From cee18af64c33c6fb023b7d6aff7330e701d7f610 Mon Sep 17 00:00:00 2001 From: Heavybullets8 Date: Thu, 3 Oct 2024 19:01:58 -0600 Subject: [PATCH] Various Improvements (#1586) * Cert-Manager: Replace depricated "installCRDs" * Cilium: Replace deprecated "io.cilium/lb-ipam-ips" annotation * Sysctls: Up `net.core.rmem_max` and `net.core.wmem_max` for Cloudflared --- .../apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 | 4 +++- .../apps/network/ingress-nginx/external/helmrelease.yaml.j2 | 2 +- .../apps/network/ingress-nginx/internal/helmrelease.yaml.j2 | 2 +- .../apps/network/k8s-gateway/app/helmrelease.yaml.j2 | 2 +- .../kubernetes/bootstrap/talos/patches/global/sysctl.yaml.j2 | 4 ++-- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 index 3238cc82..f2250030 100644 --- a/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 @@ -21,7 +21,9 @@ spec: remediation: retries: 3 values: - installCRDs: true + crds: + enabled: true + keep: true dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query dns01RecursiveNameserversOnly: true prometheus: diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 index 12683137..badf93cb 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2 @@ -29,7 +29,7 @@ spec: service: annotations: external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}" - io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#" + lbipam.cilium.io/ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#" externalTrafficPolicy: Cluster ingressClassResource: name: external diff --git a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 index 1fe17246..074d0727 100644 --- a/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2 @@ -26,7 +26,7 @@ spec: controller: service: annotations: - io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.ingress_vip }#" + lbipam.cilium.io/ips: "#{ bootstrap_cloudflare.ingress_vip }#" externalTrafficPolicy: Cluster ingressClassResource: name: internal diff --git a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 index bf7b917f..6c205b09 100644 --- a/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 +++ b/bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2 @@ -28,6 +28,6 @@ spec: type: LoadBalancer port: 53 annotations: - io.cilium/lb-ipam-ips: "#{ bootstrap_cloudflare.gateway_vip }#" + lbipam.cilium.io/ips: "#{ bootstrap_cloudflare.gateway_vip }#" externalTrafficPolicy: Cluster watchedResources: ["Ingress", "Service"] diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/sysctl.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/sysctl.yaml.j2 index 90361d7b..8f154df0 100644 --- a/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/sysctl.yaml.j2 +++ b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/sysctl.yaml.j2 @@ -3,5 +3,5 @@ machine: fs.inotify.max_queued_events: "65536" fs.inotify.max_user_watches: "524288" fs.inotify.max_user_instances: "8192" - net.core.rmem_max: "2500000" - net.core.wmem_max: "2500000" + net.core.rmem_max: "7500000" + net.core.wmem_max: "7500000"