feat: add first class support for private github repos (#1271)
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
95bf353f7e
commit
8ef31af331
9 files changed
+49
-93
No files matched your search
@@ -32,6 +32,8 @@ flux:
|
||||
webhook:
|
||||
enabled: true
|
||||
token: fake
|
||||
private:
|
||||
enabled: false
|
||||
sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
|
||||
|
||||
cloudflare:
|
||||
|
||||
@@ -32,6 +32,8 @@ flux:
|
||||
webhook:
|
||||
enabled: true
|
||||
token: fake
|
||||
private:
|
||||
enabled: false
|
||||
sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
|
||||
|
||||
cloudflare:
|
||||
|
||||
@@ -32,6 +32,8 @@ flux:
|
||||
webhook:
|
||||
enabled: true
|
||||
token: fake
|
||||
private:
|
||||
enabled: false
|
||||
sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
|
||||
|
||||
cloudflare:
|
||||
|
||||
@@ -32,6 +32,8 @@ flux:
|
||||
webhook:
|
||||
enabled: true
|
||||
token: fake
|
||||
private:
|
||||
enabled: false
|
||||
sops_age_public_key: $BOOTSTRAP_AGE_PUBLIC_KEY
|
||||
|
||||
cloudflare:
|
||||
|
||||
@@ -7,6 +7,7 @@ vars:
|
||||
PROMETHEUS_OPERATOR_VERSION: v0.71.2
|
||||
CLUSTER_SECRET_SOPS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml"
|
||||
CLUSTER_SETTINGS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml"
|
||||
GITHUB_DEPLOY_KEY_FILE: "{{.KUBERNETES_DIR}}/bootstrap/github-deploy-key.sops.yaml"
|
||||
|
||||
tasks:
|
||||
|
||||
@@ -63,7 +64,8 @@ tasks:
|
||||
- { msg: "Flux not installed", sh: "kubectl get namespace flux-system --kubeconfig {{.KUBECONFIG_FILE}} &>/dev/null && exit 0 || exit 1" }
|
||||
|
||||
github-deploy-key:
|
||||
cmd: sops --decrypt {{.KUBERNETES_DIR}}/bootstrap/github-deploy-key.sops.yaml | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
|
||||
cmd: sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
|
||||
preconditions:
|
||||
- { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" }
|
||||
- { msg: "Flux not installed", sh: "kubectl get namespace flux-system --kubeconfig {{.KUBECONFIG_FILE}} &>/dev/null && exit 0 || exit 1" }
|
||||
- { msg: "Missing Sops Age key file", sh: "test -f {{.AGE_FILE}}" }
|
||||
- { msg: "Missing Github deploy key file", sh: "test -f {{.GITHUB_DEPLOY_KEY_FILE}}" }
|
||||
@@ -392,7 +392,7 @@ You have two different options for setting up your local workstation.
|
||||
|
||||
### 🔹 Stage 6: Install Flux in your cluster
|
||||
|
||||
> [!IMPORTANT]
|
||||
> [!NOTE]
|
||||
> Skip this stage if you have **disabled** Flux in the `config.yaml`
|
||||
|
||||
1. Verify Flux can be installed
|
||||
@@ -407,6 +407,9 @@ You have two different options for setting up your local workstation.
|
||||
|
||||
2. Install Flux and sync the cluster to the Git repository
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Run `task flux:github-deploy-key` first if using a private repository.
|
||||
|
||||
```sh
|
||||
task flux:bootstrap
|
||||
# namespace/flux-system configured
|
||||
@@ -579,95 +582,6 @@ To browse or get ideas on applications people are running, community member [@wh
|
||||
The included CSI (openebs in local-hostpath mode) is a great start for storage but soon you might find you need more features like replicated block storage, or to connect to a NFS/SMB/iSCSI server. If you need any of those features be sure to check out the projects like [rook-ceph](https://github.com/rook/rook), [longhorn](https://github.com/longhorn/longhorn), [openebs](https://github.com/openebs/openebs), [democratic-csi](https://github.com/democratic-csi/democratic-csi), [csi-driver-nfs](https://github.com/kubernetes-csi/csi-driver-nfs),
|
||||
and [synology-csi](https://github.com/SynologyOpenSource/synology-csi).
|
||||
|
||||
#### Authenticate Flux over SSH
|
||||
|
||||
<details>
|
||||
<summary><i>Click <b>here</b> to read guide on adding Flux SSH authentication</i></summary>
|
||||
|
||||
Authenticating Flux to your git repository has a couple benefits like using a private git repository and/or using the Flux [Image Automation Controllers](https://fluxcd.io/docs/components/image/).
|
||||
|
||||
By default this template only works on a public Github repository, it is advised to keep your repository public.
|
||||
|
||||
The benefits of a public repository include:
|
||||
|
||||
- Debugging or asking for help, you can provide a link to a resource you are having issues with.
|
||||
- Adding a topic to your repository of `kubesearch` to be included in the [Kubesearch](https://kubesearch.dev) results. This search helps people discover different configurations of Helm charts across others Flux based repositories.
|
||||
|
||||
1. Generate new SSH key:
|
||||
|
||||
```sh
|
||||
ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./kubernetes/bootstrap/github-deploy.key -q -P ""
|
||||
```
|
||||
|
||||
2. Paste public key in the deploy keys section of your repository settings
|
||||
3. Create sops secret in `./kubernetes/bootstrap/github-deploy-key.sops.yaml` with the contents of:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: github-deploy-key
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
# 3a. Contents of github-deploy-key
|
||||
identity: |
|
||||
-----BEGIN OPENSSH PRIVATE KEY-----
|
||||
...
|
||||
-----END OPENSSH PRIVATE KEY-----
|
||||
# 3b. Output of curl --silent https://api.github.com/meta | jq --raw-output '"github.com "+.ssh_keys[]'
|
||||
known_hosts: |
|
||||
github.com ssh-ed25519 ...
|
||||
github.com ecdsa-sha2-nistp256 ...
|
||||
github.com ssh-rsa ...
|
||||
```
|
||||
|
||||
4. Encrypt secret:
|
||||
|
||||
```sh
|
||||
sops --encrypt --in-place ./kubernetes/bootstrap/github-deploy-key.sops.yaml
|
||||
```
|
||||
|
||||
5. Apply secret to cluster:
|
||||
|
||||
```sh
|
||||
sops --decrypt ./kubernetes/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f -
|
||||
```
|
||||
|
||||
6. Update `./kubernetes/flux/config/cluster.yaml`:
|
||||
|
||||
```yaml
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: home-kubernetes
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 10m
|
||||
# 6a: Change this to your user and repo names
|
||||
url: ssh://git@github.com/$user/$repo
|
||||
ref:
|
||||
branch: main
|
||||
secretRef:
|
||||
name: github-deploy-key
|
||||
```
|
||||
|
||||
7. Commit and push changes
|
||||
8. Force flux to reconcile your changes
|
||||
|
||||
```sh
|
||||
flux reconcile -n flux-system kustomization cluster --with-source
|
||||
```
|
||||
|
||||
9. Verify git repository is now using SSH:
|
||||
|
||||
```sh
|
||||
flux get sources git -A
|
||||
```
|
||||
|
||||
10. Optionally set your repository to Private in your repository settings.
|
||||
|
||||
</details>
|
||||
|
||||
## 🙌 Related Projects
|
||||
|
||||
If this repo is too hot to handle or too cold to hold check out these following projects.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
{% if flux.github.private.enabled %}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: github-deploy-key
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
identity: |
|
||||
{% filter indent(width=4, first=False) %}
|
||||
{{ flux.github.private.key }}
|
||||
{%- endfilter %}
|
||||
known_hosts: |
|
||||
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||
{% endif %}
|
||||
@@ -7,7 +7,7 @@ metadata:
|
||||
spec:
|
||||
interval: 30m
|
||||
url: "{{ flux.github.address }}"
|
||||
{% if flux.github.address.startswith('ssh://') %}
|
||||
{% if flux.github.private.enabled %}
|
||||
secretRef:
|
||||
name: github-deploy-key
|
||||
{% endif %}
|
||||
|
||||
@@ -66,6 +66,21 @@ flux:
|
||||
enabled: true
|
||||
# Token for Github push-based sync (openssl rand -hex 16)
|
||||
token: ""
|
||||
# (Required) Private key for Flux to access the Github repository
|
||||
private:
|
||||
# (Required) Enable to use a private Github repository
|
||||
enabled: false
|
||||
# Private key for Flux to access the Github repository
|
||||
# 1. Generate a new key with the following command:
|
||||
# ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f github-deploy.key -q -P ""
|
||||
# 2. Make sure to paste public key from "github-deploy.key.pub"
|
||||
# into the deploy keys section of your repository settings
|
||||
# 3. Uncomment and paste the private key below
|
||||
# key: |
|
||||
# -----BEGIN OPENSSH PRIVATE KEY-----
|
||||
# ...
|
||||
# -----END OPENSSH PRIVATE KEY-----
|
||||
|
||||
# (Required) Age Public Key (e.g. age15uzrw396e67z9wdzsxzdk7ka0g2gr3l460e0slaea563zll3hdfqwqxdta)
|
||||
sops_age_public_key: ""
|
||||
|
||||
|
||||
Reference in new issue
Block a user