diff --git a/README.md b/README.md index de97e50a..c86a7388 100644 --- a/README.md +++ b/README.md @@ -401,12 +401,6 @@ To access services from the outside world port forwarded `80` and `443` in your Now if nothing is working, that is expected. This is DNS after all! -### 🔐 SSL - -By default in this template Kubernetes ingresses are set to use the [Let's Encrypt Staging Environment](https://letsencrypt.org/docs/staging-environment/). This will hopefully reduce issues from ACME on requesting certificates until you are ready to use this in "Production". - -Once you have confirmed there are no issues requesting your certificates replace `letsencrypt-staging` with `letsencrypt-production` in your ingress annotations for `cert-manager.io/cluster-issuer` - ### 🤖 Renovatebot [Renovatebot](https://www.mend.io/free-developer-tools/renovate/) will scan your repository and offer PRs when it finds dependencies out of date. Common dependencies it will discover and update are Flux, Ansible Galaxy Roles, Terraform Providers, Kubernetes Helm Charts, Kubernetes Container Images, Pre-commit hooks updates, and more! diff --git a/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml b/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml index 7c079c70..4aa9ab0a 100644 --- a/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml +++ b/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: jetstack namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: installCRDs: true extraArgs: diff --git a/kubernetes/apps/default/echo-server/app/helmrelease.yaml b/kubernetes/apps/default/echo-server/app/helmrelease.yaml index 28313752..e6957e7c 100644 --- a/kubernetes/apps/default/echo-server/app/helmrelease.yaml +++ b/kubernetes/apps/default/echo-server/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: controller: strategy: RollingUpdate @@ -52,7 +56,6 @@ spec: enabled: true ingressClassName: nginx annotations: - cert-manager.io/cluster-issuer: letsencrypt-staging external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" external-dns.home.arpa/enabled: "true" hajimari.io/icon: video-input-antenna @@ -64,7 +67,6 @@ spec: tls: - hosts: - *host - secretName: echo-server-tls resources: requests: cpu: 5m diff --git a/kubernetes/apps/default/hajimari/app/helmrelease.yaml b/kubernetes/apps/default/hajimari/app/helmrelease.yaml index aef6b8e8..0b53323c 100644 --- a/kubernetes/apps/default/hajimari/app/helmrelease.yaml +++ b/kubernetes/apps/default/hajimari/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: hajimari namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: hajimari: title: Apps @@ -41,7 +45,6 @@ spec: enabled: true ingressClassName: nginx annotations: - cert-manager.io/cluster-issuer: letsencrypt-staging nginx.ingress.kubernetes.io/whitelist-source-range: | 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 hajimari.io/enable: "false" @@ -53,7 +56,6 @@ spec: tls: - hosts: - *host - secretName: hajimari-tls podAnnotations: configmap.reloader.stakater.com/reload: hajimari-settings persistence: diff --git a/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml index 3ea2aa2e..8df43a60 100644 --- a/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml +++ b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml @@ -5,7 +5,6 @@ metadata: name: flux-webhook namespace: flux-system annotations: - cert-manager.io/cluster-issuer: letsencrypt-staging external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}" external-dns.home.arpa/enabled: "true" hajimari.io/enable: "false" @@ -25,4 +24,3 @@ spec: tls: - hosts: - *host - secretName: flux-webhook-tls diff --git a/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml index 862f5780..3ffe6c2c 100644 --- a/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml +++ b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: weave-gitops namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: adminUser: create: true @@ -29,7 +33,6 @@ spec: enabled: true className: nginx annotations: - cert-manager.io/cluster-issuer: letsencrypt-staging nginx.ingress.kubernetes.io/whitelist-source-range: | 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 hajimari.io/icon: sawtooth-wave @@ -41,7 +44,6 @@ spec: tls: - hosts: - *host - secretName: weave-gitops-tls networkPolicy: create: false metrics: diff --git a/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml b/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml index 3af2a2a3..429acd34 100644 --- a/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml +++ b/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: metrics-server namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: args: - --kubelet-insecure-tls diff --git a/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml b/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml index 1981596e..fb19722f 100644 --- a/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml +++ b/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: stakater namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: fullnameOverride: reloader reloader: diff --git a/kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml b/kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml index b7ca320c..214b1030 100644 --- a/kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml +++ b/kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: kubernetes-dashboard namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: env: TZ: "${TIMEZONE}" diff --git a/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml b/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml index 7e281b87..e5300dc7 100644 --- a/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml +++ b/kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: controller: type: cronjob diff --git a/kubernetes/apps/networking/external-dns/app/helmrelease.yaml b/kubernetes/apps/networking/external-dns/app/helmrelease.yaml index 4de524f6..53faaccb 100644 --- a/kubernetes/apps/networking/external-dns/app/helmrelease.yaml +++ b/kubernetes/apps/networking/external-dns/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: external-dns namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: interval: 2m # logLevel: debug @@ -43,8 +47,7 @@ spec: sources: ["ingress"] txtPrefix: k8s. txtOwnerId: default - domainFilters: - - "${SECRET_DOMAIN}" + domainFilters: ["${SECRET_DOMAIN}"] serviceMonitor: enabled: true podAnnotations: diff --git a/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml b/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml index 1275b0a2..e5b0b112 100644 --- a/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml +++ b/kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml @@ -14,17 +14,17 @@ spec: kind: HelmRepository name: ingress-nginx namespace: flux-system - interval: 15m + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 - dependsOn: - - name: cert-manager - namespace: cert-manager + uninstall: + keepHistory: false values: controller: extraEnvs: @@ -32,8 +32,7 @@ spec: value: "${TIMEZONE}" service: annotations: - metallb.universe.tf/loadBalancerIPs: |- - ${METALLB_INGRESS_ADDR} + metallb.universe.tf/loadBalancerIPs: "${METALLB_INGRESS_ADDR}" externalTrafficPolicy: Local publishService: enabled: true @@ -43,8 +42,7 @@ spec: client-header-timeout: 120 client-body-buffer-size: "100M" client-body-timeout: 120 - custom-http-errors: |- - 401,403,404,500,501,502,503 + custom-http-errors: 400,401,403,404,500,502,503,504 enable-brotli: "true" forwarded-for-header: "CF-Connecting-IP" hsts-max-age: "31449600" @@ -53,10 +51,21 @@ spec: proxy-body-size: "100M" ssl-protocols: "TLSv1.3 TLSv1.2" use-forwarded-headers: "true" + log-format-escape-json: "true" + log-format-upstream: >- + {"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr", + "x_forwarded_for": "$proxy_add_x_forwarded_for", "request_id": "$req_id", + "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time, + "status": $status, "vhost": "$host", "request_proto": "$server_protocol", + "path": "$uri", "request_query": "$args", "request_length": $request_length, + "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer", + "http_user_agent": "$http_user_agent"} metrics: enabled: false + extraArgs: + default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls" podAnnotations: - configmap.reloader.stakater.com/reload: "cloudflare-networks" + configmap.reloader.stakater.com/reload: cloudflare-networks resources: requests: cpu: 10m diff --git a/kubernetes/apps/networking/ingress-nginx/certificates/certificates.yaml b/kubernetes/apps/networking/ingress-nginx/certificates/certificates.yaml new file mode 100644 index 00000000..b4025112 --- /dev/null +++ b/kubernetes/apps/networking/ingress-nginx/certificates/certificates.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: "${SECRET_DOMAIN/./-}-production" + namespace: networking +spec: + secretName: "${SECRET_DOMAIN/./-}-production-tls" + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "${SECRET_DOMAIN}" + dnsNames: + - "${SECRET_DOMAIN}" + - "*.${SECRET_DOMAIN}" +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: "${SECRET_DOMAIN/./-}-staging" + namespace: networking +spec: + secretName: "${SECRET_DOMAIN/./-}-staging-tls" + issuerRef: + name: letsencrypt-staging + kind: ClusterIssuer + commonName: "${SECRET_DOMAIN}" + dnsNames: + - "${SECRET_DOMAIN}" + - "*.${SECRET_DOMAIN}" diff --git a/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml b/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml new file mode 100644 index 00000000..cb1f2c03 --- /dev/null +++ b/kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./certificates.yaml diff --git a/kubernetes/apps/networking/ingress-nginx/ks.yaml b/kubernetes/apps/networking/ingress-nginx/ks.yaml index fc7e8d72..87935d44 100644 --- a/kubernetes/apps/networking/ingress-nginx/ks.yaml +++ b/kubernetes/apps/networking/ingress-nginx/ks.yaml @@ -1,6 +1,26 @@ --- apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 kind: Kustomization +metadata: + name: cluster-apps-ingress-nginx-certificates + namespace: flux-system + labels: + substitution.flux.home.arpa/enabled: "true" +spec: + dependsOn: + - name: cluster-apps-cert-manager-issuers + path: ./kubernetes/apps/networking/ingress-nginx/certificates + prune: true + sourceRef: + kind: GitRepository + name: home-kubernetes + wait: true + interval: 30m + retryInterval: 1m + timeout: 3m +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization metadata: name: cluster-apps-ingress-nginx namespace: flux-system @@ -8,9 +28,7 @@ metadata: substitution.flux.home.arpa/enabled: "true" spec: dependsOn: - - name: cluster-apps-cert-manager - - name: cluster-apps-cert-manager-issuers - - name: cluster-apps-metallb + - name: cluster-apps-ingress-nginx-certificates - name: cluster-apps-metallb-config path: ./kubernetes/apps/networking/ingress-nginx/app prune: true diff --git a/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml b/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml index a0116e9b..11fb9350 100644 --- a/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml +++ b/kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml @@ -14,16 +14,17 @@ spec: kind: HelmRepository name: k8s-gateway namespace: flux-system - interval: 15m + maxHistory: 3 install: createNamespace: true remediation: - retries: 5 + retries: 3 upgrade: + cleanupOnFail: true remediation: - retries: 5 - dependsOn: - - name: metallb + retries: 3 + uninstall: + keepHistory: false values: fullnameOverride: k8s-gateway domain: "${SECRET_DOMAIN}" diff --git a/kubernetes/apps/networking/metallb/app/helmrelease.yaml b/kubernetes/apps/networking/metallb/app/helmrelease.yaml index 2db0214e..f538940b 100644 --- a/kubernetes/apps/networking/metallb/app/helmrelease.yaml +++ b/kubernetes/apps/networking/metallb/app/helmrelease.yaml @@ -14,13 +14,17 @@ spec: kind: HelmRepository name: metallb namespace: flux-system + maxHistory: 3 install: createNamespace: true remediation: retries: 3 upgrade: + cleanupOnFail: true remediation: retries: 3 + uninstall: + keepHistory: false values: crds: enabled: true