feat: update kube-vip ansible playbook for k0s and k3s - ipv6 config changes (#1234)

* feat: update kube-vip ansible playbook for k0s and k3s Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update renovate Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: move ipv6 to advanced options Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: kube-vip manifests to partials Signed-off-by: Devin Buhl <devin@buhl.casa> * feat: kube vip samesies Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update config sample Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
2024-01-22 15:28:21 -05:00
1 parent 6557c255d6
commit afbf097dac
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      version: 1.14.6
+      version: 1.14.5
      sourceRef:
        kind: HelmRepository
        name: cilium
@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  #% if not bootstrap_ipv6_enabled %#
+  #% if not bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
  - ./cilium-l2.yaml
  #% endif %#
  - ./helmrelease.yaml
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "talos" %#
+#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "talos" %#
+#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "talos" %#
+#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -4,7 +4,7 @@ kind: Kustomization
 resources:
  - ./namespace.yaml
  - ./cilium/ks.yaml
-  #% if bootstrap_distribution == "talos" %#
+  #% if bootstrap_distribution in ['talos'] %#
  - ./kubelet-csr-approver/ks.yaml
  #% endif %#
  - ./metrics-server/ks.yaml
@@ -25,7 +25,7 @@ spec:
    keepHistory: false
  values:
    spegel:
-      #% if bootstrap_distribution == "k0s" %#
+      #% if bootstrap_distribution in ['k0s'] %#
      containerdSock: /run/k0s/containerd.sock
      containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
      #% endif %#
@@ -53,7 +53,7 @@ spec:
      enabled: true
      serviceMonitor:
        metricRelabelings:
-          #% if bootstrap_distribution == 'k3s' %#
+          #% if bootstrap_distribution in ['k3s'] %#
          # Remove duplicate labels provided by k3s
          - action: keep
            sourceLabels: ["__name__"]
@@ -74,7 +74,7 @@ spec:
      enabled: true
      serviceMonitor:
        metricRelabelings:
-          #% if bootstrap_distribution == 'k3s' %#
+          #% if bootstrap_distribution in ['k3s'] %#
          # Remove duplicate labels provided by k3s
          - action: keep
            sourceLabels: ["__name__"]
@@ -93,7 +93,7 @@ spec:
      #% for item in bootstrap_nodes.master %#
        - "#{ item.address }#"
      #% endfor %#
-      #% if bootstrap_distribution == 'k3s' %#
+      #% if bootstrap_distribution in ['k3s'] %#
      serviceMonitor:
        metricRelabelings:
          # Remove duplicate labels provided by k3s
@@ -107,7 +107,7 @@ spec:
    kubeScheduler:
      enabled: true
      endpoints: *endpoints
-      #% if bootstrap_distribution == 'k3s' %#
+      #% if bootstrap_distribution in ['k3s'] %#
      serviceMonitor:
        metricRelabelings:
          # Remove duplicate labels provided by k3s
@@ -26,7 +26,7 @@ spec:
  values:
    externalSnapshotter:
      enabled: false
-    #% if bootstrap_distribution == "k0s" %#
+    #% if bootstrap_distribution in ['k0s'] %#
    kubeletDir: /var/lib/k0s/kubelet
    #% endif %#
 #% endif %#
@@ -25,7 +25,7 @@ spec:
    keepHistory: false
  values:
    linux:
-      #% if bootstrap_distribution == "k0s" %#
+      #% if bootstrap_distribution in ['k0s'] %#
      kubelet: /var/lib/k0s/kubelet
      #% else %#
      kubelet: /var/lib/kubelet
@@ -5,6 +5,6 @@ resources:
  - ./namespace.yaml
  - ./descheduler/ks.yaml
  - ./reloader/ks.yaml
-  #% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+  #% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
  - ./system-upgrade-controller/ks.yaml
  #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta2
 kind: HelmRelease
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == "k3s" and addon_system_upgrade_controller.enabled %#
+#% if bootstrap_distribution in ['k3s'] and addon_system_upgrade_controller.enabled %#
 ---
 apiVersion: upgrade.cattle.io/v1
 kind: Plan
@@ -11,7 +11,7 @@ data:
  CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
  SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
  NODE_CIDR: "#{ bootstrap_node_cidr }#"
-  #% if bootstrap_ipv6_enabled %#
+  #% if bootstrap_advanced_flags.dual_stack_ipv4_first|default(false) %#
  CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
  SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
  #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'k0s' %#
+#% if bootstrap_distribution in ['k0s'] %#
 ---
 apiVersion: k0sctl.k0sproject.io/v1beta1
 kind: Cluster
@@ -91,7 +91,7 @@ spec:
            charts:
              - name: cilium
                chartname: cilium/cilium
-                # renovate: datasource=github-releases depName=cilium/cilium
+                # renovate: datasource=helm depName=cilium repository=https://helm.cilium.io
                version: "1.14.5"
                namespace: kube-system
                values: |2
@@ -1,131 +1,20 @@
+#% if bootstrap_distribution in ['k0s'] %#
 #!/usr/bin/env bash
 set -e
 set -o noglob

 [ $(id -u) -eq 0 ] || exec sudo $0 $@

-# Create directory
+# Create kube-vip directory
 mkdir -p /var/lib/k0s/manifests/kube-vip

 # Create kube-vip rbac
-cat <<EOF > /var/lib/k0s/manifests/kube-vip/rbac.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kube-vip
-  namespace: kube-system
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  annotations:
-    rbac.authorization.kubernetes.io/autoupdate: "true"
-  name: system:kube-vip-role
-rules:
-  - apiGroups: [""]
-    resources: ["services/status"]
-    verbs: ["update"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["list","get","watch", "update"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["list","get","watch", "update", "patch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["list", "get", "watch", "update", "create"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["list","get","watch", "update"]
---
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: system:kube-vip-binding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:kube-vip-role
-subjects:
- kind: ServiceAccount
-  name: kube-vip
-  namespace: kube-system
+cat <<EOF > /var/lib/k0s/manifests/kube-vip/kube-vip-rbac.yaml
+#% include 'partials/kube-vip-rbac.partial.yaml.j2' %#
 EOF

-cat <<EOF > /var/lib/k0s/manifests/kube-vip/ds.yaml
---
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: kube-vip
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/name: kube-vip
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: kube-vip
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: kube-vip
-    spec:
-      containers:
-        - name: kube-vip
-          image: ghcr.io/kube-vip/kube-vip:v0.6.4
-          imagePullPolicy: IfNotPresent
-          args: ["manager"]
-          env:
-            - name: address
-              value: "#{ bootstrap_kube_api_addr }#"
-            - name: vip_arp
-              value: "true"
-            - name: lb_enable
-              value: "true"
-            - name: port
-              value: "6443"
-            - name: vip_cidr
-              value: "32"
-            - name: cp_enable
-              value: "true"
-            - name: cp_namespace
-              value: kube-system
-            - name: vip_ddns
-              value: "false"
-            - name: svc_enable
-              value: "false"
-            - name: vip_leaderelection
-              value: "true"
-            - name: vip_leaseduration
-              value: "15"
-            - name: vip_renewdeadline
-              value: "10"
-            - name: vip_retryperiod
-              value: "2"
-            - name: prometheus_server
-              value: :2112
-          securityContext:
-            capabilities:
-              add: ["NET_ADMIN", "NET_RAW", "SYS_TIME"]
-      hostAliases:
-        - hostnames:
-            - kubernetes
-          ip: 127.0.0.1
-      hostNetwork: true
-      serviceAccountName: kube-vip
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/master
-                    operator: Exists
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: Exists
-      tolerations:
-        - effect: NoSchedule
-          operator: Exists
-        - effect: NoExecute
-          operator: Exists
+# Create kube-vip daemonset
+cat <<EOF > /var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml
+#% include 'partials/kube-vip-ds.partial.yaml.j2' %#
 EOF
+#% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'k0s' %#
+#% if bootstrap_distribution in ['k0s'] %#
 #!/usr/bin/env bash
 set -e
 set -o noglob
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'k0s' %#
+#% if bootstrap_distribution in ['k0s'] %#
 #!/usr/bin/env bash
 set -e
 set -o noglob
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'k0s' %#
+#% if bootstrap_distribution in ['k0s'] %#
 #!/usr/bin/env bash
 set -e
 set -o noglob
@@ -1,3 +1,3 @@
-#% if bootstrap_distribution == 'talos' %#
+#% if bootstrap_distribution in ['talos'] %#
 charts/
 #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'talos' %#
+#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'talos' %#
+#% if bootstrap_distribution in ['talos'] %#
 ---
 #% filter indent(width=0, first=True) %#
 #% include 'partials/cilium-values-init.partial.yaml.j2' %#
@@ -1,3 +1,3 @@
-#% if bootstrap_distribution == 'talos' %#
+#% if bootstrap_distribution in ['talos'] %#
 charts/
 #% endif %#
@@ -1,4 +1,4 @@
-#% if bootstrap_distribution == 'talos' %#
+#% if bootstrap_distribution in ['talos'] %#
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
@@ -1,29 +1,24 @@
-#% if bootstrap_distribution == 'talos' %#
+#% if bootstrap_distribution in ['talos'] %#
 # yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
 ---
-# renovate: datasource=github-releases depName=siderolabs/talos
+# renovate: depName=ghcr.io/siderolabs/installer datasource=docker extractVersion=^(?<version>.*)$
 talosVersion: v1.6.1
 # renovate: datasource=github-releases depName=kubernetes/kubernetes extractVersion=^v(?<version>.*)$
 kubernetesVersion: 1.29.1

 clusterName: &cluster home-kubernetes
-
 endpoint: https://#{ bootstrap_kube_api_addr }#:6443
-
 clusterPodNets:
  - "#{ bootstrap_cluster_cidr.split(',')[0] }#"
 clusterSvcNets:
  - "#{ bootstrap_service_cidr.split(',')[0] }#"
-
 additionalApiServerCertSans: &sans
  - "#{ bootstrap_kube_api_addr }#"
  - 127.0.0.1 # KubePrism
  #% for item in bootstrap_kube_additional_tls_sans %#
  - "#{ item }#"
  #% endfor %#
-
 additionalMachineCertSans: *sans
-
 cniConfig:
  name: none