From e11e47ff338dd4ee5991f8d154010077c62d643d Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 12:06:32 +0000 Subject: [PATCH 01/17] chore(deps): upgrade flux components to v0.12.3 Signed-off-by: Devin Buhl --- cluster/base/flux-system/gotk-components.yaml | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/cluster/base/flux-system/gotk-components.yaml b/cluster/base/flux-system/gotk-components.yaml index e0ab7b39..34b63911 100644 --- a/cluster/base/flux-system/gotk-components.yaml +++ b/cluster/base/flux-system/gotk-components.yaml @@ -1,5 +1,5 @@ --- -# Flux version: v0.12.1 +# Flux version: v0.12.3 # Components: source-controller,kustomize-controller,helm-controller,notification-controller apiVersion: v1 kind: Namespace @@ -7,7 +7,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: flux-system --- apiVersion: apiextensions.k8s.io/v1 @@ -19,7 +19,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: alerts.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -194,7 +194,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: buckets.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -382,7 +382,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: gitrepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -601,7 +601,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helmcharts.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -793,7 +793,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helmreleases.helm.toolkit.fluxcd.io spec: group: helm.toolkit.fluxcd.io @@ -1309,7 +1309,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helmrepositories.source.toolkit.fluxcd.io spec: group: source.toolkit.fluxcd.io @@ -1477,7 +1477,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: kustomizations.kustomize.toolkit.fluxcd.io spec: group: kustomize.toolkit.fluxcd.io @@ -1874,7 +1874,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: providers.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -2021,7 +2021,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: receivers.notification.toolkit.fluxcd.io spec: group: notification.toolkit.fluxcd.io @@ -2201,7 +2201,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: helm-controller namespace: flux-system --- @@ -2211,7 +2211,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: kustomize-controller namespace: flux-system --- @@ -2221,7 +2221,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: notification-controller namespace: flux-system --- @@ -2231,7 +2231,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: source-controller namespace: flux-system --- @@ -2241,7 +2241,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: crd-controller-flux-system rules: - apiGroups: @@ -2321,7 +2321,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: cluster-reconciler-flux-system roleRef: apiGroup: rbac.authorization.k8s.io @@ -2341,7 +2341,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 name: crd-controller-flux-system roleRef: apiGroup: rbac.authorization.k8s.io @@ -2373,7 +2373,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: notification-controller namespace: flux-system @@ -2393,7 +2393,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: source-controller namespace: flux-system @@ -2413,7 +2413,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: webhook-receiver namespace: flux-system @@ -2433,7 +2433,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: helm-controller namespace: flux-system @@ -2506,7 +2506,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: kustomize-controller namespace: flux-system @@ -2581,7 +2581,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: notification-controller namespace: flux-system @@ -2657,7 +2657,7 @@ metadata: labels: app.kubernetes.io/instance: flux-system app.kubernetes.io/part-of: flux - app.kubernetes.io/version: v0.12.1 + app.kubernetes.io/version: v0.12.3 control-plane: controller name: source-controller namespace: flux-system From 6599c1a516304cfdb04d20854731e0a2ff9f631d Mon Sep 17 00:00:00 2001 From: Drew Date: Thu, 15 Apr 2021 05:22:01 -0700 Subject: [PATCH 02/17] Update README.md Fixed wrong export name. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 85d61300..8da33213 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ Key-Length: 4096 Subkey-Type: 1 Subkey-Length: 4096 Expire-Date: 0 -Name-Real: ${KEY_NAME} +Name-Real: ${FLUX_KEY_NAME} EOF gpg --list-secret-keys "${FLUX_KEY_NAME}" From 19167efb03322aa485aa8292ebf052849953a054 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 09:22:18 -0400 Subject: [PATCH 03/17] fix: update readme --- README.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 8da33213..8439e36b 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS | [pre-commit](https://github.com/pre-commit/pre-commit) | Keeps formatting consistency across your files and ensures you **do not commit un-encrypted secrets** to your repository | `2.12.0` | ❌ | | [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | -## :rocket:  Pre-installation +## :warning:  Pre-installation It's very important and I cannot stress enough, make sure you are not pushing your secrets un-encrypted to a public Git repo. @@ -45,7 +45,7 @@ I would start off **by making your repository private** until you are certain th Very first step will be to create a new repository by clicking the **Use this template** button on this page. -### :key:  Setting up GnuPG keys +### :closed_lock_with_key:  Setting up GnuPG keys Here we will create a personal and a Flux GPG key. Using SOPS with GnuPG allows us to encrypt and decrypt secrets. @@ -133,7 +133,7 @@ kubectl --kubeconfig=./kubeconfig get nodes # k8s-worker-a Ready worker 4d20h v1.20.5+k3s1 ``` -### GitOps with Flux +### :small_blue_diamond:  GitOps with Flux Here we will be installing [flux](https://toolkit.fluxcd.io/) after some quick bootstrap steps. @@ -197,7 +197,7 @@ git push kubectl --kubeconfig=./kubeconfig --kustomize=./cluster/base/flux-system ``` -## Post installation +## :mega:  Post installation ### Verify ingress @@ -237,7 +237,7 @@ gpg --delete-secret-keys "${FLUX_KEY_FP}" [Here](https://marketplace.visualstudio.com/items?itemName=signageos.signageos-vscode-sops)'s a neat little plugin for those using VSCode. It will automatically decrypt you SOPS secrets when you click on the file in the editor and encrypt them when you save the file. -## Debugging +## :point_right:  Debugging Manually sync Flux with your Git repository @@ -264,8 +264,8 @@ Show the health of your main Flux `GitRepository` ```sh flux --kubeconfig=./kubeconfig get sources git -# NAME READY MESSAGE REVISION SUSPENDED -# flux-system True Fetched revision: main/943e4126e74b273ff603aedab89beb7e36be4998 main/943e4126e74b273ff603aedab89beb7e36be4998 False +# NAME READY MESSAGE REVISION SUSPENDED +# flux-system True Fetched revision: main/943e4126e74b273ff603aedab89beb7e36be4998 main/943e4126e74b273ff603aedab89beb7e36be4998 False ``` Show the health of your `HelmRelease`s @@ -291,7 +291,7 @@ flux --kubeconfig=./kubeconfig get sources helm -A Flux has a wide range of CLI options available be sure to run `flux --help` to view more! -## What's next? +## :grey_question:  What's next? The world is your cluster, try installing another application! From b4a6dc5e32e2c440e2a2853c665a9cc8551a3a84 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 09:34:23 -0400 Subject: [PATCH 04/17] fix: update readme --- README.md | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 8439e36b..13d49998 100644 --- a/README.md +++ b/README.md @@ -23,17 +23,18 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS ### :wrench:  Tools -| Tool | Purpose | Minimum version | Required | -|--------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|:---------------:|:--------:| -| [k3sup](https://github.com/alexellis/k3sup) | Tool to install k3s on your nodes | `0.10.2` | ✅ | -| [kubectl](https://kubernetes.io/docs/tasks/tools/) | Allows you to run commands against Kubernetes clusters | `1.21.0` | ✅ | -| [flux](https://toolkit.fluxcd.io/) | Operator that manages your k8s cluster based on your Git repository | `0.12.3` | ✅ | -| [SOPS](https://github.com/mozilla/sops) | Encrypts k8s secrets with GnuPG | `3.7.1` | ✅ | -| [GnuPG](https://gnupg.org/) | Encrypts and signs your data | `2.2.27` | ✅ | -| [pinentry](https://gnupg.org/related_software/pinentry/index.html) | Allows GnuPG to read passphrases and PIN numbers | `1.1.1` | ✅ | -| [direnv](https://github.com/direnv/direnv) | Exports env vars based on present working directory | `2.28.0` | ❌ | -| [pre-commit](https://github.com/pre-commit/pre-commit) | Keeps formatting consistency across your files and ensures you **do not commit un-encrypted secrets** to your repository | `2.12.0` | ❌ | -| [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | +| Tool | Purpose | Minimum version | Required | +|--------------------------------------------------------------------|---------------------------------------------------------------------|:---------------:|:--------:| +| [k3sup](https://github.com/alexellis/k3sup) | Tool to install k3s on your nodes | `0.10.2` | ✅ | +| [kubectl](https://kubernetes.io/docs/tasks/tools/) | Allows you to run commands against Kubernetes clusters | `1.21.0` | ✅ | +| [flux](https://toolkit.fluxcd.io/) | Operator that manages your k8s cluster based on your Git repository | `0.12.3` | ✅ | +| [SOPS](https://github.com/mozilla/sops) | Encrypts k8s secrets with GnuPG | `3.7.1` | ✅ | +| [GnuPG](https://gnupg.org/) | Encrypts and signs your data | `2.2.27` | ✅ | +| [pinentry](https://gnupg.org/related_software/pinentry/index.html) | Allows GnuPG to read passphrases and PIN numbers | `1.1.1` | ✅ | +| [direnv](https://github.com/direnv/direnv) | Exports env vars based on present working directory | `2.28.0` | ❌ | +| [pre-commit](https://github.com/pre-commit/pre-commit) | Runs checks during `git commit` | `2.12.0` | ❌ | +| [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | +| [helm](https://helm.sh/) | Manage Kubernetes applications | `3.5.4` | ❌ | ## :warning:  Pre-installation From 3568752163ae0232b43ec419ec0184326e6e7b02 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 09:48:30 -0400 Subject: [PATCH 05/17] fix: update readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 13d49998..20bf034f 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS | [direnv](https://github.com/direnv/direnv) | Exports env vars based on present working directory | `2.28.0` | ❌ | | [pre-commit](https://github.com/pre-commit/pre-commit) | Runs checks during `git commit` | `2.12.0` | ❌ | | [kustomize](https://kustomize.io/) | Template-free way to customize application configuration | `4.1.0` | ❌ | -| [helm](https://helm.sh/) | Manage Kubernetes applications | `3.5.4` | ❌ | +| [helm](https://helm.sh/) | Manage Kubernetes applications | `3.5.4` | ❌ | ## :warning:  Pre-installation From ded2f30585fbade6de320eae92dbf42462e44426 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 09:52:22 -0400 Subject: [PATCH 06/17] fix: update readme --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index 20bf034f..c6d090eb 100644 --- a/README.md +++ b/README.md @@ -40,8 +40,6 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS It's very important and I cannot stress enough, make sure you are not pushing your secrets un-encrypted to a public Git repo. -I would start off **by making your repository private** until you are certain there are no leaks before showing it off to the world. - ## :rocket:  Lets go! Very first step will be to create a new repository by clicking the **Use this template** button on this page. From c649f2bb5577ec132ce561e23455734050c9864d Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 11:48:22 -0400 Subject: [PATCH 07/17] feat: flatten core directory --- README.md | 2 +- .../cert-manager => cert-manager/crd}/kustomization.yaml | 0 cluster/core/{operators => }/cert-manager/helm-release.yaml | 3 --- .../{infrastructure => }/cert-manager/kustomization.yaml | 2 ++ .../cert-manager/letsencrypt-production.yaml | 0 .../cert-manager/letsencrypt-staging.yaml | 0 .../core/{infrastructure => }/cert-manager/secret.enc.yaml | 0 cluster/core/crds/kustomization.yaml | 4 ---- cluster/core/infrastructure/kustomization.yaml | 5 ----- cluster/core/kustomization.yaml | 5 ++--- .../metallb => metallb-system}/helm-release.yaml | 4 +--- .../metallb => metallb-system}/kustomization.yaml | 0 cluster/core/namespaces/kustomization.yaml | 2 +- .../core/namespaces/{networking.yaml => metallb-system.yaml} | 2 +- cluster/core/operators/cert-manager/kustomization.yaml | 4 ---- cluster/core/operators/kustomization.yaml | 4 ---- 16 files changed, 8 insertions(+), 29 deletions(-) rename cluster/core/{crds/cert-manager => cert-manager/crd}/kustomization.yaml (100%) rename cluster/core/{operators => }/cert-manager/helm-release.yaml (91%) rename cluster/core/{infrastructure => }/cert-manager/kustomization.yaml (85%) rename cluster/core/{infrastructure => }/cert-manager/letsencrypt-production.yaml (100%) rename cluster/core/{infrastructure => }/cert-manager/letsencrypt-staging.yaml (100%) rename cluster/core/{infrastructure => }/cert-manager/secret.enc.yaml (100%) delete mode 100644 cluster/core/crds/kustomization.yaml delete mode 100644 cluster/core/infrastructure/kustomization.yaml rename cluster/core/{infrastructure/metallb => metallb-system}/helm-release.yaml (92%) rename cluster/core/{infrastructure/metallb => metallb-system}/kustomization.yaml (100%) rename cluster/core/namespaces/{networking.yaml => metallb-system.yaml} (66%) delete mode 100644 cluster/core/operators/cert-manager/kustomization.yaml delete mode 100644 cluster/core/operators/kustomization.yaml diff --git a/README.md b/README.md index c6d090eb..cd60483a 100644 --- a/README.md +++ b/README.md @@ -165,7 +165,7 @@ envsubst < ./.sops.yaml envsubst < ./cluster/cluster-secrets.yaml envsubst < ./cluster/cluster-settings.yaml envsubst < ./cluster/base/flux-system/gotk-sync.yaml -envsubst < ./cluster/core/infrastructure/cert-manager/secret.enc.yaml +envsubst < ./cluster/core/cert-manager/secret.enc.yaml ``` 4. **Verify** all the above files have the correct information present diff --git a/cluster/core/crds/cert-manager/kustomization.yaml b/cluster/core/cert-manager/crd/kustomization.yaml similarity index 100% rename from cluster/core/crds/cert-manager/kustomization.yaml rename to cluster/core/cert-manager/crd/kustomization.yaml diff --git a/cluster/core/operators/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml similarity index 91% rename from cluster/core/operators/cert-manager/helm-release.yaml rename to cluster/core/cert-manager/helm-release.yaml index c4dd62d2..a62b325a 100644 --- a/cluster/core/operators/cert-manager/helm-release.yaml +++ b/cluster/core/cert-manager/helm-release.yaml @@ -5,7 +5,6 @@ metadata: name: cert-manager namespace: cert-manager spec: - interval: 5m chart: spec: # renovate: registryUrl=https://charts.jetstack.io/ @@ -15,7 +14,6 @@ spec: kind: HelmRepository name: jetstack-charts namespace: flux-system - interval: 5m values: installCRDs: false webhook: @@ -34,4 +32,3 @@ spec: enabled: false servicemonitor: enabled: false - prometheusInstance: monitoring diff --git a/cluster/core/infrastructure/cert-manager/kustomization.yaml b/cluster/core/cert-manager/kustomization.yaml similarity index 85% rename from cluster/core/infrastructure/cert-manager/kustomization.yaml rename to cluster/core/cert-manager/kustomization.yaml index cf778581..f0c9364e 100644 --- a/cluster/core/infrastructure/cert-manager/kustomization.yaml +++ b/cluster/core/cert-manager/kustomization.yaml @@ -1,6 +1,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: +- crd +- helm-release.yaml - letsencrypt-production.yaml - letsencrypt-staging.yaml - secret.enc.yaml diff --git a/cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml b/cluster/core/cert-manager/letsencrypt-production.yaml similarity index 100% rename from cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml rename to cluster/core/cert-manager/letsencrypt-production.yaml diff --git a/cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml b/cluster/core/cert-manager/letsencrypt-staging.yaml similarity index 100% rename from cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml rename to cluster/core/cert-manager/letsencrypt-staging.yaml diff --git a/cluster/core/infrastructure/cert-manager/secret.enc.yaml b/cluster/core/cert-manager/secret.enc.yaml similarity index 100% rename from cluster/core/infrastructure/cert-manager/secret.enc.yaml rename to cluster/core/cert-manager/secret.enc.yaml diff --git a/cluster/core/crds/kustomization.yaml b/cluster/core/crds/kustomization.yaml deleted file mode 100644 index 75b65cfc..00000000 --- a/cluster/core/crds/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- cert-manager diff --git a/cluster/core/infrastructure/kustomization.yaml b/cluster/core/infrastructure/kustomization.yaml deleted file mode 100644 index 749e1da3..00000000 --- a/cluster/core/infrastructure/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- cert-manager -- metallb diff --git a/cluster/core/kustomization.yaml b/cluster/core/kustomization.yaml index 65d46e44..65cbeeb5 100644 --- a/cluster/core/kustomization.yaml +++ b/cluster/core/kustomization.yaml @@ -1,7 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- crds -- infrastructure - namespaces -- operators +- metallb-system +- cert-manager diff --git a/cluster/core/infrastructure/metallb/helm-release.yaml b/cluster/core/metallb-system/helm-release.yaml similarity index 92% rename from cluster/core/infrastructure/metallb/helm-release.yaml rename to cluster/core/metallb-system/helm-release.yaml index b9266346..683cd94f 100644 --- a/cluster/core/infrastructure/metallb/helm-release.yaml +++ b/cluster/core/metallb-system/helm-release.yaml @@ -3,9 +3,8 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: metallb - namespace: networking + namespace: metallb-system spec: - interval: 5m chart: spec: chart: metallb @@ -14,7 +13,6 @@ spec: kind: HelmRepository name: bitnami-charts namespace: flux-system - interval: 10m values: controller: image: diff --git a/cluster/core/infrastructure/metallb/kustomization.yaml b/cluster/core/metallb-system/kustomization.yaml similarity index 100% rename from cluster/core/infrastructure/metallb/kustomization.yaml rename to cluster/core/metallb-system/kustomization.yaml diff --git a/cluster/core/namespaces/kustomization.yaml b/cluster/core/namespaces/kustomization.yaml index 8b2d090b..f086345d 100644 --- a/cluster/core/namespaces/kustomization.yaml +++ b/cluster/core/namespaces/kustomization.yaml @@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - cert-manager.yaml -- networking.yaml +- metallb-system.yaml diff --git a/cluster/core/namespaces/networking.yaml b/cluster/core/namespaces/metallb-system.yaml similarity index 66% rename from cluster/core/namespaces/networking.yaml rename to cluster/core/namespaces/metallb-system.yaml index fa9575ea..928cb910 100644 --- a/cluster/core/namespaces/networking.yaml +++ b/cluster/core/namespaces/metallb-system.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: Namespace metadata: - name: networking + name: metallb-system diff --git a/cluster/core/operators/cert-manager/kustomization.yaml b/cluster/core/operators/cert-manager/kustomization.yaml deleted file mode 100644 index 761d2252..00000000 --- a/cluster/core/operators/cert-manager/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- helm-release.yaml diff --git a/cluster/core/operators/kustomization.yaml b/cluster/core/operators/kustomization.yaml deleted file mode 100644 index 75b65cfc..00000000 --- a/cluster/core/operators/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- cert-manager From b03d276ce411897bced80aa764fcc85174a2a99d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E1=97=AA=D1=94=CE=BD=CE=B9=CE=B7=20=E1=97=B7=CF=85=D0=BD?= =?UTF-8?q?=CA=9F?= Date: Thu, 15 Apr 2021 11:49:55 -0400 Subject: [PATCH 08/17] fix: typo in filename --- cluster/core/namespaces/{cert-manger.yaml => cert-manager.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename cluster/core/namespaces/{cert-manger.yaml => cert-manager.yaml} (100%) diff --git a/cluster/core/namespaces/cert-manger.yaml b/cluster/core/namespaces/cert-manager.yaml similarity index 100% rename from cluster/core/namespaces/cert-manger.yaml rename to cluster/core/namespaces/cert-manager.yaml From d1126ea7798584b45486394ce1f28bfc1fe50010 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 11:52:41 -0400 Subject: [PATCH 09/17] fix: update readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index cd60483a..c5b00add 100644 --- a/README.md +++ b/README.md @@ -175,7 +175,7 @@ envsubst < ./cluster/core/cert-manager/secret.enc.yaml ```sh export GPG_TTY=$(tty) sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml -sops --encrypt --in-place ./cluster/core/infrastructure/cert-manager/secret.enc.yaml +sops --encrypt --in-place ./cluster/core/cert-manager/secret.enc.yaml ``` Variables defined in `cluster-secrets.yaml` and `cluster-settings.yaml` will be usable anywhere in your YAML manifests under `./cluster` From 665ebdea0f5c497c611161f9724426510c7e2d58 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 11:55:36 -0400 Subject: [PATCH 10/17] fix: update readme --- README.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index c5b00add..ba56d4b4 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,17 @@ Bare metal or VMs with any modern operating system like Ubuntu, Debian or CentOS It's very important and I cannot stress enough, make sure you are not pushing your secrets un-encrypted to a public Git repo. +### pre-commit + +It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-commit hooks that come with this repository. +[sops-pre-commit](https://github.com/k8s-at-home/sops-pre-commit) will check to make sure you are not by accident commiting your secrets un-encrypted. + +After pre-commit is installed on your machine run: + +```sh +pre-commit install-hooks +``` + ## :rocket:  Lets go! Very first step will be to create a new repository by clicking the **Use this template** button on this page. @@ -208,17 +219,6 @@ sudo echo "${BOOTSTRAP_INGRESS_NGINX_LB} ${BOOTSTRAP_DOMAIN} homer.${BOOTSTRAP_D Head over to your browser and you _should_ be able to access `https://homer.${BOOTSTRAP_DOMAIN}` -### pre-commit - -It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-commit hooks that come with this repository. -[sops-pre-commit](https://github.com/k8s-at-home/sops-pre-commit) will check to make sure you are not by accident commiting your SOPS secrets un-encrypted. - -After pre-commit is installed run: - -```sh -pre-commit install-hooks -``` - ### direnv This is a great tool to export environment variables depending on what your present working directory is, head over to their [installation guide](https://direnv.net/docs/installation.html) and don't forget to hook it into your shell! From c90ad4e6d9cf24c512a2182c462947f82db3e511 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 12:31:40 -0400 Subject: [PATCH 11/17] feat: update yamllint pre-commit hook --- .pre-commit-config.yaml | 2 +- cluster/core/cert-manager/helm-release.yaml | 4 ---- cluster/core/metallb-system/helm-release.yaml | 5 ----- 3 files changed, 1 insertion(+), 10 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index bc2313ae..1e6f41e8 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,7 +1,7 @@ fail_fast: false repos: - repo: https://github.com/adrienverge/yamllint.git - rev: v1.25.0 + rev: v1.26.1 hooks: - args: - -c diff --git a/cluster/core/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml index a62b325a..8bf42785 100644 --- a/cluster/core/cert-manager/helm-release.yaml +++ b/cluster/core/cert-manager/helm-release.yaml @@ -28,7 +28,3 @@ spec: nameservers: - "1.1.1.1" - "8.8.8.8" - prometheus: - enabled: false - servicemonitor: - enabled: false diff --git a/cluster/core/metallb-system/helm-release.yaml b/cluster/core/metallb-system/helm-release.yaml index 683cd94f..d09e34fc 100644 --- a/cluster/core/metallb-system/helm-release.yaml +++ b/cluster/core/metallb-system/helm-release.yaml @@ -22,11 +22,6 @@ spec: image: repository: metallb/speaker tag: v0.9.6 - prometheus: - serviceMonitor: - enabled: false - prometheusRule: - enabled: false configInline: address-pools: - name: default From aa208009ecce7f4da3a0cc714d3559fb7a47989e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E1=97=AA=D1=94=CE=BD=CE=B9=CE=B7=20=E1=97=B7=CF=85=D0=BD?= =?UTF-8?q?=CA=9F?= Date: Thu, 15 Apr 2021 15:09:47 -0400 Subject: [PATCH 12/17] fix: use python version of sops-pre-commit --- .pre-commit-config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 1e6f41e8..f5b1fe87 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,6 +23,6 @@ repos: hooks: - id: fix-smartquotes - repo: https://github.com/k8s-at-home/sops-pre-commit - rev: v1.1.0 + rev: v2.0.0 hooks: - - id: sops-encrypted-check + - id: forbid-secrets From 4dbeac3867fbdd6fa6f58c99a9e57eb7f0847733 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 15:46:44 -0400 Subject: [PATCH 13/17] fix: add interval back --- cluster/apps/default/homer/helm-release.yaml | 1 - cluster/apps/networking/ingress-nginx/helm-release.yaml | 1 - cluster/core/cert-manager/helm-release.yaml | 1 + cluster/core/metallb-system/helm-release.yaml | 1 + 4 files changed, 2 insertions(+), 2 deletions(-) diff --git a/cluster/apps/default/homer/helm-release.yaml b/cluster/apps/default/homer/helm-release.yaml index 62a527f4..e608a00f 100644 --- a/cluster/apps/default/homer/helm-release.yaml +++ b/cluster/apps/default/homer/helm-release.yaml @@ -15,7 +15,6 @@ spec: kind: HelmRepository name: k8s-at-home-charts namespace: flux-system - interval: 5m values: image: repository: b4bz/homer diff --git a/cluster/apps/networking/ingress-nginx/helm-release.yaml b/cluster/apps/networking/ingress-nginx/helm-release.yaml index 68f0642f..13740bdd 100644 --- a/cluster/apps/networking/ingress-nginx/helm-release.yaml +++ b/cluster/apps/networking/ingress-nginx/helm-release.yaml @@ -15,7 +15,6 @@ spec: kind: HelmRepository name: ingress-nginx-charts namespace: flux-system - interval: 5m values: controller: ingressClass: nginx diff --git a/cluster/core/cert-manager/helm-release.yaml b/cluster/core/cert-manager/helm-release.yaml index 8bf42785..4c89afd4 100644 --- a/cluster/core/cert-manager/helm-release.yaml +++ b/cluster/core/cert-manager/helm-release.yaml @@ -5,6 +5,7 @@ metadata: name: cert-manager namespace: cert-manager spec: + interval: 5m chart: spec: # renovate: registryUrl=https://charts.jetstack.io/ diff --git a/cluster/core/metallb-system/helm-release.yaml b/cluster/core/metallb-system/helm-release.yaml index d09e34fc..0abe5bc1 100644 --- a/cluster/core/metallb-system/helm-release.yaml +++ b/cluster/core/metallb-system/helm-release.yaml @@ -5,6 +5,7 @@ metadata: name: metallb namespace: metallb-system spec: + interval: 5m chart: spec: chart: metallb From fc55dcb090c32fac6a388c2ea7a0ada7e6304eac Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 15:47:26 -0400 Subject: [PATCH 14/17] fix: use latest pre-commit --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index f5b1fe87..57daf2d0 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,6 +23,6 @@ repos: hooks: - id: fix-smartquotes - repo: https://github.com/k8s-at-home/sops-pre-commit - rev: v2.0.0 + rev: v2.0.1 hooks: - id: forbid-secrets From a85af91a5ac89ec9d54c5ad16dff3b9dc97a4ba5 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 15:56:57 -0400 Subject: [PATCH 15/17] fix: add some NFS storage options --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ba56d4b4..84938cf5 100644 --- a/README.md +++ b/README.md @@ -290,9 +290,9 @@ flux --kubeconfig=./kubeconfig get sources helm -A Flux has a wide range of CLI options available be sure to run `flux --help` to view more! -## :grey_question:  What's next? +## :grey_question:  What's next -The world is your cluster, try installing another application! +The world is your cluster, try installing another application or if you have a NAS and want storage back by that check out [democratic-csi](https://github.com/democratic-csi/democratic-csi) or [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner). ## :handshake:  Thanks From 1e64deabbf0dbf3ddc9430640ea818a8643c6cce Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Thu, 15 Apr 2021 15:58:50 -0400 Subject: [PATCH 16/17] fix: add some NFS storage options --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 84938cf5..eb415b90 100644 --- a/README.md +++ b/README.md @@ -292,7 +292,7 @@ Flux has a wide range of CLI options available be sure to run `flux --help` to v ## :grey_question:  What's next -The world is your cluster, try installing another application or if you have a NAS and want storage back by that check out [democratic-csi](https://github.com/democratic-csi/democratic-csi) or [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner). +The world is your cluster, try installing another application or if you have a NAS and want storage back by that check out [democratic-csi](https://github.com/democratic-csi/democratic-csi), [csi-driver-nfs](https://github.com/kubernetes-csi/csi-driver-nfs) or [nfs-subdir-external-provisioner](https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner). ## :handshake:  Thanks From 676ae6dda83f97c2ac468073a70d55b3059bd7ba Mon Sep 17 00:00:00 2001 From: Drew Date: Thu, 15 Apr 2021 13:42:19 -0700 Subject: [PATCH 17/17] [FIX] Actually substitute ENV Ugly --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index eb415b90..923a651b 100644 --- a/README.md +++ b/README.md @@ -172,11 +172,11 @@ export BOOTSTRAP_DOMAIN_CERT="k8s-at-home" export BOOTSTRAP_CLOUDFLARE_TOKEN="dsKq41iLAbXE37GV" export BOOTSTRAP_INGRESS_NGINX_LB="169.254.1.10" -envsubst < ./.sops.yaml -envsubst < ./cluster/cluster-secrets.yaml -envsubst < ./cluster/cluster-settings.yaml -envsubst < ./cluster/base/flux-system/gotk-sync.yaml -envsubst < ./cluster/core/cert-manager/secret.enc.yaml +envsubst < ./.sops.yaml > ./.sops.yaml.tmp && mv ./.sops.yaml.tmp ./.sops.yaml +envsubst < ./cluster/cluster-secrets.yaml > ./cluster/cluster-secrets.yaml.tmp && mv ./cluster/cluster-secrets.yaml.tmp ./cluster/cluster-secrets.yaml +envsubst < ./cluster/cluster-settings.yaml > ./cluster/cluster-settings.yaml.tmp && mv ./cluster/cluster-settings.yaml.tmp ./cluster/cluster-settings.yaml +envsubst < ./cluster/base/flux-system/gotk-sync.yaml > ./cluster/base/flux-system/gotk-sync.yaml.tmp && mv ./cluster/base/flux-system/gotk-sync.yaml.tmp ./cluster/base/flux-system/gotk-sync.yaml +envsubst < ./cluster/core/cert-manager/secret.enc.yaml > ./cluster/core/cert-manager/secret.enc.yaml.tmp && mv ./cluster/core/cert-manager/secret.enc.yaml.tmp ./cluster/core/cert-manager/secret.enc.yaml ``` 4. **Verify** all the above files have the correct information present