ingress-nginx-internal
              app.kubernetes.io/component: controller
      resources:
        requests:
@@ -0,0 +1,66 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-certificates
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/network/ingress-nginx/certificates
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-internal
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/internal
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app ingress-nginx-external
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: ingress-nginx-certificates
+  path: ./kubernetes/apps/network/ingress-nginx/external
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -30,5 +30,5 @@ spec:
      type: LoadBalancer
      port: 53
      annotations:
-        io.cilium/lb-ipam-ips: "#{ bootstrap_k8s_gateway_addr }#"
+        io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#"
      externalTrafficPolicy: Cluster
@@ -3,10 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ./namespace.yaml
-  - ./certificates/ks.yaml
  - ./cloudflared/ks.yaml
  - ./echo-server/ks.yaml
  - ./external-dns/ks.yaml
+  - ./ingress-nginx/ks.yaml
  - ./k8s-gateway/ks.yaml
-  - ./nginx-external/ks.yaml
-  - ./nginx-internal/ks.yaml
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-external
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-external/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
@@ -1,22 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: &app nginx-internal
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: certificates
-  path: ./kubernetes/apps/network/nginx-internal/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: false
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("flux").get("enabled") == True`
				`@@ -0,0 +1 @@`
				`main = lambda data: data.get("cloudflare").get("enabled") == True`