From de61c22c379ff4577f706a7677248775c07bba6a Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Wed, 19 Oct 2022 15:07:03 -0400 Subject: [PATCH] feat!: Remove core and crds fluxtomizations and use raw helm chart to install CRs Signed-off-by: Devin Buhl --- .secretlintignore | 1 + README.md | 6 +- cluster/apps/default/kustomization.yaml | 1 + .../reloader/helm-release.yaml | 0 .../reloader}/kustomization.yaml | 0 cluster/apps/kube-system/kustomization.yaml | 3 - cluster/apps/kustomization.yaml | 2 +- .../cert-manager/helm-release.yaml | 4 +- .../cert-manager/issuers/helm-release.yaml | 69 +++++++++++++++++++ .../cert-manager/issuers}/kustomization.yaml | 4 +- .../cert-manager}/kustomization.yaml | 4 +- .../networking/cloudflare-ddns/cron-job.yaml | 40 +++++------ .../ingress-nginx/helm-release.yaml | 4 +- cluster/apps/networking/metallb/config.yaml | 18 ----- .../metallb/config/helm-release.yaml | 45 ++++++++++++ .../metallb/config}/kustomization.yaml | 0 .../apps/networking/metallb/helm-release.yaml | 4 +- .../networking/metallb/kustomization.yaml | 2 +- .../kured/helm-release.yaml | 2 +- .../kured}/kustomization.yaml | 0 .../apps/system-upgrade/kustomization.yaml | 3 + .../kustomization.yaml | 14 ++-- cluster/charts/dysnix-charts.yaml | 9 +++ cluster/charts/kustomization.yaml | 1 + .../core/cluster-issuers/kustomization.yaml | 6 -- .../letsencrypt-production.yaml | 21 ------ .../cluster-issuers/letsencrypt-staging.yaml | 21 ------ cluster/crds/cert-manager/kustomization.yaml | 6 -- cluster/crds/kustomization.yaml | 7 -- cluster/crds/metallb/crds.yaml | 30 -------- .../kustomization.yaml | 6 -- cluster/flux/apps.yaml | 5 +- cluster/flux/charts.yaml | 2 +- cluster/flux/config.yaml | 2 +- cluster/flux/core.yaml | 27 -------- cluster/flux/crds.yaml | 13 ---- configure | 4 +- .../inventory/group_vars/kubernetes/os.yml | 1 + tmpl/cluster/flux-cluster.yaml | 4 +- 39 files changed, 185 insertions(+), 206 deletions(-) rename cluster/apps/{kube-system => default}/reloader/helm-release.yaml (100%) rename cluster/apps/{kube-system/kured => default/reloader}/kustomization.yaml (100%) rename cluster/apps/{kube-system => networking}/cert-manager/helm-release.yaml (93%) create mode 100644 cluster/apps/networking/cert-manager/issuers/helm-release.yaml rename cluster/{crds/metallb => apps/networking/cert-manager/issuers}/kustomization.yaml (63%) rename cluster/{core => apps/networking/cert-manager}/kustomization.yaml (68%) delete mode 100644 cluster/apps/networking/metallb/config.yaml create mode 100644 cluster/apps/networking/metallb/config/helm-release.yaml rename cluster/apps/{kube-system/cert-manager => networking/metallb/config}/kustomization.yaml (100%) rename cluster/apps/{kube-system => system-upgrade}/kured/helm-release.yaml (95%) rename cluster/apps/{kube-system/reloader => system-upgrade/kured}/kustomization.yaml (100%) create mode 100644 cluster/charts/dysnix-charts.yaml delete mode 100644 cluster/core/cluster-issuers/kustomization.yaml delete mode 100644 cluster/core/cluster-issuers/letsencrypt-production.yaml delete mode 100644 cluster/core/cluster-issuers/letsencrypt-staging.yaml delete mode 100644 cluster/crds/cert-manager/kustomization.yaml delete mode 100644 cluster/crds/kustomization.yaml delete mode 100644 cluster/crds/metallb/crds.yaml delete mode 100644 cluster/crds/system-upgrade-controller/kustomization.yaml delete mode 100644 cluster/flux/core.yaml delete mode 100644 cluster/flux/crds.yaml diff --git a/.secretlintignore b/.secretlintignore index e942fc15..208737e8 100644 --- a/.secretlintignore +++ b/.secretlintignore @@ -1,2 +1,3 @@ megalinter-reports +tmpl README.md diff --git a/README.md b/README.md index ab748bd5..2fa3f651 100644 --- a/README.md +++ b/README.md @@ -103,10 +103,8 @@ The Git repository contains the following directories under `cluster` and are or ```sh 📁 cluster # k8s cluster defined as code ├─📁 flux # flux, gitops operator, loaded before everything -├─📁 crds # custom resources, loaded before 📁 core and 📁 apps -├─📁 charts # helm repos, loaded before 📁 core and 📁 apps -├─📁 config # cluster config, loaded before 📁 core and 📁 apps -├─📁 core # crucial apps, namespaced dir tree, loaded before 📁 apps +├─📁 charts # helm chart repos +├─📁 config # cluster config └─📁 apps # regular apps, namespaced dir tree, loaded last ``` diff --git a/cluster/apps/default/kustomization.yaml b/cluster/apps/default/kustomization.yaml index 5bdcb771..bd16b986 100644 --- a/cluster/apps/default/kustomization.yaml +++ b/cluster/apps/default/kustomization.yaml @@ -5,3 +5,4 @@ resources: - namespace.yaml - echo-server - hajimari + - reloader diff --git a/cluster/apps/kube-system/reloader/helm-release.yaml b/cluster/apps/default/reloader/helm-release.yaml similarity index 100% rename from cluster/apps/kube-system/reloader/helm-release.yaml rename to cluster/apps/default/reloader/helm-release.yaml diff --git a/cluster/apps/kube-system/kured/kustomization.yaml b/cluster/apps/default/reloader/kustomization.yaml similarity index 100% rename from cluster/apps/kube-system/kured/kustomization.yaml rename to cluster/apps/default/reloader/kustomization.yaml diff --git a/cluster/apps/kube-system/kustomization.yaml b/cluster/apps/kube-system/kustomization.yaml index 4047c969..1dc050cf 100644 --- a/cluster/apps/kube-system/kustomization.yaml +++ b/cluster/apps/kube-system/kustomization.yaml @@ -3,7 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - namespace.yaml - - cert-manager - # - kured - metrics-server - - reloader diff --git a/cluster/apps/kustomization.yaml b/cluster/apps/kustomization.yaml index f24e55f6..10518a56 100644 --- a/cluster/apps/kustomization.yaml +++ b/cluster/apps/kustomization.yaml @@ -6,4 +6,4 @@ resources: - flux-system - kube-system - networking - - system-upgrade + # - system-upgrade diff --git a/cluster/apps/kube-system/cert-manager/helm-release.yaml b/cluster/apps/networking/cert-manager/helm-release.yaml similarity index 93% rename from cluster/apps/kube-system/cert-manager/helm-release.yaml rename to cluster/apps/networking/cert-manager/helm-release.yaml index 41cee6ab..e78c4341 100644 --- a/cluster/apps/kube-system/cert-manager/helm-release.yaml +++ b/cluster/apps/networking/cert-manager/helm-release.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: cert-manager - namespace: kube-system + namespace: networking spec: interval: 15m chart: @@ -23,7 +23,7 @@ spec: remediation: retries: 5 values: - installCRDs: false + installCRDs: true webhook: enabled: true extraArgs: diff --git a/cluster/apps/networking/cert-manager/issuers/helm-release.yaml b/cluster/apps/networking/cert-manager/issuers/helm-release.yaml new file mode 100644 index 00000000..15088a49 --- /dev/null +++ b/cluster/apps/networking/cert-manager/issuers/helm-release.yaml @@ -0,0 +1,69 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: cert-manager-issuers + namespace: networking +spec: + interval: 15m + chart: + spec: + chart: raw + version: v0.3.1 + sourceRef: + kind: HelmRepository + name: dysnix + namespace: flux-system + install: + createNamespace: true + remediation: + retries: 5 + upgrade: + remediation: + retries: 5 + dependsOn: + - name: cert-manager + namespace: networking + values: + resources: + - apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: letsencrypt-production + spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: "${SECRET_CLOUDFLARE_EMAIL}" + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiKeySecretRef: + name: cloudflare-api-key + key: api-key + selector: + dnsZones: + - ${SECRET_DOMAIN} + + - apiVersion: cert-manager.io/v1 + kind: ClusterIssuer + metadata: + name: letsencrypt-staging + spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: "${SECRET_CLOUDFLARE_EMAIL}" + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiKeySecretRef: + name: cloudflare-api-key + key: api-key + selector: + dnsZones: + - ${SECRET_DOMAIN} diff --git a/cluster/crds/metallb/kustomization.yaml b/cluster/apps/networking/cert-manager/issuers/kustomization.yaml similarity index 63% rename from cluster/crds/metallb/kustomization.yaml rename to cluster/apps/networking/cert-manager/issuers/kustomization.yaml index 7d6dc05e..4268fa0e 100644 --- a/cluster/crds/metallb/kustomization.yaml +++ b/cluster/apps/networking/cert-manager/issuers/kustomization.yaml @@ -1,5 +1,5 @@ ---- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - crds.yaml + - helm-release.yaml + - secret.sops.yaml diff --git a/cluster/core/kustomization.yaml b/cluster/apps/networking/cert-manager/kustomization.yaml similarity index 68% rename from cluster/core/kustomization.yaml rename to cluster/apps/networking/cert-manager/kustomization.yaml index fac0ced4..c0aa9d02 100644 --- a/cluster/core/kustomization.yaml +++ b/cluster/apps/networking/cert-manager/kustomization.yaml @@ -1,5 +1,5 @@ ---- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - cluster-issuers + - helm-release.yaml + - issuers diff --git a/cluster/apps/networking/cloudflare-ddns/cron-job.yaml b/cluster/apps/networking/cloudflare-ddns/cron-job.yaml index 13f3a8ea..f3eba9ef 100644 --- a/cluster/apps/networking/cloudflare-ddns/cron-job.yaml +++ b/cluster/apps/networking/cloudflare-ddns/cron-job.yaml @@ -2,41 +2,41 @@ apiVersion: batch/v1 kind: CronJob metadata: - name: cloudflare-ddns - namespace: networking + name: &app cloudflare-ddns + namespace: default spec: - schedule: "0 * * * *" - concurrencyPolicy: "Forbid" - successfulJobsHistoryLimit: 3 - failedJobsHistoryLimit: 5 + schedule: "@hourly" + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + failedJobsHistoryLimit: 2 jobTemplate: spec: - backoffLimit: 3 - ttlSecondsAfterFinished: 300 + ttlSecondsAfterFinished: 3600 template: spec: - restartPolicy: Never + automountServiceAccountToken: false + restartPolicy: OnFailure containers: - - name: cloudflare-ddns - image: ghcr.io/onedr0p/kubernetes-kubectl:1.25.3 + - name: *app + image: ghcr.io/onedr0p/kubernetes-kubectl:1.25.3@sha256:e1f54416c4f8779f748ba4a8d7d48d489b584e8963ee8b84310e19d6e2f0430e envFrom: - secretRef: - name: cloudflare-ddns + name: *app command: - "/bin/bash" - - "/app/cloudflare-ddns.sh" + - &scriptPath "/app/cloudflare-ddns.sh" volumeMounts: - - name: cloudflare-ddns - mountPath: /app/cloudflare-ddns.sh - subPath: cloudflare-ddns.sh + - name: *app + mountPath: *scriptPath + subPath: &scriptName cloudflare-ddns.sh readOnly: true volumes: - - name: cloudflare-ddns + - name: *app projected: defaultMode: 0775 sources: - configMap: - name: cloudflare-ddns + name: *app items: - - key: cloudflare-ddns.sh - path: cloudflare-ddns.sh + - key: *scriptName + path: *scriptName diff --git a/cluster/apps/networking/ingress-nginx/helm-release.yaml b/cluster/apps/networking/ingress-nginx/helm-release.yaml index 45b555ac..21816331 100644 --- a/cluster/apps/networking/ingress-nginx/helm-release.yaml +++ b/cluster/apps/networking/ingress-nginx/helm-release.yaml @@ -24,7 +24,9 @@ spec: retries: 5 dependsOn: - name: cert-manager - namespace: kube-system + namespace: networking + - name: cert-manager-issuers + namespace: networking values: controller: replicaCount: 1 diff --git a/cluster/apps/networking/metallb/config.yaml b/cluster/apps/networking/metallb/config.yaml deleted file mode 100644 index 7c646df4..00000000 --- a/cluster/apps/networking/metallb/config.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- -apiVersion: metallb.io/v1beta1 -kind: L2Advertisement -metadata: - name: l2-ip - namespace: networking -spec: - ipAddressPools: - - default-pool ---- -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool -metadata: - name: default-pool - namespace: networking -spec: - addresses: - - "${METALLB_LB_RANGE}" diff --git a/cluster/apps/networking/metallb/config/helm-release.yaml b/cluster/apps/networking/metallb/config/helm-release.yaml new file mode 100644 index 00000000..57929208 --- /dev/null +++ b/cluster/apps/networking/metallb/config/helm-release.yaml @@ -0,0 +1,45 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: metallb-config + namespace: networking +spec: + interval: 15m + chart: + spec: + chart: raw + version: v0.3.1 + sourceRef: + kind: HelmRepository + name: dysnix + namespace: flux-system + install: + createNamespace: true + remediation: + retries: 5 + upgrade: + remediation: + retries: 5 + dependsOn: + - name: metallb + namespace: networking + values: + resources: + - apiVersion: metallb.io/v1beta1 + kind: L2Advertisement + metadata: + name: l2-ip + namespace: networking + spec: + ipAddressPools: + - default-pool + + - apiVersion: metallb.io/v1beta1 + kind: IPAddressPool + metadata: + name: default-pool + namespace: networking + spec: + addresses: + - "${METALLB_LB_RANGE}" diff --git a/cluster/apps/kube-system/cert-manager/kustomization.yaml b/cluster/apps/networking/metallb/config/kustomization.yaml similarity index 100% rename from cluster/apps/kube-system/cert-manager/kustomization.yaml rename to cluster/apps/networking/metallb/config/kustomization.yaml diff --git a/cluster/apps/networking/metallb/helm-release.yaml b/cluster/apps/networking/metallb/helm-release.yaml index 86cdc281..1f12fc27 100644 --- a/cluster/apps/networking/metallb/helm-release.yaml +++ b/cluster/apps/networking/metallb/helm-release.yaml @@ -22,7 +22,7 @@ spec: remediation: retries: 5 values: + crds: + enabled: true psp: create: false - crds: - enabled: false diff --git a/cluster/apps/networking/metallb/kustomization.yaml b/cluster/apps/networking/metallb/kustomization.yaml index b7af5433..92745563 100644 --- a/cluster/apps/networking/metallb/kustomization.yaml +++ b/cluster/apps/networking/metallb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - helm-release.yaml - - config.yaml + - config diff --git a/cluster/apps/kube-system/kured/helm-release.yaml b/cluster/apps/system-upgrade/kured/helm-release.yaml similarity index 95% rename from cluster/apps/kube-system/kured/helm-release.yaml rename to cluster/apps/system-upgrade/kured/helm-release.yaml index cdb6da8a..c7b2815c 100644 --- a/cluster/apps/kube-system/kured/helm-release.yaml +++ b/cluster/apps/system-upgrade/kured/helm-release.yaml @@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease metadata: name: kured - namespace: kube-system + namespace: system-upgrade spec: interval: 15m chart: diff --git a/cluster/apps/kube-system/reloader/kustomization.yaml b/cluster/apps/system-upgrade/kured/kustomization.yaml similarity index 100% rename from cluster/apps/kube-system/reloader/kustomization.yaml rename to cluster/apps/system-upgrade/kured/kustomization.yaml diff --git a/cluster/apps/system-upgrade/kustomization.yaml b/cluster/apps/system-upgrade/kustomization.yaml index 65b36143..b8ec373c 100644 --- a/cluster/apps/system-upgrade/kustomization.yaml +++ b/cluster/apps/system-upgrade/kustomization.yaml @@ -3,4 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - namespace.yaml + # renovate: datasource=docker image=rancher/system-upgrade-controller + - https://github.com/rancher/system-upgrade-controller/releases/download/v0.9.1/crd.yaml - system-upgrade-controller + - kured diff --git a/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml b/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml index 79114b7b..67d9f4ba 100644 --- a/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml +++ b/cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml @@ -6,11 +6,7 @@ resources: - plans images: - name: rancher/system-upgrade-controller - newName: docker.io/rancher/system-upgrade-controller newTag: v0.9.1 -commonLabels: - app.kubernetes.io/name: system-upgrade-controller - app.kubernetes.io/instance: system-upgrade-controller patchesStrategicMerge: # Delete namespace resource - | @@ -19,3 +15,13 @@ patchesStrategicMerge: kind: Namespace metadata: name: system-upgrade + # Add labels + - |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: system-upgrade-controller + namespace: system-upgrade + labels: + app.kubernetes.io/name: system-upgrade-controller + app.kubernetes.io/instance: system-upgrade-controller diff --git a/cluster/charts/dysnix-charts.yaml b/cluster/charts/dysnix-charts.yaml new file mode 100644 index 00000000..ce01a64b --- /dev/null +++ b/cluster/charts/dysnix-charts.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1beta2 +kind: HelmRepository +metadata: + name: dysnix + namespace: flux-system +spec: + interval: 1h + url: https://dysnix.github.io/charts diff --git a/cluster/charts/kustomization.yaml b/cluster/charts/kustomization.yaml index 32680d81..160e1cd1 100644 --- a/cluster/charts/kustomization.yaml +++ b/cluster/charts/kustomization.yaml @@ -4,6 +4,7 @@ kind: Kustomization resources: - bitnami-charts.yaml - bjw-s-charts.yaml + - dysnix-charts.yaml - external-dns-charts.yaml - hajimari-charts.yaml - ingress-nginx-charts.yaml diff --git a/cluster/core/cluster-issuers/kustomization.yaml b/cluster/core/cluster-issuers/kustomization.yaml deleted file mode 100644 index c6491fd6..00000000 --- a/cluster/core/cluster-issuers/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - letsencrypt-production.yaml - - letsencrypt-staging.yaml - - secret.sops.yaml diff --git a/cluster/core/cluster-issuers/letsencrypt-production.yaml b/cluster/core/cluster-issuers/letsencrypt-production.yaml deleted file mode 100644 index 1f880a85..00000000 --- a/cluster/core/cluster-issuers/letsencrypt-production.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: "${SECRET_CLOUDFLARE_EMAIL}" - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: "${SECRET_CLOUDFLARE_EMAIL}" - apiKeySecretRef: - name: cloudflare-api-key - key: api-key - selector: - dnsZones: - - ${SECRET_DOMAIN} diff --git a/cluster/core/cluster-issuers/letsencrypt-staging.yaml b/cluster/core/cluster-issuers/letsencrypt-staging.yaml deleted file mode 100644 index 0d08a792..00000000 --- a/cluster/core/cluster-issuers/letsencrypt-staging.yaml +++ /dev/null @@ -1,21 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - email: "${SECRET_CLOUDFLARE_EMAIL}" - privateKeySecretRef: - name: letsencrypt-staging - solvers: - - dns01: - cloudflare: - email: "${SECRET_CLOUDFLARE_EMAIL}" - apiKeySecretRef: - name: cloudflare-api-key - key: api-key - selector: - dnsZones: - - ${SECRET_DOMAIN} diff --git a/cluster/crds/cert-manager/kustomization.yaml b/cluster/crds/cert-manager/kustomization.yaml deleted file mode 100644 index 3c63707d..00000000 --- a/cluster/crds/cert-manager/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # renovate: datasource=docker image=quay.io/jetstack/cert-manager-controller - - https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.crds.yaml diff --git a/cluster/crds/kustomization.yaml b/cluster/crds/kustomization.yaml deleted file mode 100644 index 0e7d6d6f..00000000 --- a/cluster/crds/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - cert-manager - - system-upgrade-controller - - metallb diff --git a/cluster/crds/metallb/crds.yaml b/cluster/crds/metallb/crds.yaml deleted file mode 100644 index 9dd0138c..00000000 --- a/cluster/crds/metallb/crds.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: source.toolkit.fluxcd.io/v1beta2 -kind: GitRepository -metadata: - name: metallb-source - namespace: flux-system -spec: - interval: 12h - url: https://github.com/metallb/metallb.git - ref: - # renovate: registryUrl=https://metallb.github.io/metallb chart=metallb - tag: 0.13.7 - ignore: | - # exclude all - /* - # include crd directory - !/config/crd ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 -kind: Kustomization -metadata: - name: crds-metallb - namespace: flux-system -spec: - interval: 30m - prune: false - wait: true - sourceRef: - kind: GitRepository - name: metallb-source diff --git a/cluster/crds/system-upgrade-controller/kustomization.yaml b/cluster/crds/system-upgrade-controller/kustomization.yaml deleted file mode 100644 index f93e9e65..00000000 --- a/cluster/crds/system-upgrade-controller/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - # renovate: datasource=docker image=rancher/system-upgrade-controller - - https://github.com/rancher/system-upgrade-controller/releases/download/v0.9.1/crd.yaml diff --git a/cluster/flux/apps.yaml b/cluster/flux/apps.yaml index 2448d389..0af2a00c 100644 --- a/cluster/flux/apps.yaml +++ b/cluster/flux/apps.yaml @@ -5,14 +5,15 @@ metadata: name: apps namespace: flux-system spec: - interval: 10m + interval: 30m path: ./cluster/apps prune: true sourceRef: kind: GitRepository name: flux-cluster dependsOn: - - name: core + - name: config + - name: charts decryption: provider: sops secretRef: diff --git a/cluster/flux/charts.yaml b/cluster/flux/charts.yaml index 02733619..453e5a40 100644 --- a/cluster/flux/charts.yaml +++ b/cluster/flux/charts.yaml @@ -5,7 +5,7 @@ metadata: name: charts namespace: flux-system spec: - interval: 10m + interval: 30m path: ./cluster/charts prune: true sourceRef: diff --git a/cluster/flux/config.yaml b/cluster/flux/config.yaml index e8285d28..dd00f930 100644 --- a/cluster/flux/config.yaml +++ b/cluster/flux/config.yaml @@ -5,7 +5,7 @@ metadata: name: config namespace: flux-system spec: - interval: 10m + interval: 30m path: ./cluster/config prune: true sourceRef: diff --git a/cluster/flux/core.yaml b/cluster/flux/core.yaml deleted file mode 100644 index a6d441d0..00000000 --- a/cluster/flux/core.yaml +++ /dev/null @@ -1,27 +0,0 @@ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 -kind: Kustomization -metadata: - name: core - namespace: flux-system -spec: - interval: 10m - path: ./cluster/core - prune: false - sourceRef: - kind: GitRepository - name: flux-cluster - dependsOn: - - name: charts - - name: config - - name: crds - decryption: - provider: sops - secretRef: - name: sops-age - postBuild: - substituteFrom: - - kind: ConfigMap - name: cluster-settings - - kind: Secret - name: cluster-secrets diff --git a/cluster/flux/crds.yaml b/cluster/flux/crds.yaml deleted file mode 100644 index 74113f25..00000000 --- a/cluster/flux/crds.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 -kind: Kustomization -metadata: - name: crds - namespace: flux-system -spec: - interval: 10m - path: ./cluster/crds - prune: false - sourceRef: - kind: GitRepository - name: flux-cluster diff --git a/configure b/configure index 99657b2a..34ac43a7 100755 --- a/configure +++ b/configure @@ -53,14 +53,14 @@ main() { envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \ > "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml" envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \ - > "${PROJECT_DIR}/cluster/core/cluster-issuers/secret.sops.yaml" + > "${PROJECT_DIR}/cluster/apps/networking/cert-manager/issuers/secret.sops.yaml" envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \ > "${PROJECT_DIR}/cluster/apps/networking/cloudflare-ddns/secret.sops.yaml" envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \ > "${PROJECT_DIR}/cluster/apps/networking/external-dns/secret.sops.yaml" # encrypt cluster secrets sops --encrypt --in-place "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml" - sops --encrypt --in-place "${PROJECT_DIR}/cluster/core/cluster-issuers/secret.sops.yaml" + sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/cert-manager/issuers/secret.sops.yaml" sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/cloudflare-ddns/secret.sops.yaml" sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/external-dns/secret.sops.yaml" # generate terraform secrets diff --git a/provision/ansible/inventory/group_vars/kubernetes/os.yml b/provision/ansible/inventory/group_vars/kubernetes/os.yml index ed7cef53..db0aee21 100644 --- a/provision/ansible/inventory/group_vars/kubernetes/os.yml +++ b/provision/ansible/inventory/group_vars/kubernetes/os.yml @@ -9,6 +9,7 @@ packages: - "https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-{{ ansible_distribution_major_version }}.noarch.rpm" - "https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-{{ ansible_distribution_major_version }}.noarch.rpm" - dnf-automatic + - dnf-plugin-system-upgrade - dnf-utils - hdparm - htop diff --git a/tmpl/cluster/flux-cluster.yaml b/tmpl/cluster/flux-cluster.yaml index 2615833d..b7dde180 100644 --- a/tmpl/cluster/flux-cluster.yaml +++ b/tmpl/cluster/flux-cluster.yaml @@ -5,7 +5,7 @@ metadata: name: flux-cluster namespace: flux-system spec: - interval: 10m + interval: 30m ref: branch: main url: ${BOOTSTRAP_GIT_REPOSITORY} @@ -16,7 +16,7 @@ metadata: name: flux-cluster namespace: flux-system spec: - interval: 10m + interval: 30m path: ./cluster/flux prune: true wait: false