refactor!: project updates (#1326)
* refactor!: flux is required again Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: delimiter that chomps Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: bootstrap_cloudflare logic Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: update tests Signed-off-by: Devin Buhl <devin@buhl.casa> * fix: remove last quote Signed-off-by: Devin Buhl <devin@buhl.casa> * chore: update readme Signed-off-by: Devin Buhl <devin@buhl.casa> --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
04ff4ef994
commit
c17d543b21
93 files changed
+591
-755
No files matched your search
@@ -1 +0,0 @@
|
||||
main = lambda data: data.get("flux", {}).get("enabled", False) == True
|
||||
@@ -1 +1 @@
|
||||
main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True
|
||||
main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True
|
||||
+1
-1
@@ -4,4 +4,4 @@ kind: Secret
|
||||
metadata:
|
||||
name: cert-manager-secret
|
||||
stringData:
|
||||
api-token: "{{ cloudflare.token }}"
|
||||
api-token: "#{ bootstrap_cloudflare.token }#"
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
@@ -41,4 +41,4 @@ spec:
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -3,6 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
{% if flux.github.webhook.enabled %}
|
||||
- ./webhooks/ks.yaml
|
||||
{% endif %}
|
||||
@@ -1,6 +0,0 @@
|
||||
main = lambda data: (
|
||||
data.get("flux", {})
|
||||
.get("github", {})
|
||||
.get("webhook", {})
|
||||
.get("enabled", False) == True
|
||||
)
|
||||
@@ -1,4 +1,4 @@
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
@@ -22,4 +22,4 @@ spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
+2
-2
@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
- ./ingress.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
- ./receiver.yaml
|
||||
+1
-1
@@ -4,4 +4,4 @@ kind: Secret
|
||||
metadata:
|
||||
name: github-webhook-token-secret
|
||||
stringData:
|
||||
token: "{{ flux.github.webhook.token }}"
|
||||
token: "#{ bootstrap_github_webhook_token }#"
|
||||
@@ -9,21 +9,21 @@ spec:
|
||||
matchLabels:
|
||||
kubernetes.io/os: linux
|
||||
virtualRouters:
|
||||
- localASN: {{ distribution.talos.bgp.local_asn }}
|
||||
- localASN: #{ bootstrap_bgp.local_asn }#
|
||||
neighbors:
|
||||
{% if distribution.talos.bgp.peers %}
|
||||
{% for item in distribution.talos.bgp.peers %}
|
||||
- peerAddress: "{{ item }}/32"
|
||||
peerASN: {{ distribution.talos.bgp.peer_asn }}
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
{% if nodes.default_gateway %}
|
||||
- peerAddress: "{{ nodes.default_gateway }}/32"
|
||||
{% else %}
|
||||
- peerAddress: "{{ nodes.host_network | nthhost(1) }}/32"
|
||||
{% endif %}
|
||||
peerASN: {{ distribution.talos.bgp.peer_asn }}
|
||||
{% endif %}
|
||||
#% if bootstrap_bgp.peers %#
|
||||
#% for item in bootstrap_bgp.peers %#
|
||||
- peerAddress: "#{ item }#/32"
|
||||
peerASN: #{ bootstrap_bgp.peer_asn }#
|
||||
#% endfor %#
|
||||
#% else %#
|
||||
#% if bootstrap_node_default_gateway %#
|
||||
- peerAddress: "#{ bootstrap_node_default_gateway }#/32"
|
||||
#% else %#
|
||||
- peerAddress: "#{ bootstrap_node_network | nthhost(1) }#/32"
|
||||
#% endif %#
|
||||
peerASN: #{ bootstrap_bgp.peer_asn }#
|
||||
#% endif %#
|
||||
serviceSelector:
|
||||
matchExpressions:
|
||||
- {key: somekey, operator: NotIn, values: ['never-used-value']}
|
||||
@@ -34,4 +34,4 @@ metadata:
|
||||
name: pool
|
||||
spec:
|
||||
cidrs:
|
||||
- cidr: "${LOADBALANCER_CIDR}"
|
||||
- cidr: "${BGP_ADVERTISED_CIDR}"
|
||||
@@ -23,6 +23,6 @@ spec:
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
{% filter indent(width=4, first=True) %}
|
||||
{% include 'partials/cilium-values-full.partial.yaml.j2' %}
|
||||
{% endfilter %}
|
||||
#% filter indent(width=4, first=True) %#
|
||||
#% include 'partials/cilium-values-full.partial.yaml.j2' %#
|
||||
#% endfilter %#
|
||||
@@ -2,11 +2,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
{% if distribution.talos.bgp.enabled %}
|
||||
#% if bootstrap_bgp.enabled %#
|
||||
- ./cilium-bgp.yaml
|
||||
{% endif %}
|
||||
{% if ( (not distribution.talos.bgp.enabled) and
|
||||
(not feature_gates.dual_stack_ipv4_first) ) %}
|
||||
#% endif %#
|
||||
#% if ((not bootstrap_bgp.enabled) and (not bootstrap_feature_gates.dual_stack_ipv4_first)) %#
|
||||
- ./cilium-l2.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
- ./helmrelease.yaml
|
||||
@@ -1 +1 @@
|
||||
main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
|
||||
main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
|
||||
+3
-3
@@ -23,9 +23,9 @@ spec:
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
{% filter indent(width=4, first=True) %}
|
||||
{% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
|
||||
{% endfilter %}
|
||||
#% filter indent(width=4, first=True) %#
|
||||
#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
|
||||
#% endfilter %#
|
||||
metrics:
|
||||
enable: true
|
||||
serviceMonitor:
|
||||
|
||||
@@ -4,11 +4,11 @@ kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cilium/ks.yaml
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
- ./kubelet-csr-approver/ks.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
- ./metrics-server/ks.yaml
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
- ./spegel/ks.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
- ./reloader/ks.yaml
|
||||
@@ -28,4 +28,4 @@ spec:
|
||||
readOnlyRootFileSystem: true
|
||||
podMonitor:
|
||||
enabled: true
|
||||
namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}"
|
||||
namespace: "{{ .Release.Namespace }}"
|
||||
@@ -1 +1 @@
|
||||
main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
|
||||
main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
|
||||
@@ -1 +1 @@
|
||||
main = lambda data: data.get("cloudflare", {}).get("enabled", False) == True
|
||||
main = lambda data: data.get("bootstrap_cloudflare", {}).get("enabled", False) == True
|
||||
@@ -4,10 +4,10 @@ kind: Secret
|
||||
metadata:
|
||||
name: cloudflared-secret
|
||||
stringData:
|
||||
TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
|
||||
TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
|
||||
credentials.json: |
|
||||
{
|
||||
"AccountTag": "{{ cloudflare.tunnel.account_id }}",
|
||||
"TunnelSecret": "{{ cloudflare.tunnel.secret }}",
|
||||
"TunnelID": "{{ cloudflare.tunnel.id }}"
|
||||
"AccountTag": "#{ bootstrap_cloudflare.tunnel.account_id }#",
|
||||
"TunnelSecret": "#{ bootstrap_cloudflare.tunnel.secret }#",
|
||||
"TunnelID": "#{ bootstrap_cloudflare.tunnel.id }#"
|
||||
}
|
||||
@@ -82,7 +82,7 @@ spec:
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
|
||||
hosts:
|
||||
- host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-external.${SECRET_DOMAIN}"
|
||||
- host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
@@ -95,7 +95,7 @@ spec:
|
||||
enabled: true
|
||||
className: internal
|
||||
hosts:
|
||||
- host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-internal.${SECRET_DOMAIN}"
|
||||
- host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
service:
|
||||
|
||||
@@ -4,4 +4,4 @@ kind: Secret
|
||||
metadata:
|
||||
name: external-dns-secret
|
||||
stringData:
|
||||
api-token: "{{ cloudflare.token }}"
|
||||
api-token: "#{ bootstrap_cloudflare.token }#"
|
||||
+2
-2
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./staging.yaml
|
||||
{% if cloudflare.acme.production %}
|
||||
#% if bootstrap_cloudflare.acme.production %#
|
||||
- ./production.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
+4
-4
@@ -32,7 +32,7 @@ spec:
|
||||
service:
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
|
||||
io.cilium/lb-ipam-ips: "{{ cloudflare.tunnel.ingress_vip }}"
|
||||
io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#"
|
||||
externalTrafficPolicy: Cluster
|
||||
ingressClassResource:
|
||||
name: external
|
||||
@@ -70,11 +70,11 @@ spec:
|
||||
namespaceSelector:
|
||||
any: true
|
||||
extraArgs:
|
||||
{% if cloudflare.acme.production %}
|
||||
#% if bootstrap_cloudflare.acme.production %#
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
|
||||
{% else %}
|
||||
#% else %#
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
+4
-4
@@ -29,7 +29,7 @@ spec:
|
||||
replicaCount: 1
|
||||
service:
|
||||
annotations:
|
||||
io.cilium/lb-ipam-ips: "{{ cloudflare.ingress_vip }}"
|
||||
io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.ingress_vip }#"
|
||||
externalTrafficPolicy: Cluster
|
||||
ingressClassResource:
|
||||
name: internal
|
||||
@@ -67,11 +67,11 @@ spec:
|
||||
namespaceSelector:
|
||||
any: true
|
||||
extraArgs:
|
||||
{% if cloudflare.acme.production %}
|
||||
#% if bootstrap_cloudflare.acme.production %#
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
|
||||
{% else %}
|
||||
#% else %#
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
@@ -30,5 +30,5 @@ spec:
|
||||
type: LoadBalancer
|
||||
port: 53
|
||||
annotations:
|
||||
io.cilium/lb-ipam-ips: "{{ cloudflare.gateway_vip }}"
|
||||
io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.gateway_vip }#"
|
||||
externalTrafficPolicy: Cluster
|
||||
@@ -1 +1 @@
|
||||
main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["k3s"]
|
||||
main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s"]
|
||||
@@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
{% if distribution.type in ['k3s', 'talos'] %}
|
||||
#% if bootstrap_distribution in ['k3s', 'talos'] %#
|
||||
- ./system-upgrade-controller/ks.yaml
|
||||
{% endif %}
|
||||
{% if distribution.type in ["k3s"] %}
|
||||
#% endif %#
|
||||
#% if bootstrap_distribution in ["k3s"] %#
|
||||
- ./k3s/ks.yaml
|
||||
{% endif %}
|
||||
{% if distribution.type in ["talos"] and distribution.talos.schematicID %}
|
||||
#% endif %#
|
||||
#% if bootstrap_distribution in ["talos"] and bootstrap_talos.schematic_id %#
|
||||
- ./talos/ks.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
+1
-1
@@ -1 +1 @@
|
||||
main = lambda data: data.get("distribution", {}).get("type", "k3s") in ['k3s', 'talos']
|
||||
main = lambda data: data.get("bootstrap_distribution", "k3s") in ["k3s", "talos"]
|
||||
+2
-2
@@ -11,7 +11,7 @@ subjects:
|
||||
- kind: ServiceAccount
|
||||
name: system-upgrade
|
||||
namespace: system-upgrade
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
---
|
||||
apiVersion: talos.dev/v1alpha1
|
||||
kind: ServiceAccount
|
||||
@@ -20,4 +20,4 @@ metadata:
|
||||
spec:
|
||||
roles:
|
||||
- os:admin
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -1,6 +1,4 @@
|
||||
main = lambda data: (
|
||||
data.get("distribution", {}).get("type", "k3s") in ["talos"] and
|
||||
data.get("distribution", {})
|
||||
.get("talos", {})
|
||||
.get("schematicID", {})
|
||||
data.get("bootstrap_distribution", "k3s") in ["talos"] and
|
||||
data.get("talos", {}).get("schematic_id", {})
|
||||
)
|
||||
@@ -88,6 +88,6 @@ spec:
|
||||
args:
|
||||
- --nodes=$(NODE_IP)
|
||||
- upgrade
|
||||
- --image=factory.talos.dev/installer/{{ distribution.talos.schematicID }}:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
|
||||
- --image=factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#:$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
|
||||
- --preserve=true
|
||||
- --wait=false
|
||||
@@ -1 +0,0 @@
|
||||
main = lambda data: data.get("flux", {}).get("enabled", False) == True
|
||||
+5
-5
@@ -1,4 +1,4 @@
|
||||
{% if flux.github.private.enabled %}
|
||||
#% if bootstrap_github_private_key %#
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
@@ -7,11 +7,11 @@ metadata:
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
identity: |
|
||||
{% filter indent(width=4, first=False) %}
|
||||
{{ flux.github.private.key }}
|
||||
{%- endfilter %}
|
||||
#% filter indent(width=4, first=False) %#
|
||||
#{ bootstrap_github_private_key }#
|
||||
#%- endfilter %#
|
||||
known_hosts: |
|
||||
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
File renamed without changes.
@@ -0,0 +1 @@
|
||||
main = lambda data: data.get("bootstrap_distribution", "k3s") in ["talos"]
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
#% filter indent(width=0, first=True) %#
|
||||
#% include 'partials/cilium-values-init.partial.yaml.j2' %#
|
||||
#% endfilter %#
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
repositories:
|
||||
- name: cilium
|
||||
url: https://helm.cilium.io
|
||||
- name: postfinance
|
||||
url: https://postfinance.github.io/kubelet-csr-approver
|
||||
|
||||
releases:
|
||||
- name: cilium
|
||||
namespace: kube-system
|
||||
chart: cilium/cilium
|
||||
version: 1.15.1
|
||||
wait: true
|
||||
values:
|
||||
- ./cilium-values.yaml
|
||||
- name: kubelet-csr-approver
|
||||
namespace: kube-system
|
||||
chart: postfinance/kubelet-csr-approver
|
||||
version: 1.0.7
|
||||
wait: true
|
||||
values:
|
||||
- ./kubelet-csr-approver-values.yaml
|
||||
+4
@@ -0,0 +1,4 @@
|
||||
---
|
||||
#% filter indent(width=0, first=True) %#
|
||||
#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %#
|
||||
#% endfilter %#
|
||||
+60
-62
@@ -6,80 +6,80 @@ talosVersion: v1.6.4
|
||||
kubernetesVersion: v1.29.1
|
||||
|
||||
clusterName: &cluster home-kubernetes
|
||||
endpoint: https://{{ cluster.endpoint_vip }}:6443
|
||||
endpoint: https://#{ bootstrap_controllers_vip }#:6443
|
||||
clusterPodNets:
|
||||
- "{{ cluster.pod_network.split(',')[0] }}"
|
||||
- "#{ bootstrap_pod_network.split(',')[0] }#"
|
||||
clusterSvcNets:
|
||||
- "{{ cluster.service_network.split(',')[0] }}"
|
||||
- "#{ bootstrap_service_network.split(',')[0] }#"
|
||||
additionalApiServerCertSans: &sans
|
||||
- "{{ cluster.endpoint_vip }}"
|
||||
- "#{ bootstrap_controllers_vip }#"
|
||||
- 127.0.0.1 # KubePrism
|
||||
{% for item in cluster.tls_sans %}
|
||||
- "{{ item }}"
|
||||
{% endfor %}
|
||||
#% for item in bootstrap_tls_sans %#
|
||||
- "#{ item }#"
|
||||
#% endfor %#
|
||||
additionalMachineCertSans: *sans
|
||||
cniConfig:
|
||||
name: none
|
||||
|
||||
nodes:
|
||||
{% for item in nodes.inventory %}
|
||||
- hostname: "{{ item.name }}"
|
||||
ipAddress: "{{ item.address }}"
|
||||
{% if item.talos_disk_device.startswith('/') %}
|
||||
installDisk: "{{ item.talos_disk_device }}"
|
||||
{% else %}
|
||||
#% for item in bootstrap_node_inventory %#
|
||||
- hostname: "#{ item.name }#"
|
||||
ipAddress: "#{ item.address }#"
|
||||
#% if item.talos_disk.startswith('/') %#
|
||||
installDisk: "#{ item.talos_disk }#"
|
||||
#% else %#
|
||||
installDiskSelector:
|
||||
serial: "{{ item.talos_disk_device }}"
|
||||
{% endif %}
|
||||
{% if distribution.talos.secureboot.enabled %}
|
||||
serial: "#{ item.talos_disk }#"
|
||||
#% endif %#
|
||||
#% if bootstrap_talos.secureboot.enabled %#
|
||||
machineSpec:
|
||||
secureboot: true
|
||||
talosImageURL: factory.talos.dev/installer-secureboot/{{ distribution.talos.schematicID }}
|
||||
{% else %}
|
||||
talosImageURL: factory.talos.dev/installer/{{ distribution.talos.schematicID }}
|
||||
{% endif %}
|
||||
controlPlane: {{ (item.controller) | string | lower }}
|
||||
talosImageURL: factory.talos.dev/installer-secureboot/#{ bootstrap_talos.schematic_id }#
|
||||
#% else %#
|
||||
talosImageURL: factory.talos.dev/installer/#{ bootstrap_talos.schematic_id }#
|
||||
#% endif %#
|
||||
controlPlane: #{ (item.controller) | string | lower }#
|
||||
networkInterfaces:
|
||||
- interface: eth0
|
||||
dhcp: false
|
||||
{% if distribution.talos.vlan %}
|
||||
#% if bootstrap_talos.vlan %#
|
||||
vlans:
|
||||
- vlanId: {{ distribution.talos.vlan }}
|
||||
- vlanId: #{ bootstrap_talos.vlan }#
|
||||
addresses:
|
||||
- "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
|
||||
- "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
|
||||
mtu: 1500
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
{% if nodes.default_gateway %}
|
||||
gateway: "{{ nodes.default_gateway }}"
|
||||
{% else %}
|
||||
gateway: "{{ nodes.host_network | nthhost(1) }}"
|
||||
{% endif %}
|
||||
{% if item.controller %}
|
||||
#% if bootstrap_node_default_gateway %#
|
||||
gateway: "#{ bootstrap_node_default_gateway }#"
|
||||
#% else %#
|
||||
gateway: "#{ bootstrap_node_network | nthhost(1) }#"
|
||||
#% endif %#
|
||||
#% if item.controller %#
|
||||
vip:
|
||||
ip: "{{ cluster.endpoint_vip }}"
|
||||
{% endif %}
|
||||
{% else %}
|
||||
ip: "#{ bootstrap_controllers_vip }#"
|
||||
#% endif %#
|
||||
#% else %#
|
||||
addresses:
|
||||
- "{{ item.address }}/{{ nodes.host_network.split('/') | last }}"
|
||||
- "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
|
||||
mtu: 1500
|
||||
routes:
|
||||
- network: 0.0.0.0/0
|
||||
{% if nodes.default_gateway %}
|
||||
gateway: "{{ nodes.default_gateway }}"
|
||||
{% else %}
|
||||
gateway: "{{ nodes.host_network | nthhost(1) }}"
|
||||
{% endif %}
|
||||
{% if item.controller %}
|
||||
#% if bootstrap_node_default_gateway %#
|
||||
gateway: "#{ bootstrap_node_default_gateway }#"
|
||||
#% else %#
|
||||
gateway: "#{ bootstrap_node_network | nthhost(1) }#"
|
||||
#% endif %#
|
||||
#% if item.controller %#
|
||||
vip:
|
||||
ip: "{{ cluster.endpoint_vip }}"
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{% if distribution.talos.user_patches %}
|
||||
ip: "#{ bootstrap_controllers_vip }#"
|
||||
#% endif %#
|
||||
#% endif %#
|
||||
#% if bootstrap_talos.user_patches %#
|
||||
patches:
|
||||
- "@./patches/node_{{ item.name }}.yaml"
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
- "@./patches/node_#{ item.name }#.yaml"
|
||||
#% endif %#
|
||||
#% endfor %#
|
||||
|
||||
patches:
|
||||
# Configure containerd
|
||||
@@ -123,16 +123,16 @@ patches:
|
||||
rotate-server-certificates: true
|
||||
nodeIP:
|
||||
validSubnets:
|
||||
- "{{ nodes.host_network }}"
|
||||
- "#{ bootstrap_node_network }#"
|
||||
|
||||
# Force nameserver
|
||||
- |-
|
||||
machine:
|
||||
network:
|
||||
nameservers:
|
||||
{% for item in nodes.dns_servers | default(['1.1.1.1', '1.0.0.1']) %}
|
||||
- {{ item }}
|
||||
{% endfor %}
|
||||
#% for item in bootstrap_dns_servers | default(['1.1.1.1', '1.0.0.1']) %#
|
||||
- #{ item }#
|
||||
#% endfor %#
|
||||
|
||||
# Configure NTP
|
||||
- |-
|
||||
@@ -170,8 +170,7 @@ patches:
|
||||
extraKernelArgs:
|
||||
- net.ifnames=0
|
||||
|
||||
{% if distribution.talos.secureboot.enabled and
|
||||
distribution.talos.secureboot.encrypt_disk_with_tpm %}
|
||||
#% if bootstrap_talos.secureboot.enabled and bootstrap_talos.secureboot.encrypt_disk_with_tpm %#
|
||||
# Encrypt system disk with TPM
|
||||
- |-
|
||||
machine:
|
||||
@@ -186,11 +185,11 @@ patches:
|
||||
keys:
|
||||
- slot: 0
|
||||
tpm: {}
|
||||
{% endif %}
|
||||
{% if distribution.talos.user_patches %}
|
||||
#% endif %#
|
||||
#% if bootstrap_talos.user_patches %#
|
||||
# User specified global patches
|
||||
- "@./patches/global.yaml"
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
|
||||
controlPlane:
|
||||
patches:
|
||||
@@ -214,7 +213,7 @@ controlPlane:
|
||||
extraArgs:
|
||||
listen-metrics-urls: http://0.0.0.0:2381
|
||||
advertisedSubnets:
|
||||
- "{{ nodes.host_network }}"
|
||||
- "#{ bootstrap_node_network }#"
|
||||
|
||||
# Disable default API server admission plugins.
|
||||
- |-
|
||||
@@ -232,15 +231,14 @@ controlPlane:
|
||||
allowedKubernetesNamespaces:
|
||||
- system-upgrade
|
||||
|
||||
{% if distribution.talos.user_patches %}
|
||||
#% if bootstrap_talos.user_patches %#
|
||||
# User specified controlPlane patches
|
||||
- "@./patches/controlPlane.yaml"
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
|
||||
{% if ( (distribution.talos.user_patches) and
|
||||
(nodes.inventory | selectattr('controller', 'equalto', False) | list | length) ) %}
|
||||
#% if ((bootstrap_talos.user_patches) and (bootstrap_node_inventory | selectattr('controller', 'equalto', False) | list | length)) %#
|
||||
worker:
|
||||
patches:
|
||||
# User specified worker patches
|
||||
- "@./patches/worker.yaml"
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -1 +0,0 @@
|
||||
main = lambda data: data.get("flux", {}).get("enabled", False) == True
|
||||
@@ -6,13 +6,13 @@ metadata:
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30m
|
||||
url: "{{ flux.github.address }}"
|
||||
{% if flux.github.private.enabled %}
|
||||
url: "#{ bootstrap_github_address }#"
|
||||
#% if bootstrap_github_private_key %#
|
||||
secretRef:
|
||||
name: github-deploy-key
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
ref:
|
||||
branch: "{{ flux.github.branch|default('main', true) }}"
|
||||
branch: "#{ bootstrap_github_branch|default('main', true) }#"
|
||||
ignore: |
|
||||
# exclude all
|
||||
/*
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
@@ -8,4 +8,4 @@ metadata:
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://kubernetes-sigs.github.io/external-dns
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -1,4 +1,4 @@
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
@@ -8,4 +8,4 @@ metadata:
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://kubernetes.github.io/ingress-nginx
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -1,4 +1,4 @@
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
@@ -8,4 +8,4 @@ metadata:
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://ori-edge.github.io/k8s_gateway
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -4,18 +4,18 @@ kind: Kustomization
|
||||
resources:
|
||||
- ./bjw-s.yaml
|
||||
- ./cilium.yaml
|
||||
{% if cloudflare.enabled %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
- ./external-dns.yaml
|
||||
- ./ingress-nginx.yaml
|
||||
- ./k8s-gateway.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
- ./jetstack.yaml
|
||||
- ./metrics-server.yaml
|
||||
- ./openebs.yaml
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
- ./postfinance.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
- ./stakater.yaml
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
- ./xenitab.yaml
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -1,4 +1,4 @@
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
@@ -8,4 +8,4 @@ metadata:
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://postfinance.github.io/kubelet-csr-approver
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -1,4 +1,4 @@
|
||||
{% if distribution.type in ["talos"] %}
|
||||
#% if bootstrap_distribution in ["talos"] %#
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
@@ -9,4 +9,4 @@ spec:
|
||||
type: oci
|
||||
interval: 5m
|
||||
url: oci://ghcr.io/xenitab/helm-charts
|
||||
{% endif %}
|
||||
#% endif %#
|
||||
@@ -6,8 +6,8 @@ metadata:
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
|
||||
{% if cloudflare.enabled %}
|
||||
SECRET_DOMAIN: "{{ cloudflare.domain }}"
|
||||
SECRET_ACME_EMAIL: "{{ cloudflare.acme.email }}"
|
||||
SECRET_CLOUDFLARE_TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
|
||||
{% endif %}
|
||||
#% if bootstrap_cloudflare.enabled %#
|
||||
SECRET_DOMAIN: "#{ bootstrap_cloudflare.domain }#"
|
||||
SECRET_ACME_EMAIL: "#{ bootstrap_cloudflare.acme.email }#"
|
||||
SECRET_CLOUDFLARE_TUNNEL_ID: "#{ bootstrap_cloudflare.tunnel.id }#"
|
||||
#% endif %#
|
||||
@@ -5,12 +5,12 @@ metadata:
|
||||
name: cluster-settings
|
||||
namespace: flux-system
|
||||
data:
|
||||
TIMEZONE: "{{ timezone }}"
|
||||
CLUSTER_CIDR: "{{ cluster.pod_network.split(',')[0] }}"
|
||||
NODE_CIDR: "{{ nodes.host_network }}"
|
||||
{% if feature_gates.dual_stack_ipv4_first %}
|
||||
CLUSTER_CIDR_V6: "{{ cluster.pod_network.split(',')[1] }}"
|
||||
{% endif %}
|
||||
{% if distribution.talos.bgp.enabled %}
|
||||
LOADBALANCER_CIDR: "{{ distribution.talos.bgp.loadbalancer_network }}"
|
||||
{% endif %}
|
||||
TIMEZONE: "#{ bootstrap_timezone }#"
|
||||
CLUSTER_CIDR: "#{ bootstrap_pod_network.split(',')[0] }#"
|
||||
NODE_CIDR: "#{ bootstrap_node_network }#"
|
||||
#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
|
||||
CLUSTER_CIDR_V6: "#{ bootstrap_pod_network.split(',')[1] }#"
|
||||
#% endif %#
|
||||
#% if bootstrap_bgp.enabled %#
|
||||
BGP_ADVERTISED_CIDR: "#{ bootstrap_bgp.advertised_network }#"
|
||||
#% endif %#
|
||||
@@ -1 +0,0 @@
|
||||
main = lambda data: data.get("distribution", {}).get("type", "k3s") in ["talos"]
|
||||
@@ -1 +0,0 @@
|
||||
charts/
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
helmCharts:
|
||||
- name: cilium
|
||||
repo: https://helm.cilium.io
|
||||
version: 1.15.1
|
||||
releaseName: cilium
|
||||
namespace: kube-system
|
||||
valuesFile: values.yaml
|
||||
commonAnnotations:
|
||||
meta.helm.sh/release-name: cilium
|
||||
meta.helm.sh/release-namespace: kube-system
|
||||
commonLabels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
{% filter indent(width=0, first=True) %}
|
||||
{% include 'partials/cilium-values-init.partial.yaml.j2' %}
|
||||
{% endfilter %}
|
||||
@@ -1 +0,0 @@
|
||||
charts/
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
helmCharts:
|
||||
- name: kubelet-csr-approver
|
||||
repo: https://postfinance.github.io/kubelet-csr-approver
|
||||
version: 1.0.6
|
||||
releaseName: kubelet-csr-approver
|
||||
namespace: kube-system
|
||||
valuesInline:
|
||||
{% filter indent(width=6, first=True) %}
|
||||
{% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
|
||||
{% endfilter %}
|
||||
commonAnnotations:
|
||||
meta.helm.sh/release-name: kubelet-csr-approver
|
||||
meta.helm.sh/release-namespace: kube-system
|
||||
commonLabels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
Reference in new issue
Block a user