feat: refactor config file (#1267)

Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-28 12:41:31 -05:00
1 parent e4427a8325
commit 889ca07692
@@ -0,0 +1,115 @@
+---
+# (Required) Distribution can either be k3s, k0s, or talos
+distribution: ""
+
+# (Required) IANA formatted timezone (e.g. America/New_York)
+timezone: ""
+
+# (Required) Cluster details
+cluster:
+  # (Required) The pod CIDR for the cluster, this must NOT overlap with any
+  #   existing networks. If you want to use IPv6 check the advanced flags below
+  pod_network: 10.69.0.0/16
+  # (Required) The service CIDR for the cluster, this must NOT overlap with any
+  #   existing networks. If you want to use IPv6 check the advanced flags below
+  service_network: 10.96.0.0/16
+  # (Required) The IP address of the Kube API, choose an available IP in
+  #   your nodes network that is NOT being used. This is announced over L2.
+  endpoint_vip: ""
+  # (Optional) Add additional SANs to the Kube API cert, this is useful
+  #   if you want to call the Kube API by hostname rather than IP
+  tls_sans: []
+  # (Required) The nodes section is used to configure your cluster nodes
+  nodes:
+    # (Required) CIDR your nodes are on (e.g. 192.168.1.0/24)
+    host_network: ""
+    # (Required) The DNS server to use for the cluster, this can be an existing
+    #   local DNS server or a public one
+    # If using a local DNS server make sure it meets the following requirements:
+    #   1. your nodes can reach it
+    #   2. it is configured to forward requests to a public DNS server
+    #   3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
+    dns_servers: []
+    # (Optional) The DNS search domain to use for the nodes.
+    # Leave this option blank to avoid DNS issues inside the cluster.
+    search_domain: ""
+    # (Required) Use only 1, 3 or more ODD number of controller nodes, recommended is 3
+    #   Worker nodes are optional
+    inventory: []
+      # - name: ""               # Name of the node (must match [a-z0-9-\.]+)
+      #   address: ""            # IP address of the node
+      #   controller: true       # (Required) Set to true if this is a controller node
+      #   ssh_username: ""       # (Required: k3s/k0s) SSH username of the node
+      #   talos_disk_device: ""  # (Required: Talos) Device Path or Serial number of Disk for this node
+      # ...
+
+# (Required) Flux details
+# IMPORTANT: All options are ignored if flux is disabled and no resources
+#   outside Cilium and kube-vip (k0s/k3s) will be deployed to your cluster.
+flux:
+  # (Required) Disable to use a different tool (e.g. kubectl, Argo, Kluctl)
+  enabled: true
+  # (Required) Options for Github
+  github:
+    # (Required) Github repository URL (for private repos use the ssh:// URL)
+    address: ""
+    # (Required) Github repository branch
+    branch: main
+    # (Required) Options for Flux Github webhook
+    webhook:
+      # (Required) Enable to use Github push-based sync
+      enabled: true
+      # Token for Github push-based sync (openssl rand -hex 16)
+      token: ""
+  # (Required) Age Public Key (e.g. age15uzrw396e67z9wdzsxzdk7ka0g2gr3l460e0slaea563zll3hdfqwqxdta)
+  sops_age_public_key: ""
+
+# (Required) Cloudflare details - Cloudflare is used for DNS, TLS certificates and tunneling.
+# IMPORTANT: All options are ignored if cloudflare is disabled and no resources
+#   outside a bare Flux setup will be deployed to your cluster if Flux is enabled.
+cloudflare:
+  # (Required) Disable to use a different DNS provider
+  enabled: true
+  # (Required) Cloudflare Domain
+  domain: ""
+  # (Required) Cloudflare API Token (NOT API Key)
+  token: ""
+  # (Required) Optionals for Cloudflare Acme
+  acme:
+    # (Required) Email you want to be associated with the ACME account (used for TLS certs via letsencrypt.org)
+    email: ""
+    # (Required) Use the ACME production server when requesting the wildcard certificate.
+    #   By default the ACME staging server is used. This is to prevent being rate-limited.
+    #   Update this option to `true` when you have verified the staging certificate
+    #   works and then re-run `task configure` and push your changes to Github.
+    production: false
+  # (Required) Provide LAN access to the cluster ingresses for internal ingress classes
+  # The Load balancer IP for internal ingress, choose an available IP
+  #   in your nodes network that is NOT being used. This is announced over L2.
+  ingress_vip: ""
+  # (Required) Gateway is used for providing DNS to your cluster on LAN
+  # The Load balancer IP for k8s_gateway, choose an available IP
+  #   in your nodes network that is NOT being used. This is announced over L2.
+  gateway_vip: ""
+  # (Required) Options for Cloudflare Tunnel
+  tunnel:
+    # (Required) Cloudflare Account ID (cat ~/.cloudflared/*.json | jq -r .AccountTag)
+    account_id: ""
+    # (Required) Cloudflared Tunnel ID (cat ~/.cloudflared/*.json | jq -r .TunnelID)
+    id: ""
+    # (Required) Cloudflared Tunnel Secret (cat ~/.cloudflared/*.json | jq -r .TunnelSecret)
+    secret: ""
+    # (Required) Provide WAN access to the cluster ingresses for external ingress classes
+    # The Load balancer IP for external ingress, choose an available IP
+    #   in your nodes network that is NOT being used. This is announced over L2.
+    ingress_vip: ""
+
+# (Optional) Feature gates are used to enable experimental features
+feature_gates:
+  # Enable Dual Stack IPv4 first
+  # IMPORTANT: I am looking for people to help maintain IPv6 support since I cannot test it.
+  #   Ref: https://github.com/onedr0p/flux-cluster-template/issues/1148
+  # Keep in mind that Cilium does not currently support IPv6 L2 announcements.
+  # Make sure you set cluster.pod_cidr and cluster.service_cidr
+  #   to a valid dual stack CIDRs, e.g. "10.42.0.0/16,fd00:10:244::/64"
+  dual_stack_ipv4_first: false