infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: Yall have spoken, wildcard certs are now a thing

Browse Source 
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl committed 2023-01-12 08:55:55 -05:00
1 parent 07c7dd2ae6
commit d764022847
17 files changed
+121 -33
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
-6
View File
@@ -401,12 +401,6 @@ To access services from the outside world port forwarded `80` and `443` in your
Now if nothing is working, that is expected. This is DNS after all!
### 🔐 SSL
By default in this template Kubernetes ingresses are set to use the [Let's Encrypt Staging Environment](https://letsencrypt.org/docs/staging-environment/). This will hopefully reduce issues from ACME on requesting certificates until you are ready to use this in "Production".
Once you have confirmed there are no issues requesting your certificates replace `letsencrypt-staging` with `letsencrypt-production` in your ingress annotations for `cert-manager.io/cluster-issuer`
### 🤖 Renovatebot
[Renovatebot](https://www.mend.io/free-developer-tools/renovate/) will scan your repository and offer PRs when it finds dependencies out of date. Common dependencies it will discover and update are Flux, Ansible Galaxy Roles, Terraform Providers, Kubernetes Helm Charts, Kubernetes Container Images, Pre-commit hooks updates, and more!
kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
+4
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: jetstack
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
installCRDs: true
extraArgs:
kubernetes/apps/default/echo-server/app/helmrelease.yaml
+4 -2
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
controller:
strategy: RollingUpdate
@@ -52,7 +56,6 @@ spec:
enabled: true
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-staging
external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
external-dns.home.arpa/enabled: "true"
hajimari.io/icon: video-input-antenna
@@ -64,7 +67,6 @@ spec:
tls:
- hosts:
- *host
secretName: echo-server-tls
resources:
requests:
cpu: 5m
kubernetes/apps/default/hajimari/app/helmrelease.yaml
+4 -2
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: hajimari
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
hajimari:
title: Apps
@@ -41,7 +45,6 @@ spec:
enabled: true
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-staging
nginx.ingress.kubernetes.io/whitelist-source-range: |
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
hajimari.io/enable: "false"
@@ -53,7 +56,6 @@ spec:
tls:
- hosts:
- *host
secretName: hajimari-tls
podAnnotations:
configmap.reloader.stakater.com/reload: hajimari-settings
persistence:
kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
-2
View File
@@ -5,7 +5,6 @@ metadata:
name: flux-webhook
namespace: flux-system
annotations:
cert-manager.io/cluster-issuer: letsencrypt-staging
external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
external-dns.home.arpa/enabled: "true"
hajimari.io/enable: "false"
@@ -25,4 +24,3 @@ spec:
tls:
- hosts:
- *host
secretName: flux-webhook-tls
kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
+4 -2
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: weave-gitops
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
adminUser:
create: true
@@ -29,7 +33,6 @@ spec:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-staging
nginx.ingress.kubernetes.io/whitelist-source-range: |
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
hajimari.io/icon: sawtooth-wave
@@ -41,7 +44,6 @@ spec:
tls:
- hosts:
- *host
secretName: weave-gitops-tls
networkPolicy:
create: false
metrics:
kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
+4
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: metrics-server
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
args:
- --kubelet-insecure-tls
kubernetes/apps/kube-system/reloader/app/helmrelease.yaml
+4
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: stakater
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
fullnameOverride: reloader
reloader:
kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml
+4
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: kubernetes-dashboard
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
env:
TZ: "${TIMEZONE}"
kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml
+4
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
controller:
type: cronjob
kubernetes/apps/networking/external-dns/app/helmrelease.yaml
+5 -2
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: external-dns
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
interval: 2m
# logLevel: debug
@@ -43,8 +47,7 @@ spec:
sources: ["ingress"]
txtPrefix: k8s.
txtOwnerId: default
domainFilters:
- "${SECRET_DOMAIN}"
domainFilters: ["${SECRET_DOMAIN}"]
serviceMonitor:
enabled: true
podAnnotations:
kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
+18 -9
View File
@@ -14,17 +14,17 @@ spec:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
interval: 15m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
dependsOn:
- name: cert-manager
namespace: cert-manager
uninstall:
keepHistory: false
values:
controller:
extraEnvs:
@@ -32,8 +32,7 @@ spec:
value: "${TIMEZONE}"
service:
annotations:
metallb.universe.tf/loadBalancerIPs: |-
${METALLB_INGRESS_ADDR}
metallb.universe.tf/loadBalancerIPs: "${METALLB_INGRESS_ADDR}"
externalTrafficPolicy: Local
publishService:
enabled: true
@@ -43,8 +42,7 @@ spec:
client-header-timeout: 120
client-body-buffer-size: "100M"
client-body-timeout: 120
custom-http-errors: |-
401,403,404,500,501,502,503
custom-http-errors: 400,401,403,404,500,502,503,504
enable-brotli: "true"
forwarded-for-header: "CF-Connecting-IP"
hsts-max-age: "31449600"
@@ -53,10 +51,21 @@ spec:
proxy-body-size: "100M"
ssl-protocols: "TLSv1.3 TLSv1.2"
use-forwarded-headers: "true"
log-format-escape-json: "true"
log-format-upstream: >-
{"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr",
"x_forwarded_for": "$proxy_add_x_forwarded_for", "request_id": "$req_id",
"remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time,
"status": $status, "vhost": "$host", "request_proto": "$server_protocol",
"path": "$uri", "request_query": "$args", "request_length": $request_length,
"duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer",
"http_user_agent": "$http_user_agent"}
metrics:
enabled: false
extraArgs:
default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-production-tls"
podAnnotations:
configmap.reloader.stakater.com/reload: "cloudflare-networks"
configmap.reloader.stakater.com/reload: cloudflare-networks
resources:
requests:
cpu: 10m
kubernetes/apps/networking/ingress-nginx/certificates/certificates.yaml
+30
View File
@@ -0,0 +1,30 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: "${SECRET_DOMAIN/./-}-production"
namespace: networking
spec:
secretName: "${SECRET_DOMAIN/./-}-production-tls"
issuerRef:
name: letsencrypt-production
kind: ClusterIssuer
commonName: "${SECRET_DOMAIN}"
dnsNames:
- "${SECRET_DOMAIN}"
- "*.${SECRET_DOMAIN}"
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: "${SECRET_DOMAIN/./-}-staging"
namespace: networking
spec:
secretName: "${SECRET_DOMAIN/./-}-staging-tls"
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer
commonName: "${SECRET_DOMAIN}"
dnsNames:
- "${SECRET_DOMAIN}"
- "*.${SECRET_DOMAIN}"
kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./certificates.yaml
kubernetes/apps/networking/ingress-nginx/ks.yaml
+21 -3
View File
@@ -1,6 +1,26 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-ingress-nginx-certificates
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-cert-manager-issuers
path: ./kubernetes/apps/networking/ingress-nginx/certificates
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 3m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
name: cluster-apps-ingress-nginx
namespace: flux-system
@@ -8,9 +28,7 @@ metadata:
substitution.flux.home.arpa/enabled: "true"
spec:
dependsOn:
- name: cluster-apps-cert-manager
- name: cluster-apps-cert-manager-issuers
- name: cluster-apps-metallb
- name: cluster-apps-ingress-nginx-certificates
- name: cluster-apps-metallb-config
path: ./kubernetes/apps/networking/ingress-nginx/app
prune: true
kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml
+6 -5
View File
@@ -14,16 +14,17 @@ spec:
kind: HelmRepository
name: k8s-gateway
namespace: flux-system
interval: 15m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 5
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 5
dependsOn:
- name: metallb
retries: 3
uninstall:
keepHistory: false
values:
fullnameOverride: k8s-gateway
domain: "${SECRET_DOMAIN}"
kubernetes/apps/networking/metallb/app/helmrelease.yaml
+4
View File
@@ -14,13 +14,17 @@ spec:
kind: HelmRepository
name: metallb
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
crds:
enabled: true