Merge branch 'main' into main

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 fail_fast: false
 repos:
 - repo: https://github.com/adrienverge/yamllint.git
-  rev: v1.25.0
+  rev: v1.26.1
   hooks:
   - args:
     - -c
@@ -23,6 +23,6 @@ repos:
   hooks:
   - id: fix-smartquotes
 - repo: https://github.com/k8s-at-home/sops-pre-commit
-  rev: v1.1.0
+  rev: v2.0.1
   hooks:
-  - id: sops-encrypted-check
+  - id: forbid-secrets

README.md

@@ -23,29 +23,39 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS
 
 ### :wrench:  Tools
 
-| Tool                                                               | Purpose                                                                                                                  | Minimum version | Required |
-|--------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|:---------------:|:--------:|
-| [k3sup](https://github.com/alexellis/k3sup)                        | Tool to install k3s on your nodes                                                                                        |    `0.10.2`     |    ✅     |
-| [kubectl](https://kubernetes.io/docs/tasks/tools/)                 | Allows you to run commands against Kubernetes clusters                                                                   |    `1.21.0`     |    ✅     |
-| [flux](https://toolkit.fluxcd.io/)                                 | Operator that manages your k8s cluster based on your Git repository                                                      |    `0.12.3`     |    ✅     |
-| [SOPS](https://github.com/mozilla/sops)                            | Encrypts k8s secrets with GnuPG                                                                                          |     `3.7.1`     |    ✅     |
-| [GnuPG](https://gnupg.org/)                                        | Encrypts and signs your data                                                                                             |    `2.2.27`     |    ✅     |
-| [pinentry](https://gnupg.org/related_software/pinentry/index.html) | Allows GnuPG to read passphrases and PIN numbers                                                                         |     `1.1.1`     |    ✅     |
-| [direnv](https://github.com/direnv/direnv)                         | Exports env vars based on present working directory                                                                      |    `2.28.0`     |    ❌     |
-| [pre-commit](https://github.com/pre-commit/pre-commit)             | Keeps formatting consistency across your files and ensures you **do not commit un-encrypted secrets** to your repository |    `2.12.0`     |    ❌     |
-| [kustomize](https://kustomize.io/)                                 | Template-free way to customize application configuration                                                                 |     `4.1.0`     |    ❌     |
+| Tool                                                               | Purpose                                                             | Minimum version | Required |
+|--------------------------------------------------------------------|---------------------------------------------------------------------|:---------------:|:--------:|
+| [k3sup](https://github.com/alexellis/k3sup)                        | Tool to install k3s on your nodes                                   |    `0.10.2`     |    ✅     |
+| [kubectl](https://kubernetes.io/docs/tasks/tools/)                 | Allows you to run commands against Kubernetes clusters              |    `1.21.0`     |    ✅     |
+| [flux](https://toolkit.fluxcd.io/)                                 | Operator that manages your k8s cluster based on your Git repository |    `0.12.3`     |    ✅     |
+| [SOPS](https://github.com/mozilla/sops)                            | Encrypts k8s secrets with GnuPG                                     |     `3.7.1`     |    ✅     |
+| [GnuPG](https://gnupg.org/)                                        | Encrypts and signs your data                                        |    `2.2.27`     |    ✅     |
+| [pinentry](https://gnupg.org/related_software/pinentry/index.html) | Allows GnuPG to read passphrases and PIN numbers                    |     `1.1.1`     |    ✅     |
+| [direnv](https://github.com/direnv/direnv)                         | Exports env vars based on present working directory                 |    `2.28.0`     |    ❌     |
+| [pre-commit](https://github.com/pre-commit/pre-commit)             | Runs checks during `git commit`                                     |    `2.12.0`     |    ❌     |
+| [kustomize](https://kustomize.io/)                                 | Template-free way to customize application configuration            |     `4.1.0`     |    ❌     |
+| [helm](https://helm.sh/)                                           | Manage Kubernetes applications                                      |     `3.5.4`     |    ❌     |
 
-## :rocket:  Pre-installation
+## :warning:  Pre-installation
 
 It's very important and I cannot stress enough, make sure you are not pushing your secrets un-encrypted to a public Git repo.
 
-I would start off **by making your repository private** until you are certain there are no leaks before showing it off to the world.
+### pre-commit
+
+It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-commit hooks that come with this repository.
+[sops-pre-commit](https://github.com/k8s-at-home/sops-pre-commit) will check to make sure you are not by accident commiting your secrets un-encrypted.
+
+After pre-commit is installed on your machine run:
+
+```sh
+pre-commit install-hooks
+```
 
 ## :rocket:  Lets go!
 
 Very first step will be to create a new repository by clicking the **Use this template** button on this page.
 
-### :key:  Setting up GnuPG keys
+### :closed_lock_with_key:  Setting up GnuPG keys
 
 Here we will create a personal and a Flux GPG key. Using SOPS with GnuPG allows us to encrypt and decrypt secrets.
 
@@ -86,7 +96,7 @@ Key-Length: 4096
 Subkey-Type: 1
 Subkey-Length: 4096
 Expire-Date: 0
-Name-Real: ${KEY_NAME}
+Name-Real: ${FLUX_KEY_NAME}
 EOF
 
 gpg --list-secret-keys "${FLUX_KEY_NAME}"
@@ -133,7 +143,7 @@ kubectl --kubeconfig=./kubeconfig get nodes
 # k8s-worker-a   Ready    worker                    4d20h   v1.20.5+k3s1
 ```
 
-### GitOps with Flux
+### :small_blue_diamond:  GitOps with Flux
 
 Here we will be installing [flux](https://toolkit.fluxcd.io/) after some quick bootstrap steps.
 
@@ -176,7 +186,7 @@ envsubst < ./tmpl/secret.enc.yaml > ./cluster/core/infrastructure/cert-manager/s
 ```sh
 export GPG_TTY=$(tty)
 sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml
-sops --encrypt --in-place ./cluster/core/infrastructure/cert-manager/secret.enc.yaml
+sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml
 ```
 
 Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster`
@@ -197,7 +207,7 @@ git push
 kubectl --kubeconfig=./kubeconfig --kustomize=./cluster/base/flux-system
 ```
 
-## Post installation
+## :mega:&nbsp; Post installation
 
 ### Verify ingress
 
@@ -209,17 +219,6 @@ sudo echo "${BOOTSTRAP_INGRESS_NGINX_LB} ${BOOTSTRAP_DOMAIN} homer.${BOOTSTRAP_D
 
 Head over to your browser and you _should_ be able to access `https://homer.${BOOTSTRAP_DOMAIN}`
 
-### pre-commit
-
-It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-commit hooks that come with this repository.
-[sops-pre-commit](https://github.com/k8s-at-home/sops-pre-commit) will check to make sure you are not by accident commiting your SOPS secrets un-encrypted.
-
-After pre-commit is installed run:
-
-```sh
-pre-commit install-hooks
-```
-
 ### direnv
 
 This is a great tool to export environment variables depending on what your present working directory is, head over to their [installation guide](https://direnv.net/docs/installation.html) and don't forget to hook it into your shell!
@@ -237,7 +236,7 @@ gpg --delete-secret-keys "${FLUX_KEY_FP}"
 [Here](https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops)'s a neat little plugin for those using VSCode.
 It will automatically decrypt you SOPS secrets when you click on the file in the editor and encrypt them when you save the file.
 
-## Debugging
+## :point_right:&nbsp; Debugging
 
 Manually sync Flux with your Git repository
 
@@ -264,8 +263,8 @@ Show the health of your main Flux `GitRepository`
 
 ```sh
 flux --kubeconfig=./kubeconfig get sources git
-# NAME           READY	MESSAGE                                                            REVISION                                                             	SUSPENDED
-# flux-system    True 	Fetched revision: main/943e4126e74b273ff603aedab89beb7e36be4998    main/943e4126e74b273ff603aedab89beb7e36be4998                        	False
+# NAME           READY	MESSAGE                                                            REVISION                                         SUSPENDED
+# flux-system    True 	Fetched revision: main/943e4126e74b273ff603aedab89beb7e36be4998    main/943e4126e74b273ff603aedab89beb7e36be4998    False
 ```
 
 Show the health of your `HelmRelease`s
@@ -291,9 +290,9 @@ flux --kubeconfig=./kubeconfig get sources helm -A
 
 Flux has a wide range of CLI options available be sure to run `flux --help` to view more!
 
-## What's next?
+## :grey_question:&nbsp; What's next
 
-The world is your cluster, try installing another application!
+The world is your cluster, try installing another application or if you have a NAS and want storage back by that check out [democratic-csi](https://github.com/democratic-csi/democratic-csi), [csi-driver-nfs](https://github.com/kubernetes-csi/csi-driver-nfs) or [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner).
 
 ## :handshake:&nbsp; Thanks
 

cluster/apps/default/homer/helm-release.yaml

@@ -15,7 +15,6 @@ spec:
         kind: HelmRepository
         name: k8s-at-home-charts
         namespace: flux-system
-      interval: 5m
   values:
     image:
       repository: b4bz/homer

cluster/apps/networking/ingress-nginx/helm-release.yaml

@@ -15,7 +15,6 @@ spec:
         kind: HelmRepository
         name: ingress-nginx-charts
         namespace: flux-system
-      interval: 5m
   values:
     controller:
       ingressClass: nginx

cluster/base/flux-system/gotk-components.yaml

@@ -1,5 +1,5 @@
 ---
-# Flux version: v0.12.1
+# Flux version: v0.12.3
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller
 apiVersion: v1
 kind: Namespace
@@ -7,7 +7,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: flux-system
 ---
 apiVersion: apiextensions.k8s.io/v1
@@ -19,7 +19,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: alerts.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -194,7 +194,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: buckets.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -382,7 +382,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: gitrepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -601,7 +601,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: helmcharts.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -793,7 +793,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: helmreleases.helm.toolkit.fluxcd.io
 spec:
   group: helm.toolkit.fluxcd.io
@@ -1309,7 +1309,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: helmrepositories.source.toolkit.fluxcd.io
 spec:
   group: source.toolkit.fluxcd.io
@@ -1477,7 +1477,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
   group: kustomize.toolkit.fluxcd.io
@@ -1874,7 +1874,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: providers.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -2021,7 +2021,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: receivers.notification.toolkit.fluxcd.io
 spec:
   group: notification.toolkit.fluxcd.io
@@ -2201,7 +2201,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: helm-controller
   namespace: flux-system
 ---
@@ -2211,7 +2211,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: kustomize-controller
   namespace: flux-system
 ---
@@ -2221,7 +2221,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: notification-controller
   namespace: flux-system
 ---
@@ -2231,7 +2231,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: source-controller
   namespace: flux-system
 ---
@@ -2241,7 +2241,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -2321,7 +2321,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: cluster-reconciler-flux-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -2341,7 +2341,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
   name: crd-controller-flux-system
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -2373,7 +2373,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: notification-controller
   namespace: flux-system
@@ -2393,7 +2393,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: source-controller
   namespace: flux-system
@@ -2413,7 +2413,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: webhook-receiver
   namespace: flux-system
@@ -2433,7 +2433,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: helm-controller
   namespace: flux-system
@@ -2506,7 +2506,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: kustomize-controller
   namespace: flux-system
@@ -2581,7 +2581,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: notification-controller
   namespace: flux-system
@@ -2657,7 +2657,7 @@ metadata:
   labels:
     app.kubernetes.io/instance: flux-system
     app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v0.12.1
+    app.kubernetes.io/version: v0.12.3
     control-plane: controller
   name: source-controller
   namespace: flux-system

cluster/core/cert-manager/helm-release.yaml

@@ -15,7 +15,6 @@ spec:
         kind: HelmRepository
         name: jetstack-charts
         namespace: flux-system
-      interval: 5m
   values:
     installCRDs: false
     webhook:
@@ -30,8 +29,3 @@ spec:
       nameservers:
       - "1.1.1.1"
       - "8.8.8.8"
-    prometheus:
-      enabled: false
-      servicemonitor:
-        enabled: false
-        prometheusInstance: monitoring

cluster/core/cert-manager/kustomization.yaml

@@ -1,6 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+- crd
+- helm-release.yaml
 - letsencrypt-production.yaml
 - letsencrypt-staging.yaml
 - secret.enc.yaml

cluster/core/cert-manager/secret.enc.yaml

@@ -0,0 +1,8 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-token-secret
+    namespace: cert-manager
+stringData:
+    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}

cluster/core/crds/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- cert-manager

cluster/core/infrastructure/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- cert-manager
-- metallb

cluster/core/kustomization.yaml

@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- crds
-- infrastructure
 - namespaces
-- operators
+- metallb-system
+- cert-manager

cluster/core/metallb-system/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: metallb
-  namespace: networking
+  namespace: metallb-system
 spec:
   interval: 5m
   chart:
@@ -14,7 +14,6 @@ spec:
         kind: HelmRepository
         name: bitnami-charts
         namespace: flux-system
-      interval: 10m
   values:
     controller:
       image:
@@ -24,11 +23,6 @@ spec:
       image:
         repository: metallb/speaker
         tag: v0.9.6
-    prometheus:
-      serviceMonitor:
-        enabled: false
-      prometheusRule:
-        enabled: false
     configInline:
       address-pools:
       - name: default

cluster/core/namespaces/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - cert-manager.yaml
-- networking.yaml
+- metallb-system.yaml

cluster/core/namespaces/metallb-system.yaml

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: networking
+  name: metallb-system

cluster/core/operators/cert-manager/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- helm-release.yaml

cluster/core/operators/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- cert-manager