feat!: template all ansible dir and rename template to bootstrap (#847)
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
c7f10b0c6d
commit
c9d988a66f
177 files changed
+238
-129
No files matched your search
@@ -0,0 +1,11 @@
|
||||
---
|
||||
creation_rules:
|
||||
- path_regex: kubernetes/.*\.sops\.ya?ml
|
||||
encrypted_regex: "^(data|stringData)$"
|
||||
key_groups:
|
||||
- age:
|
||||
- "{{ bootstrap_age_public_key }}"
|
||||
- path_regex: ansible/.*\.sops\.ya?ml
|
||||
key_groups:
|
||||
- age:
|
||||
- "{{ bootstrap_age_public_key }}"
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: csi-driver-nfs
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: csi-driver-nfs
|
||||
version: v4.4.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: csi-driver-nfs
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
externalSnapshotter:
|
||||
enabled: false
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
- ./storageclass.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
{% for item in csi_driver_nfs.storage_class %}
|
||||
---
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: {{ item.name }}
|
||||
provisioner: nfs.csi.k8s.io
|
||||
parameters:
|
||||
server: {{ item.server }}
|
||||
share: {{ item.share }}
|
||||
reclaimPolicy: Delete
|
||||
volumeBindingMode: Immediate
|
||||
mountOptions: ["hard", "noatime"]
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-csi-driver-nfs
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/csi-driver-nfs/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,100 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: grafana
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: grafana
|
||||
version: 6.57.4
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: local-path-provisioner
|
||||
namespace: kube-system
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
deploymentStrategy:
|
||||
type: Recreate
|
||||
admin:
|
||||
existingSecret: grafana-admin-secret
|
||||
env:
|
||||
GF_EXPLORE_ENABLED: true
|
||||
GF_SERVER_ROOT_URL: "https://grafana.${SECRET_DOMAIN}"
|
||||
grafana.ini:
|
||||
analytics:
|
||||
check_for_updates: false
|
||||
check_for_plugin_updates: false
|
||||
dashboardProviders:
|
||||
dashboardproviders.yaml:
|
||||
apiVersion: 1
|
||||
providers:
|
||||
- name: default
|
||||
orgId: 1
|
||||
folder: ""
|
||||
type: file
|
||||
disableDeletion: false
|
||||
editable: true
|
||||
options:
|
||||
path: /var/lib/grafana/dashboards/default
|
||||
datasources:
|
||||
datasources.yaml:
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
- name: Prometheus
|
||||
type: prometheus
|
||||
access: proxy
|
||||
url: http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090
|
||||
isDefault: true
|
||||
dashboards:
|
||||
default:
|
||||
cert-manager:
|
||||
url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
|
||||
datasource: Prometheus
|
||||
flux-cluster:
|
||||
url: https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/monitoring/monitoring-config/dashboards/cluster.json
|
||||
datasource: Prometheus
|
||||
flux-control-plane:
|
||||
url: https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/monitoring/monitoring-config/dashboards/control-plane.json
|
||||
datasource: Prometheus
|
||||
sidecar:
|
||||
dashboards:
|
||||
enabled: true
|
||||
searchNamespace: ALL
|
||||
datasources:
|
||||
enabled: true
|
||||
searchNamespace: ALL
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: simple-icons:grafana
|
||||
hosts:
|
||||
- &host "grafana.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClassName: local-path
|
||||
testFramework:
|
||||
enabled: false
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: grafana-admin-secret
|
||||
namespace: monitoring
|
||||
stringData:
|
||||
admin-user: admin
|
||||
admin-password: "{{ grafana.password }}"
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-grafana
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/monitoring/grafana/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: hajimari
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: hajimari
|
||||
version: 2.0.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: hajimari
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
hajimari:
|
||||
title: Apps
|
||||
darkTheme: espresso
|
||||
alwaysTargetBlank: true
|
||||
showGreeting: false
|
||||
showAppGroups: false
|
||||
showAppStatus: false
|
||||
showBookmarkGroups: false
|
||||
showGlobalBookmarks: false
|
||||
showAppUrls: false
|
||||
defaultEnable: true
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- default
|
||||
- monitoring
|
||||
ingress:
|
||||
main:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
hajimari.io/enable: "false"
|
||||
hosts:
|
||||
- host: &host "hajimari.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
podAnnotations:
|
||||
configmap.reloader.stakater.com/reload: hajimari-settings
|
||||
persistence:
|
||||
data:
|
||||
enabled: true
|
||||
type: emptyDir
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128M
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-hajimari
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/default/hajimari/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,142 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kube-prometheus-stack
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 30m
|
||||
timeout: 15m
|
||||
chart:
|
||||
spec:
|
||||
chart: kube-prometheus-stack
|
||||
version: 47.1.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: local-path-provisioner
|
||||
namespace: kube-system
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
cleanPrometheusOperatorObjectNames: true
|
||||
alertmanager:
|
||||
enabled: false
|
||||
grafana:
|
||||
enabled: false
|
||||
forceDeployDashboards: true
|
||||
sidecar:
|
||||
dashboards:
|
||||
multicluster:
|
||||
etcd:
|
||||
enabled: true
|
||||
kube-state-metrics:
|
||||
metricLabelsAllowlist:
|
||||
- "pods=[*]"
|
||||
- "deployments=[*]"
|
||||
- "persistentvolumeclaims=[*]"
|
||||
prometheus:
|
||||
monitor:
|
||||
enabled: true
|
||||
relabelings:
|
||||
- action: replace
|
||||
regex: (.*)
|
||||
replacement: $1
|
||||
sourceLabels: ["__meta_kubernetes_pod_node_name"]
|
||||
targetLabel: kubernetes_node
|
||||
kubelet:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)"
|
||||
action: keep
|
||||
- sourceLabels: ["node"]
|
||||
targetLabel: instance
|
||||
action: replace
|
||||
kubeApiServer:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)"
|
||||
action: keep
|
||||
# Remove high cardinality metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: (apiserver|etcd|rest_client)_request(|_sli|_slo)_duration_seconds_bucket
|
||||
action: drop
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
|
||||
action: drop
|
||||
kubeControllerManager:
|
||||
enabled: true
|
||||
endpoints: &cp
|
||||
{% for item in bootstrap_nodes.master %}
|
||||
- {{ item.address }}
|
||||
{% endfor %}
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)"
|
||||
action: keep
|
||||
kubeEtcd:
|
||||
enabled: true
|
||||
endpoints: *cp
|
||||
kubeProxy:
|
||||
enabled: false # Disabled because eBPF
|
||||
kubeScheduler:
|
||||
enabled: true
|
||||
endpoints: *cp
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)"
|
||||
action: keep
|
||||
prometheus:
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
hajimari.io/appName: Prometheus
|
||||
hajimari.io/icon: simple-icons:prometheus
|
||||
pathType: Prefix
|
||||
hosts:
|
||||
- &host "prometheus.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
prometheusSpec:
|
||||
ruleSelectorNilUsesHelmValues: false
|
||||
serviceMonitorSelectorNilUsesHelmValues: false
|
||||
podMonitorSelectorNilUsesHelmValues: false
|
||||
probeSelectorNilUsesHelmValues: false
|
||||
enableAdminAPI: true
|
||||
walCompression: true
|
||||
retentionSize: 8GB
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: local-path
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-kube-prometheus-stack
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/monitoring/kube-prometheus-stack/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,61 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: kubernetes-dashboard
|
||||
version: 7.0.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: kubernetes-dashboard
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
api:
|
||||
containers:
|
||||
args:
|
||||
- --enable-insecure-login=true
|
||||
- --enable-skip-login=true
|
||||
- --disable-settings-authorizer=true
|
||||
app:
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: mdi:kubernetes
|
||||
hosts:
|
||||
- &host "kubernetes.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
secretName: kubernetes-dashboard-tls
|
||||
metricsScraper:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
cert-manager:
|
||||
enabled: false
|
||||
nginx:
|
||||
enabled: false
|
||||
metrics-server:
|
||||
enabled: false
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- ./rbac.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,41 @@
|
||||
# For dashboard sign in token:
|
||||
# kubectl -n monitoring get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
meta.helm.sh/release-name: kubernetes-dashboard
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
secrets:
|
||||
- name: kubernetes-dashboard
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: kubernetes.io/service-account-token
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
meta.helm.sh/release-name: kubernetes-dashboard
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
kubernetes.io/service-account.name: kubernetes-dashboard
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: system:kubernetes-dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-kubernetes-dashboard
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-cert-manager
|
||||
- name: cluster-apps-ingress-nginx
|
||||
- name: cluster-apps-metrics-server
|
||||
path: ./kubernetes/apps/monitoring/kubernetes-dashboard/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: weave-gitops
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: weave-gitops
|
||||
version: 4.0.24
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: weave-gitops
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
adminUser:
|
||||
create: true
|
||||
createSecret: false
|
||||
username: admin
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: sawtooth-wave
|
||||
hosts:
|
||||
- host: &host "gitops.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
networkPolicy:
|
||||
create: false
|
||||
metrics:
|
||||
enabled: true
|
||||
rbac:
|
||||
create: true
|
||||
impersonationResourceNames: ["admin"]
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: cluster-user-auth
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: flux-system
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cluster-user-auth
|
||||
namespace: flux-system
|
||||
type: Opaque
|
||||
stringData:
|
||||
username: admin
|
||||
password: "{{ weave_gitops.password | password_hash('bcrypt', rounds=10) }}"
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-weave-gitops
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/flux-system/weave-gitops/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,35 @@
|
||||
[defaults]
|
||||
# General settings
|
||||
nocows = True
|
||||
executable = /bin/bash
|
||||
stdout_callback = yaml
|
||||
force_valid_group_names = ignore
|
||||
# File/Directory settings
|
||||
log_path = ~/.ansible/ansible.log
|
||||
inventory = ./inventory
|
||||
roles_path = ~/.ansible/roles:./roles
|
||||
collections_path = ~/.ansible/collections
|
||||
remote_tmp = ~/.ansible/tmp
|
||||
local_tmp = ~/.ansible/tmp
|
||||
# Fact Caching settings
|
||||
fact_caching = jsonfile
|
||||
fact_caching_connection = ~/.ansible/facts_cache
|
||||
# SSH settings
|
||||
remote_port = 22
|
||||
timeout = 60
|
||||
host_key_checking = False
|
||||
# Plugin settings
|
||||
vars_plugins_enabled = host_group_vars,community.sops.sops
|
||||
|
||||
[inventory]
|
||||
unparsed_is_failed = True
|
||||
|
||||
[privilege_escalation]
|
||||
become = True
|
||||
|
||||
[ssh_connection]
|
||||
scp_if_ssh = smart
|
||||
retries = 3
|
||||
ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o Compression=yes -o ServerAliveInterval=15s
|
||||
pipelining = True
|
||||
control_path = %(directory)s/%%h-%%r
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
#
|
||||
# Below vars are for the xanmanning.k3s role
|
||||
# ...see https://github.com/PyratLabs/ansible-role-k3s
|
||||
#
|
||||
|
||||
# renovate: datasource=github-releases depName=k3s-io/k3s
|
||||
k3s_release_version: "v1.27.3+k3s1"
|
||||
k3s_install_hard_links: true
|
||||
k3s_become: true
|
||||
k3s_etcd_datastore: true
|
||||
k3s_use_unsupported_config: true
|
||||
k3s_registration_address: "{% raw %}{{ kube_vip_addr }}{% endraw %}"
|
||||
k3s_server_manifests_urls:
|
||||
# Kube-vip RBAC
|
||||
- url: https://raw.githubusercontent.com/kube-vip/kube-vip/main/docs/manifests/rbac.yaml
|
||||
filename: kube-vip-rbac.yaml
|
||||
# Essential Prometheus Operator CRDs (the rest are installed with the kube-prometheus-stack helm release)
|
||||
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.66.0/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml
|
||||
filename: custom-prometheus-podmonitors.yaml
|
||||
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.66.0/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
|
||||
filename: custom-prometheus-prometheusrules.yaml
|
||||
- url: https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.66.0/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
|
||||
filename: custom-prometheus-servicemonitors.yaml
|
||||
# /var/lib/rancher/k3s/server/manifests
|
||||
k3s_server_manifests_templates:
|
||||
- custom-cilium-helmchart.yaml.j2
|
||||
- custom-cilium-l2.yaml.j2
|
||||
- custom-coredns-helmchart.yaml.j2
|
||||
# /var/lib/rancher/k3s/agent/pod-manifests
|
||||
k3s_server_pod_manifests_templates:
|
||||
- kube-vip-static-pod.yaml.j2
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
timezone: "{{ bootstrap_timezone }}"
|
||||
github_username: "{{ bootstrap_github_username }}"
|
||||
coredns_addr: "{{ bootstrap_coredns_addr }}"
|
||||
kube_vip_addr: "{{ bootstrap_kube_vip_addr }}"
|
||||
cluster_cidr: "{{ bootstrap_cluster_cidr }}"
|
||||
service_cidr: "{{ bootstrap_service_cidr }}"
|
||||
node_cidr: "{{ bootstrap_node_cidr }}"
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
# https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
|
||||
# https://github.com/PyratLabs/ansible-role-k3s
|
||||
|
||||
k3s_control_node: true
|
||||
k3s_server:
|
||||
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
|
||||
tls-san:
|
||||
- "{% raw %}{{ kube_vip_addr }}{% endraw %}"
|
||||
docker: false
|
||||
flannel-backend: "none" # This needs to be in quotes
|
||||
disable:
|
||||
- coredns # Disable coredns - replaced with Coredns Helm Chart
|
||||
- flannel # Disable flannel - replaced with Cilium Helm Chart
|
||||
- local-storage # Disable local-path-provisioner - installed with Flux
|
||||
- metrics-server # Disable metrics-server - installed with Flux
|
||||
- servicelb # Disable servicelb - replaced with Cilium Helm Chart
|
||||
- traefik # Disable traefik - replaced with ingress-nginx and installed with Flux
|
||||
disable-network-policy: true
|
||||
disable-cloud-controller: true
|
||||
disable-kube-proxy: true # Cilium uses eBPF
|
||||
write-kubeconfig-mode: "644"
|
||||
cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}"
|
||||
service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}"
|
||||
etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack
|
||||
kube-controller-manager-arg:
|
||||
- "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack
|
||||
kube-scheduler-arg:
|
||||
- "bind-address=0.0.0.0" # Required to monitor kube-scheduler with kube-prometheus-stack
|
||||
kube-apiserver-arg:
|
||||
- "anonymous-auth=true" # Required for HAProxy health-checks
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
# https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
|
||||
# https://github.com/PyratLabs/ansible-role-k3s
|
||||
|
||||
k3s_control_node: false
|
||||
k3s_agent:
|
||||
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
|
||||
Whitespace-only changes.
@@ -0,0 +1,20 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
kubernetes:
|
||||
children:
|
||||
master:
|
||||
hosts:
|
||||
{% for item in bootstrap_nodes.master %}
|
||||
{{ item.name }}:
|
||||
ansible_user: {{ item.username }}
|
||||
ansible_host: {{ item.address }}
|
||||
{% endfor %}
|
||||
{% if bootstrap_nodes.worker | default([]) | length > 0 %}
|
||||
worker:
|
||||
hosts:
|
||||
{% for item in bootstrap_nodes.worker %}
|
||||
{{ item.name }}:
|
||||
ansible_user: {{ item.username }}
|
||||
ansible_host: {{ item.address }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
- name: Cluster Installation
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Check if cluster is installed
|
||||
check_mode: false
|
||||
ansible.builtin.stat:
|
||||
path: /etc/rancher/k3s/config.yaml
|
||||
register: k3s_installed
|
||||
|
||||
- name: Ignore manifests templates and urls if the cluster is already installed
|
||||
when: k3s_installed.stat.exists
|
||||
ansible.builtin.set_fact:
|
||||
k3s_server_manifests_templates: []
|
||||
k3s_server_manifests_urls: []
|
||||
|
||||
- name: Install Kubernetes
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: installed
|
||||
|
||||
- name: Kubeconfig
|
||||
ansible.builtin.include_tasks: tasks/kubeconfig.yaml
|
||||
|
||||
- name: Wait for custom manifests to rollout
|
||||
when:
|
||||
- k3s_primary_control_node
|
||||
- (k3s_server_manifests_templates | length > 0
|
||||
or k3s_server_manifests_urls | length > 0)
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
kind: "{% raw %}{{ item.kind }}{% endraw %}"
|
||||
name: "{% raw %}{{ item.name }}{% endraw %}"
|
||||
namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
|
||||
wait: true
|
||||
wait_sleep: 10
|
||||
wait_timeout: 360
|
||||
loop:
|
||||
- { name: cilium, kind: HelmChart, namespace: kube-system }
|
||||
- { name: coredns, kind: HelmChart, namespace: kube-system }
|
||||
- { name: policy, kind: CiliumL2AnnouncementPolicy }
|
||||
- { name: pool, kind: CiliumLoadBalancerIPPool }
|
||||
- { name: podmonitors.monitoring.coreos.com, kind: CustomResourceDefinition }
|
||||
- { name: prometheusrules.monitoring.coreos.com, kind: CustomResourceDefinition }
|
||||
- { name: servicemonitors.monitoring.coreos.com, kind: CustomResourceDefinition }
|
||||
|
||||
- name: Coredns
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.include_tasks: tasks/coredns.yaml
|
||||
|
||||
- name: Cilium
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.include_tasks: tasks/cilium.yaml
|
||||
|
||||
- name: Cruft
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.include_tasks: tasks/cruft.yaml
|
||||
|
||||
- name: Stale Containers
|
||||
ansible.builtin.include_tasks: tasks/stale_containers.yaml
|
||||
vars:
|
||||
stale_containers_state: enabled
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
- name: Cluster kube-vip
|
||||
hosts: master
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Ensure Kubernetes is running
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: started
|
||||
|
||||
- name: Upgrade kube-vip
|
||||
ansible.builtin.template:
|
||||
src: templates/kube-vip-static-pod.yaml.j2
|
||||
dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
|
||||
mode: preserve
|
||||
@@ -0,0 +1,73 @@
|
||||
---
|
||||
- name: Cluster Nuke
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
vars_prompt:
|
||||
- name: nuke
|
||||
prompt: |-
|
||||
Are you sure you want to nuke this cluster?
|
||||
Type 'YES I WANT TO DESTROY THIS CLUSTER' to proceed
|
||||
default: "n"
|
||||
private: false
|
||||
pre_tasks:
|
||||
- name: Check for confirmation
|
||||
ansible.builtin.fail:
|
||||
msg: Aborted nuking the cluster
|
||||
when: nuke != 'YES I WANT TO DESTROY THIS CLUSTER'
|
||||
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Stop Kubernetes # noqa: ignore-errors
|
||||
ignore_errors: true
|
||||
block:
|
||||
- name: Stop Kubernetes
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: stopped
|
||||
|
||||
# https://github.com/k3s-io/docs/blob/main/docs/installation/network-options.md
|
||||
- name: Networking
|
||||
block:
|
||||
- name: Networking | Delete Cilium links
|
||||
ansible.builtin.command:
|
||||
cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
|
||||
removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
|
||||
loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
|
||||
- name: Networking | Flush iptables
|
||||
ansible.builtin.iptables:
|
||||
table: "{% raw %}{{ item }}{% endraw %}"
|
||||
flush: true
|
||||
loop: ["filter", "nat", "mangle", "raw"]
|
||||
- name: Networking | Flush ip6tables
|
||||
ansible.builtin.iptables:
|
||||
table: "{% raw %}{{ item }}{% endraw %}"
|
||||
flush: true
|
||||
ip_version: ipv6
|
||||
loop: ["filter", "nat", "mangle", "raw"]
|
||||
- name: Networking | Delete CNI directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/cni/net.d
|
||||
state: absent
|
||||
|
||||
- name: Uninstall Kubernetes
|
||||
ansible.builtin.include_role:
|
||||
name: xanmanning.k3s
|
||||
public: true
|
||||
vars:
|
||||
k3s_state: uninstalled
|
||||
|
||||
- name: Stale Containers
|
||||
ansible.builtin.include_tasks: tasks/stale_containers.yaml
|
||||
vars:
|
||||
stale_containers_state: disabled
|
||||
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
reboot_timeout: 3600
|
||||
@@ -0,0 +1,120 @@
|
||||
---
|
||||
- name: Prepare System
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Locale
|
||||
block:
|
||||
- name: Locale | Set timezone
|
||||
community.general.timezone:
|
||||
name: "{% raw %}{{ timezone | default('Etc/UTC') }}{% endraw %}"
|
||||
|
||||
- name: Packages
|
||||
block:
|
||||
- name: Packages | Install
|
||||
ansible.builtin.apt:
|
||||
name: apt-transport-https,ca-certificates,conntrack,curl,dirmngr,gdisk,gnupg,htop,
|
||||
iptables,iputils-ping,ipvsadm,libseccomp2,lm-sensors,neofetch,net-tools,nfs-common,
|
||||
nvme-cli,open-iscsi,parted,psmisc,python3,python3-apt,python3-kubernetes,python3-yaml,
|
||||
smartmontools,socat,software-properties-common,unzip,util-linux
|
||||
install_recommends: false
|
||||
|
||||
- name: User Configuration
|
||||
block:
|
||||
- name: User Configuration | SSH keys
|
||||
ansible.posix.authorized_key:
|
||||
user: "{% raw %}{{ ansible_user }}{% endraw %}"
|
||||
key: "https://github.com/{% raw %}{{ github_username }}{% endraw %}.keys"
|
||||
- name: User Configuration | Silence login
|
||||
ansible.builtin.file:
|
||||
dest: /root/.hushlogin
|
||||
state: touch
|
||||
owner: "{% raw %}{{ ansible_user }}{% endraw %}"
|
||||
mode: "0644"
|
||||
modification_time: preserve
|
||||
access_time: preserve
|
||||
|
||||
- name: Network Configuration
|
||||
notify: Reboot
|
||||
block:
|
||||
- name: Network Configuration | Set hostname
|
||||
ansible.builtin.hostname:
|
||||
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
- name: Network Configuration | Update hosts
|
||||
ansible.builtin.copy:
|
||||
content: |
|
||||
127.0.0.1 localhost
|
||||
127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
|
||||
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 localhost ip6-localhost ip6-loopback
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
dest: /etc/hosts
|
||||
mode: preserve
|
||||
# https://github.com/cilium/cilium/issues/18706
|
||||
- name: Network Configuration | Cilium (1)
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/systemd/networkd.conf
|
||||
regexp: ManageForeignRoutingPolicyRules
|
||||
line: ManageForeignRoutingPolicyRules=no
|
||||
- name: Network Configuration | Cilium (2)
|
||||
ansible.builtin.lineinfile:
|
||||
dest: /etc/systemd/networkd.conf
|
||||
regexp: ManageForeignRoutes
|
||||
line: ManageForeignRoutes=no
|
||||
|
||||
- name: System Configuration
|
||||
notify: Reboot
|
||||
block:
|
||||
- name: System Configuration | Neofetch
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/profile.d/neofetch.sh
|
||||
mode: "0755"
|
||||
content: neofetch --config none
|
||||
- name: System Configuration | Disable apparmor
|
||||
ansible.builtin.systemd:
|
||||
name: apparmor
|
||||
state: stopped
|
||||
masked: true
|
||||
- name: System Configuration | Disable swap
|
||||
ansible.posix.mount:
|
||||
name: "{% raw %}{{ item }}{% endraw %}"
|
||||
fstype: swap
|
||||
state: absent
|
||||
loop: ["none", "swap"]
|
||||
- name: System Configuration | Kernel modules (1)
|
||||
community.general.modprobe:
|
||||
name: "{% raw %}{{ item }}{% endraw %}"
|
||||
state: present
|
||||
loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
|
||||
- name: System Configuration | Kernel modules (2)
|
||||
ansible.builtin.copy:
|
||||
dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
|
||||
mode: "0644"
|
||||
content: "{% raw %}{{ item }}{% endraw %}"
|
||||
loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
|
||||
- name: System Configuration | Sysctl
|
||||
ansible.posix.sysctl:
|
||||
name: "{% raw %}{{ item.key }}{% endraw %}"
|
||||
value: "{% raw %}{{ item.value }}{% endraw %}"
|
||||
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
|
||||
reload: true
|
||||
with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
|
||||
vars:
|
||||
sysctl_config:
|
||||
fs.inotify.max_queued_events: 65536
|
||||
fs.inotify.max_user_watches: 524288
|
||||
fs.inotify.max_user_instances: 8192
|
||||
|
||||
handlers:
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
reboot_timeout: 3600
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
- name: Reboot
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting nodes
|
||||
reboot_timeout: 3600
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
# https://github.com/kevincoakley/ansible-role-k8s-rolling-update
|
||||
- name: Cluster rollout update
|
||||
hosts: all
|
||||
become: true
|
||||
gather_facts: true
|
||||
any_errors_fatal: true
|
||||
serial: 1
|
||||
pre_tasks:
|
||||
- name: Pausing for 5 seconds...
|
||||
ansible.builtin.pause:
|
||||
seconds: 5
|
||||
tasks:
|
||||
- name: Get the node's details
|
||||
ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
|
||||
register: kubectl_get_node
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Update node
|
||||
when:
|
||||
# When status.conditions[x].type == Ready then check stats.conditions[x].status for True|False
|
||||
- kubectl_get_node['stdout'] | from_json | json_query("status.conditions[?type == 'Ready'].status")
|
||||
# If spec.unschedulable is defined then the node is cordoned
|
||||
- not (kubectl_get_node['stdout'] | from_json).spec.unschedulable is defined
|
||||
block:
|
||||
- name: Cordon node
|
||||
ansible.builtin.command: "kubectl cordon {% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
changed_when: false
|
||||
|
||||
- name: Wait for node to cordon
|
||||
ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
|
||||
register: wait_for_cordon
|
||||
retries: 10
|
||||
delay: 10
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
changed_when: false
|
||||
until: (wait_for_cordon['stdout'] | from_json).spec.unschedulable
|
||||
|
||||
- name: Cordon & drain node
|
||||
ansible.builtin.command: "kubectl drain --ignore-daemonsets --delete-emptydir-data --force {% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
changed_when: false
|
||||
|
||||
- name: Update all packages
|
||||
ansible.builtin.apt:
|
||||
upgrade: dist
|
||||
update_cache: true
|
||||
|
||||
- name: Reboot
|
||||
ansible.builtin.reboot:
|
||||
msg: Rebooting node
|
||||
post_reboot_delay: 60
|
||||
reboot_timeout: 3600
|
||||
|
||||
- name: Uncordon node
|
||||
ansible.builtin.command: "kubectl uncordon {% raw %}{{ inventory_hostname }}{% endraw %}"
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
changed_when: false
|
||||
|
||||
- name: Wait for node to uncordon
|
||||
ansible.builtin.command: "kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
|
||||
register: wait_for_uncordon
|
||||
retries: 10
|
||||
delay: 10
|
||||
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
|
||||
changed_when: false
|
||||
until: not (kubectl_get_node['stdout'] | from_json).spec.unschedulable is defined
|
||||
@@ -0,0 +1,6 @@
|
||||
[Unit]
|
||||
Description=Stale containers
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/local/bin/k3s crictl rmi --prune
|
||||
@@ -0,0 +1,11 @@
|
||||
[Unit]
|
||||
Description=Stale containers
|
||||
|
||||
[Timer]
|
||||
OnCalendar=weekly
|
||||
AccuracySec=1h
|
||||
Persistent=true
|
||||
RandomizedDelaySec=6000
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
- name: Cilium
|
||||
block:
|
||||
- name: Cilium | Check if Cilium HelmChart exists
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
register: cilium_helmchart
|
||||
|
||||
- name: Cilium | Wait for Cilium to rollout
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: helm-install-cilium
|
||||
kind: Job
|
||||
namespace: kube-system
|
||||
wait: true
|
||||
wait_condition:
|
||||
type: Complete
|
||||
status: true
|
||||
wait_timeout: 360
|
||||
|
||||
- name: Cilium | Patch the Cilium HelmChart to unmanage it
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_json_patch:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
patch:
|
||||
- op: add
|
||||
path: /metadata/annotations/helmcharts.helm.cattle.io~1unmanaged
|
||||
value: "true"
|
||||
|
||||
- name: Cilium | Delete the Cilium HelmChart CR
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
|
||||
- name: Cilium | Force delete the Cilium HelmChart
|
||||
when: cilium_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: cilium
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: patched
|
||||
definition:
|
||||
metadata:
|
||||
finalizers: []
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
- name: Coredns
|
||||
block:
|
||||
- name: Coredns | Check if Coredns HelmChart exists
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
register: coredns_helmchart
|
||||
|
||||
- name: Coredns | Wait for Coredns to rollout
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: helm-install-coredns
|
||||
kind: Job
|
||||
namespace: kube-system
|
||||
wait: true
|
||||
wait_condition:
|
||||
type: Complete
|
||||
status: true
|
||||
wait_timeout: 360
|
||||
|
||||
- name: Coredns | Patch the Coredns HelmChart to unmanage it
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s_json_patch:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
patch:
|
||||
- op: add
|
||||
path: /metadata/annotations/helmcharts.helm.cattle.io~1unmanaged
|
||||
value: "true"
|
||||
|
||||
- name: Coredns | Delete the Coredns HelmChart CR
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
|
||||
- name: Coredns | Force delete the Coredns HelmChart
|
||||
when: coredns_helmchart.resources | count > 0
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: coredns
|
||||
kind: HelmChart
|
||||
namespace: kube-system
|
||||
state: patched
|
||||
definition:
|
||||
metadata:
|
||||
finalizers: []
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
# https://github.com/k3s-io/k3s/issues/1971
|
||||
- name: Cruft
|
||||
block:
|
||||
- name: Cruft | Get list of custom mantifests
|
||||
ansible.builtin.find:
|
||||
paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
|
||||
file_type: file
|
||||
use_regex: true
|
||||
patterns: ["^custom-.*"]
|
||||
register: custom_manifest
|
||||
|
||||
- name: Cruft | Delete custom mantifests
|
||||
ansible.builtin.file:
|
||||
path: "{% raw %}{{ item.path }}{% endraw %}"
|
||||
state: absent
|
||||
loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
|
||||
|
||||
- name: Cruft | Get list of custom addons
|
||||
kubernetes.core.k8s_info:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
kind: Addon
|
||||
register: addons_list
|
||||
|
||||
- name: Cruft | Delete addons
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: /etc/rancher/k3s/k3s.yaml
|
||||
name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
|
||||
kind: Addon
|
||||
namespace: kube-system
|
||||
state: absent
|
||||
loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
|
||||
@@ -0,0 +1,26 @@
|
||||
---
|
||||
- name: Get absolute path to this Git repository # noqa: command-instead-of-module
|
||||
ansible.builtin.command: git rev-parse --show-toplevel
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
register: repository_path
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
failed_when: repository_path.rc != 0
|
||||
|
||||
- name: Copy kubeconfig to the project directory
|
||||
when: k3s_primary_control_node
|
||||
ansible.builtin.fetch:
|
||||
src: /etc/rancher/k3s/k3s.yaml
|
||||
dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
|
||||
flat: true
|
||||
|
||||
- name: Update kubeconfig with the correct load balancer address
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
run_once: true
|
||||
ansible.builtin.replace:
|
||||
path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
|
||||
regexp: https://127.0.0.1:6443
|
||||
replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
# https://github.com/k3s-io/k3s/issues/1900
|
||||
- name: Enabled Stale containers
|
||||
when: stale_containers_state == "enabled"
|
||||
block:
|
||||
- name: Stale containers | Create systemd unit
|
||||
ansible.builtin.copy:
|
||||
src: files/stale-containers.service
|
||||
dest: /etc/systemd/system/stale-containers.service
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Stale containers | Create systemd timer
|
||||
ansible.builtin.copy:
|
||||
src: files/stale-containers.timer
|
||||
dest: /etc/systemd/system/stale-containers.timer
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Stale containers | Start the systemd timer
|
||||
ansible.builtin.systemd:
|
||||
name: stale-containers.timer
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
masked: false
|
||||
state: started
|
||||
|
||||
- name: Disable Stale containers
|
||||
when: stale_containers_state == "disabled"
|
||||
block:
|
||||
- name: Stale containers | Mask the systemd timer
|
||||
ansible.builtin.systemd:
|
||||
name: stale-containers.timer
|
||||
masked: true
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
# https://docs.k3s.io/helm
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: kube-system
|
||||
spec:
|
||||
repo: https://helm.cilium.io/
|
||||
chart: cilium
|
||||
# renovate: datasource=helm depName=cilium registryUrl=https://helm.cilium.io
|
||||
version: "1.14.0-rc.0"
|
||||
targetNamespace: kube-system
|
||||
bootstrap: true
|
||||
valuesContent: |-
|
||||
autoDirectNodeRoutes: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
bgp:
|
||||
enabled: false
|
||||
cluster:
|
||||
name: home-cluster
|
||||
id: 1
|
||||
containerRuntime:
|
||||
integration: containerd
|
||||
socketPath: /var/run/k3s/containerd/containerd.sock
|
||||
endpointRoutes:
|
||||
enabled: true
|
||||
hubble:
|
||||
enabled: false
|
||||
ipam:
|
||||
mode: kubernetes
|
||||
ipv4NativeRoutingCIDR: "{% raw %}{{ k3s_server['cluster-cidr'] }}{% endraw %}"
|
||||
k8sServiceHost: "{% raw %}{{ kube_vip_addr }}{% endraw %}"
|
||||
k8sServicePort: 6443
|
||||
kubeProxyReplacement: strict
|
||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||
# https://github.com/cilium/cilium/issues/26586
|
||||
l2announcements:
|
||||
enabled: true
|
||||
leaseDuration: 120s
|
||||
leaseRenewDeadline: 60s
|
||||
leaseRetryPeriod: 1s
|
||||
loadBalancer:
|
||||
algorithm: maglev
|
||||
mode: dsr
|
||||
localRedirectPolicy: true
|
||||
operator:
|
||||
replicas: 1
|
||||
rollOutPods: true
|
||||
rollOutCiliumPods: true
|
||||
securityContext:
|
||||
privileged: true
|
||||
tunnel: disabled
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
# https://docs.cilium.io/en/latest/network/l2-announcements
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
spec:
|
||||
loadBalancerIPs: true
|
||||
# NOTE: This might need to be set if you have more than one active NIC on your nodes
|
||||
# interfaces:
|
||||
# - ^eno[0-9]+
|
||||
nodeSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: pool
|
||||
spec:
|
||||
cidrs:
|
||||
- cidr: "{% raw %}{{ node_cidr }}{% endraw %}"
|
||||
@@ -0,0 +1,78 @@
|
||||
---
|
||||
# https://docs.k3s.io/helm
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
repo: https://coredns.github.io/helm
|
||||
chart: coredns
|
||||
# renovate: datasource=helm depName=coredns registryUrl=https://coredns.github.io/helm
|
||||
version: "1.24.1"
|
||||
targetNamespace: kube-system
|
||||
bootstrap: true
|
||||
valuesContent: |-
|
||||
fullnameOverride: coredns
|
||||
replicaCount: 1
|
||||
k8sAppLabelOverride: kube-dns
|
||||
service:
|
||||
name: kube-dns
|
||||
# Choose the 10th IP address from the start of the service-cidr
|
||||
clusterIP: "{% raw %}{{ k3s_server['service-cidr'] | ansible.utils.nthhost(10) }}{% endraw %}"
|
||||
serviceAccount:
|
||||
create: true
|
||||
deployment:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
servers:
|
||||
- zones:
|
||||
- zone: .
|
||||
scheme: dns://
|
||||
use_tcp: true
|
||||
port: 53
|
||||
plugins:
|
||||
- name: log
|
||||
- name: errors
|
||||
- name: health
|
||||
configBlock: |-
|
||||
lameduck 5s
|
||||
- name: ready
|
||||
- name: kubernetes
|
||||
parameters: cluster.local in-addr.arpa ip6.arpa
|
||||
configBlock: |-
|
||||
pods insecure
|
||||
fallthrough in-addr.arpa ip6.arpa
|
||||
ttl 30
|
||||
- name: prometheus
|
||||
parameters: 0.0.0.0:9153
|
||||
- name: forward
|
||||
parameters: . /etc/resolv.conf
|
||||
- name: cache
|
||||
parameters: 30
|
||||
- name: loop
|
||||
- name: reload
|
||||
- name: loadbalance
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: coredns
|
||||
@@ -0,0 +1,57 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kube-vip
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app.kubernetes.io/instance: kube-vip
|
||||
app.kubernetes.io/name: kube-vip
|
||||
spec:
|
||||
containers:
|
||||
- name: kube-vip
|
||||
image: ghcr.io/kube-vip/kube-vip:v0.6.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args: ["manager"]
|
||||
env:
|
||||
- name: address
|
||||
value: "{% raw %}{{ kube_vip_addr }}{% endraw %}"
|
||||
- name: vip_arp
|
||||
value: "true"
|
||||
- name: port
|
||||
value: "6443"
|
||||
- name: vip_cidr
|
||||
value: "32"
|
||||
- name: cp_enable
|
||||
value: "true"
|
||||
- name: cp_namespace
|
||||
value: kube-system
|
||||
- name: vip_ddns
|
||||
value: "false"
|
||||
- name: svc_enable
|
||||
value: "false"
|
||||
- name: vip_leaderelection
|
||||
value: "true"
|
||||
- name: vip_leaseduration
|
||||
value: "15"
|
||||
- name: vip_renewdeadline
|
||||
value: "10"
|
||||
- name: vip_retryperiod
|
||||
value: "2"
|
||||
- name: prometheus_server
|
||||
value: :2112
|
||||
securityContext:
|
||||
capabilities:
|
||||
add: ["NET_ADMIN", "NET_RAW"]
|
||||
volumeMounts:
|
||||
- mountPath: /etc/kubernetes/admin.conf
|
||||
name: kubeconfig
|
||||
hostAliases:
|
||||
- hostnames:
|
||||
- kubernetes
|
||||
ip: 127.0.0.1
|
||||
hostNetwork: true
|
||||
volumes:
|
||||
- name: kubeconfig
|
||||
hostPath:
|
||||
path: /etc/rancher/k3s/k3s.yaml
|
||||
@@ -0,0 +1 @@
|
||||
openshift==0.13.1
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
collections:
|
||||
- name: ansible.posix
|
||||
version: 1.5.4
|
||||
- name: ansible.utils
|
||||
version: 2.10.3
|
||||
- name: community.general
|
||||
version: 7.1.0
|
||||
- name: community.sops
|
||||
version: 1.6.4
|
||||
- name: kubernetes.core
|
||||
version: 2.4.0
|
||||
roles:
|
||||
- name: xanmanning.k3s
|
||||
src: https://github.com/PyratLabs/ansible-role-k3s.git
|
||||
version: v3.4.2
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: v1.12.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: jetstack
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
installCRDs: true
|
||||
extraArgs:
|
||||
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
|
||||
- --dns01-recursive-nameservers-only
|
||||
podDnsPolicy: None
|
||||
podDnsConfig:
|
||||
nameservers:
|
||||
- "1.1.1.1"
|
||||
- "9.9.9.9"
|
||||
prometheus:
|
||||
enabled: true
|
||||
servicemonitor:
|
||||
enabled: true
|
||||
prometheusInstance: monitoring
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: cert-manager
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
- ./prometheusrule.yaml
|
||||
+62
@@ -0,0 +1,62 @@
|
||||
#jinja2: trim_blocks: True
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: cert-manager.rules
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
groups:
|
||||
- name: cert-manager
|
||||
rules:
|
||||
- alert: CertManagerAbsent
|
||||
expr: |
|
||||
absent(up{job="cert-manager"})
|
||||
for: 15m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
description: >
|
||||
New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
|
||||
summary: "Cert Manager has dissapeared from Prometheus service discovery."
|
||||
- name: certificates
|
||||
rules:
|
||||
- alert: CertManagerCertExpirySoon
|
||||
expr: |
|
||||
avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
|
||||
for: 15m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
description: >
|
||||
The domain that this cert covers will be unavailable after
|
||||
{% raw %}{{ $value | humanizeDuration }}{% endraw %}. Clients using endpoints that this cert
|
||||
protects will start to fail in {% raw %}{{ $value | humanizeDuration }}{% endraw %}.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
|
||||
summary: |
|
||||
The cert {% raw %}{{ $labels.name }}{% endraw %} is {% raw %}{{ $value | humanizeDuration }}{% endraw %} from expiry, it should have renewed over a week ago.
|
||||
- alert: CertManagerCertNotReady
|
||||
expr: |
|
||||
max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
|
||||
for: 15m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
description: >
|
||||
This certificate has not been ready to serve traffic for at least
|
||||
10m. If the cert is being renewed or there is another valid cert, the ingress
|
||||
controller _may_ be able to serve that instead.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
|
||||
summary: "The cert {% raw %}{{ $labels.name }}{% endraw %} is not ready to serve traffic."
|
||||
- alert: CertManagerHittingRateLimits
|
||||
expr: |
|
||||
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
|
||||
for: 15m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
description: >
|
||||
Depending on the rate limit, cert-manager may be unable to generate certificates for up to a week.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
|
||||
summary: "Cert manager hitting LetsEncrypt rate limits."
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-production
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: "${SECRET_ACME_EMAIL}"
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-production
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
apiTokenSecretRef:
|
||||
name: cert-manager-secret
|
||||
key: api-token
|
||||
selector:
|
||||
dnsZones:
|
||||
- "${SECRET_DOMAIN}"
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: "${SECRET_ACME_EMAIL}"
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
apiTokenSecretRef:
|
||||
name: cert-manager-secret
|
||||
key: api-token
|
||||
selector:
|
||||
dnsZones:
|
||||
- "${SECRET_DOMAIN}"
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./issuers.yaml
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cert-manager-secret
|
||||
namespace: cert-manager
|
||||
stringData:
|
||||
api-token: "{{ bootstrap_cloudflare_token }}"
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cert-manager
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/cert-manager/cert-manager/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cert-manager-issuers
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-cert-manager
|
||||
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cert-manager/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: cert-manager
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,9 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
{% if hajimari.enabled | default(false) %}
|
||||
- ./hajimari/ks.yaml
|
||||
{% endif %}
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: default
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-flux-webhooks
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/flux-system/addons/webhooks
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+25
@@ -0,0 +1,25 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: flux-webhook
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
|
||||
hajimari.io/enable: "false"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: &host "flux-webhook.${SECRET_DOMAIN}"
|
||||
http:
|
||||
paths:
|
||||
- path: /hook/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: webhook-receiver
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./ingress.yaml
|
||||
- ./receiver.yaml
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
---
|
||||
apiVersion: notification.toolkit.fluxcd.io/v1
|
||||
kind: Receiver
|
||||
metadata:
|
||||
name: github-receiver
|
||||
namespace: flux-system
|
||||
spec:
|
||||
type: github
|
||||
events:
|
||||
- ping
|
||||
- push
|
||||
secretRef:
|
||||
name: github-webhook-token-secret
|
||||
resources:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
namespace: flux-system
|
||||
- apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
name: cluster
|
||||
namespace: flux-system
|
||||
- apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
name: cluster-apps
|
||||
namespace: flux-system
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: github-webhook-token-secret
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
token: "{{ bootstrap_flux_github_webhook_token }}"
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./github
|
||||
@@ -0,0 +1,10 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./addons/ks.yaml
|
||||
{% if weave_gitops.enabled | default(false) %}
|
||||
- ./weave-gitops/ks.yaml
|
||||
{% endif %}
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: flux-system
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
# https://docs.cilium.io/en/latest/network/l2-announcements
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
spec:
|
||||
loadBalancerIPs: true
|
||||
# NOTE: This might need to be set if you have more than one active NIC on your nodes
|
||||
# interfaces:
|
||||
# - ^eno[0-9]+
|
||||
nodeSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: pool
|
||||
spec:
|
||||
cidrs:
|
||||
- cidr: "{{ bootstrap_node_cidr }}"
|
||||
@@ -0,0 +1,105 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: cilium
|
||||
version: 1.14.0-rc.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cilium
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
autoDirectNodeRoutes: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
bgp:
|
||||
enabled: false
|
||||
cluster:
|
||||
name: home-cluster
|
||||
id: 1
|
||||
containerRuntime:
|
||||
integration: containerd
|
||||
socketPath: /var/run/k3s/containerd/containerd.sock
|
||||
endpointRoutes:
|
||||
enabled: true
|
||||
hubble:
|
||||
enabled: true
|
||||
metrics:
|
||||
enabled:
|
||||
- dns:query
|
||||
- drop
|
||||
- tcp
|
||||
- flow
|
||||
- port-distribution
|
||||
- icmp
|
||||
- http
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
relay:
|
||||
enabled: true
|
||||
rollOutPods: true
|
||||
prometheus:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
ui:
|
||||
enabled: true
|
||||
rollOutPods: true
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: simple-icons:cilium
|
||||
hosts:
|
||||
- &host "hubble.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
ipam:
|
||||
mode: kubernetes
|
||||
k8sServiceHost: "{{ bootstrap_kube_vip_addr }}"
|
||||
k8sServicePort: 6443
|
||||
ipv4NativeRoutingCIDR: "{{ bootstrap_cluster_cidr }}"
|
||||
kubeProxyReplacement: strict
|
||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||
# https://github.com/cilium/cilium/issues/26586
|
||||
l2announcements:
|
||||
enabled: true
|
||||
leaseDuration: 120s
|
||||
leaseRenewDeadline: 60s
|
||||
leaseRetryPeriod: 1s
|
||||
loadBalancer:
|
||||
algorithm: maglev
|
||||
mode: dsr
|
||||
localRedirectPolicy: true
|
||||
operator:
|
||||
replicas: 1
|
||||
rollOutPods: true
|
||||
prometheus:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
prometheus:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
rollOutCiliumPods: true
|
||||
securityContext:
|
||||
privileged: true
|
||||
tunnel: disabled
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./cilium-l2.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cilium
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/cilium/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,90 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: coredns
|
||||
version: 1.24.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: coredns
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: coredns
|
||||
replicaCount: 1
|
||||
k8sAppLabelOverride: kube-dns
|
||||
service:
|
||||
name: kube-dns
|
||||
clusterIP: "{{ bootstrap_coredns_addr }}"
|
||||
serviceAccount:
|
||||
create: true
|
||||
deployment:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
servers:
|
||||
- zones:
|
||||
- zone: .
|
||||
scheme: dns://
|
||||
use_tcp: true
|
||||
port: 53
|
||||
plugins:
|
||||
- name: log
|
||||
- name: errors
|
||||
- name: health
|
||||
configBlock: |-
|
||||
lameduck 5s
|
||||
- name: ready
|
||||
- name: kubernetes
|
||||
parameters: cluster.local in-addr.arpa ip6.arpa
|
||||
configBlock: |-
|
||||
pods insecure
|
||||
fallthrough in-addr.arpa ip6.arpa
|
||||
ttl 30
|
||||
- name: prometheus
|
||||
parameters: 0.0.0.0:9153
|
||||
- name: forward
|
||||
parameters: . /etc/resolv.conf
|
||||
- name: cache
|
||||
parameters: 30
|
||||
- name: loop
|
||||
- name: reload
|
||||
- name: loadbalance
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: coredns
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-coredns
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/coredns/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,14 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cilium/ks.yaml
|
||||
- ./coredns/ks.yaml
|
||||
- ./local-path-provisioner/ks.yaml
|
||||
- ./metrics-server/ks.yaml
|
||||
- ./reloader/ks.yaml
|
||||
{% if csi_driver_nfs.enabled | default(false) %}
|
||||
- ./csi-driver-nfs/ks.yaml
|
||||
{% endif %}
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: local-path-provisioner
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: ./deploy/chart/local-path-provisioner
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: local-path-provisioner
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
helperImage:
|
||||
repository: public.ecr.aws/docker/library/busybox
|
||||
tag: latest
|
||||
storageClass:
|
||||
defaultClass: false
|
||||
nodePathMap:
|
||||
- node: DEFAULT_PATH_FOR_NON_LISTED_NODES
|
||||
paths: ["/var/lib/rancher/k3s/storage"]
|
||||
# NOTE: Do not enable Flux variable substitution on this HelmRelease
|
||||
configmap:
|
||||
setup: |-
|
||||
#!/bin/sh
|
||||
while getopts "m:s:p:" opt
|
||||
do
|
||||
case $opt in
|
||||
p)
|
||||
absolutePath=$OPTARG
|
||||
;;
|
||||
s)
|
||||
sizeInBytes=$OPTARG
|
||||
;;
|
||||
m)
|
||||
volMode=$OPTARG
|
||||
;;
|
||||
esac
|
||||
done
|
||||
mkdir -m 0777 -p ${absolutePath}
|
||||
chmod 701 ${absolutePath}/..
|
||||
teardown: |-
|
||||
#!/bin/sh
|
||||
while getopts "m:s:p:" opt
|
||||
do
|
||||
case $opt in
|
||||
p)
|
||||
absolutePath=$OPTARG
|
||||
;;
|
||||
s)
|
||||
sizeInBytes=$OPTARG
|
||||
;;
|
||||
m)
|
||||
volMode=$OPTARG
|
||||
;;
|
||||
esac
|
||||
done
|
||||
rm -rf ${absolutePath}
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-local-path-provisioner
|
||||
namespace: flux-system
|
||||
labels:
|
||||
substitution.flux.home.arpa/disabled: "true"
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/local-path-provisioner/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: metrics-server
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: metrics-server
|
||||
version: 3.10.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: metrics-server
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
args:
|
||||
- --kubelet-insecure-tls
|
||||
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
|
||||
- --kubelet-use-node-status-port
|
||||
- --metric-resolution=15s
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-metrics-server
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/metrics-server/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kube-system
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: reloader
|
||||
namespace: &namespace kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: reloader
|
||||
version: 1.0.29
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: stakater
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: reloader
|
||||
reloader:
|
||||
reloadStrategy: annotations
|
||||
podMonitor:
|
||||
enabled: true
|
||||
namespace: *namespace
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-reloader
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/reloader/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,15 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
{% if grafana.enabled | default(false) %}
|
||||
- ./grafana/ks.yaml
|
||||
{% endif %}
|
||||
{% if kube_prometheus_stack.enabled | default(false) %}
|
||||
- ./kube-prometheus-stack/ks.yaml
|
||||
{% endif %}
|
||||
{% if kubernetes_dashboard.enabled | default(false) %}
|
||||
- ./kubernetes-dashboard/ks.yaml
|
||||
{% endif %}
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: monitoring
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
originRequest:
|
||||
http2Origin: true
|
||||
|
||||
# https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/ingress
|
||||
ingress:
|
||||
- hostname: "${SECRET_DOMAIN}"
|
||||
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
|
||||
originRequest:
|
||||
originServerName: "ingress.${SECRET_DOMAIN}"
|
||||
- hostname: "*.${SECRET_DOMAIN}"
|
||||
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
|
||||
originRequest:
|
||||
originServerName: "ingress.${SECRET_DOMAIN}"
|
||||
- service: http_status:404
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: externaldns.k8s.io/v1alpha1
|
||||
kind: DNSEndpoint
|
||||
metadata:
|
||||
name: cloudflared
|
||||
namespace: networking
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
|
||||
spec:
|
||||
endpoints:
|
||||
- dnsName: "ingress.${SECRET_DOMAIN}"
|
||||
recordType: CNAME
|
||||
targets: ["${SECRET_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"]
|
||||
@@ -0,0 +1,102 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cloudflared
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 1.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
controller:
|
||||
replicas: 1
|
||||
strategy: RollingUpdate
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
image:
|
||||
repository: docker.io/cloudflare/cloudflared
|
||||
tag: 2023.6.1
|
||||
env:
|
||||
NO_AUTOUPDATE: "true"
|
||||
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
|
||||
TUNNEL_METRICS: 0.0.0.0:8080
|
||||
TUNNEL_TRANSPORT_PROTOCOL: auto
|
||||
TUNNEL_ID:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: cloudflared-secret
|
||||
key: TUNNEL_ID
|
||||
args:
|
||||
- tunnel
|
||||
- --config
|
||||
- /etc/cloudflared/config/config.yaml
|
||||
- run
|
||||
- "$(TUNNEL_ID)"
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 8080
|
||||
serviceMonitor:
|
||||
main:
|
||||
enabled: true
|
||||
endpoints:
|
||||
- port: http
|
||||
scheme: http
|
||||
path: /metrics
|
||||
interval: 1m
|
||||
scrapeTimeout: 30s
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: configMap
|
||||
name: cloudflared-configmap
|
||||
subPath: config.yaml
|
||||
mountPath: /etc/cloudflared/config/config.yaml
|
||||
readOnly: true
|
||||
creds:
|
||||
enabled: true
|
||||
type: secret
|
||||
name: cloudflared-secret
|
||||
subPath: credentials.json
|
||||
mountPath: /etc/cloudflared/creds/credentials.json
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 10Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./dnsendpoint.yaml
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
configMapGenerator:
|
||||
- name: cloudflared-configmap
|
||||
files:
|
||||
- ./configs/config.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cloudflared-secret
|
||||
namespace: networking
|
||||
stringData:
|
||||
TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
|
||||
credentials.json: |
|
||||
{
|
||||
"AccountTag": "{{ bootstrap_cloudflare_account_tag }}",
|
||||
"TunnelSecret": "{{ bootstrap_cloudflare_tunnel_secret }}",
|
||||
"TunnelID": "{{ bootstrap_cloudflare_tunnel_id }}"
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cloudflared
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-dns
|
||||
path: ./kubernetes/apps/networking/cloudflared/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,78 @@
|
||||
#jinja2: trim_blocks: True
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: echo-server
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 1.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
controller:
|
||||
strategy: RollingUpdate
|
||||
image:
|
||||
repository: docker.io/jmalloc/echo-server
|
||||
tag: 0.3.5
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: &port 8080
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
ingress:
|
||||
main:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
|
||||
hajimari.io/icon: video-input-antenna
|
||||
hosts:
|
||||
- host: &host "{% raw %}{{ .Release.Name }}{% endraw %}.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 10Mi
|
||||
limits:
|
||||
memory: 50Mi
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-echo-server
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/networking/echo-server/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+93
@@ -0,0 +1,93 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.5.0
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-sigs/external-dns/pull/2007"
|
||||
creationTimestamp: null
|
||||
name: dnsendpoints.externaldns.k8s.io
|
||||
spec:
|
||||
group: externaldns.k8s.io
|
||||
names:
|
||||
kind: DNSEndpoint
|
||||
listKind: DNSEndpointList
|
||||
plural: dnsendpoints
|
||||
singular: dnsendpoint
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: DNSEndpointSpec defines the desired state of DNSEndpoint
|
||||
properties:
|
||||
endpoints:
|
||||
items:
|
||||
description: Endpoint is a high-level way of a connection between a service and an IP
|
||||
properties:
|
||||
dnsName:
|
||||
description: The hostname of the DNS record
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Labels stores labels defined for the Endpoint
|
||||
type: object
|
||||
providerSpecific:
|
||||
description: ProviderSpecific stores provider specific config
|
||||
items:
|
||||
description: ProviderSpecificProperty holds the name and value of a configuration which is specific to individual DNS providers
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
recordTTL:
|
||||
description: TTL for the record
|
||||
format: int64
|
||||
type: integer
|
||||
recordType:
|
||||
description: RecordType type of record, e.g. CNAME, A, SRV, TXT etc
|
||||
type: string
|
||||
setIdentifier:
|
||||
description: Identifier to distinguish multiple records with the same name and type (e.g. Route53 records with routing policies other than 'simple')
|
||||
type: string
|
||||
targets:
|
||||
description: The targets the DNS record points to
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: DNSEndpointStatus defines the observed state of DNSEndpoint
|
||||
properties:
|
||||
observedGeneration:
|
||||
description: The generation observed by the external-dns controller.
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app external-dns
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: external-dns
|
||||
version: 1.13.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: external-dns
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: *app
|
||||
provider: cloudflare
|
||||
env:
|
||||
- name: CF_API_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: external-dns-secret
|
||||
key: api-token
|
||||
extraArgs:
|
||||
- --annotation-filter=external-dns.alpha.kubernetes.io/target
|
||||
- --cloudflare-proxied
|
||||
- --crd-source-apiversion=externaldns.k8s.io/v1alpha1
|
||||
- --crd-source-kind=DNSEndpoint
|
||||
policy: sync
|
||||
sources: ["crd", "ingress"]
|
||||
txtPrefix: k8s.
|
||||
txtOwnerId: default
|
||||
domainFilters: ["${SECRET_DOMAIN}"]
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: external-dns-secret
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./dnsendpoint-crd.yaml
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
Loaded 100 of 177 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user