infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: update jinja delimiters back to default (#1269)

Browse Source 
* feat: update jinja delimiters back to default

Signed-off-by: Devin Buhl <devin@buhl.casa>

* feat: remove cert-manager promrules

Signed-off-by: Devin Buhl <devin@buhl.casa>

* fix: update talos csr approver

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-29 17:11:37 -05:00
1 parent 5fa8b9685a
commit df642e5425
55 files changed
+295 -358
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bootstrap/templates/.sops.yaml.j2
+9 -9
View File
@@ -1,22 +1,22 @@
#% if flux.enabled %# {% if flux.enabled %}
--- ---
creation_rules: creation_rules:
#% if distribution in ['talos'] %# {% if distribution in ['talos'] %}
- # IMPORTANT: This rule MUST be above the others - # IMPORTANT: This rule MUST be above the others
path_regex: talos/.*\.sops\.ya?ml path_regex: talos/.*\.sops\.ya?ml
key_groups: key_groups:
- age: - age:
- "#{ flux.sops_age_public_key }#" - "{{ flux.sops_age_public_key }}"
#% endif %# {% endif %}
- path_regex: kubernetes/.*\.sops\.ya?ml - path_regex: kubernetes/.*\.sops\.ya?ml
encrypted_regex: "^(data|stringData)$" encrypted_regex: "^(data|stringData)$"
key_groups: key_groups:
- age: - age:
- "#{ flux.sops_age_public_key }#" - "{{ flux.sops_age_public_key }}"
#% if distribution in ['k0s', 'k3s'] %# {% if distribution in ['k0s', 'k3s'] %}
- path_regex: ansible/.*\.sops\.ya?ml - path_regex: ansible/.*\.sops\.ya?ml
key_groups: key_groups:
- age: - age:
- "#{ flux.sops_age_public_key }#" - "{{ flux.sops_age_public_key }}"
#% endif %# {% endif %}
#% endif %# {% endif %}
bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2
+1 -1
View File
@@ -2,7 +2,7 @@
k3s_become: true k3s_become: true
k3s_etcd_datastore: true k3s_etcd_datastore: true
k3s_install_hard_links: true k3s_install_hard_links: true
k3s_registration_address: "#{ cluster.endpoint_vip }#" k3s_registration_address: "{{ cluster.endpoint_vip }}"
# renovate: datasource=github-releases depName=k3s-io/k3s # renovate: datasource=github-releases depName=k3s-io/k3s
k3s_release_version: v1.29.0+k3s1 k3s_release_version: v1.29.0+k3s1
k3s_server_manifests_templates: k3s_server_manifests_templates:
bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
+15 -15
View File
@@ -1,13 +1,13 @@
--- ---
k3s_control_node: true k3s_control_node: true
k3s_server: k3s_server:
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
cluster-cidr: "#{ cluster.pod_network.split(',')[0] }#,#{ cluster.pod_network.split(',')[1] }#" cluster-cidr: "{{ cluster.pod_network.split(',')[0] }},{{ cluster.pod_network.split(',')[1] }}"
service-cidr: "#{ cluster.service_network.split(',')[0] }#,#{ cluster.service_network.split(',')[1] }#" service-cidr: "{{ cluster.service_network.split(',')[0] }},{{ cluster.service_network.split(',')[1] }}"
#% else %# {% else %}
cluster-cidr: "#{ cluster.pod_network }#" cluster-cidr: "{{ cluster.pod_network }}"
service-cidr: "#{ cluster.service_network }#" service-cidr: "{{ cluster.service_network }}"
#% endif %# {% endif %}
disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"] disable: ["flannel", "local-storage", "metrics-server", "servicelb", "traefik"]
disable-cloud-controller: true disable-cloud-controller: true
disable-kube-proxy: true disable-kube-proxy: true
@@ -24,16 +24,16 @@ k3s_server:
kubelet-arg: kubelet-arg:
- "image-gc-high-threshold=55" - "image-gc-high-threshold=55"
- "image-gc-low-threshold=50" - "image-gc-low-threshold=50"
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
#% else %# {% else %}
node-ip: "{{ ansible_host }}" node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
#% endif %# {% endif %}
pause-image: registry.k8s.io/pause:3.9 pause-image: registry.k8s.io/pause:3.9
secrets-encryption: true secrets-encryption: true
tls-san: tls-san:
- "#{ cluster.endpoint_vip }#" - "{{ cluster.endpoint_vip }}"
#% for item in cluster.tls_sans %# {% for item in cluster.tls_sans %}
- "{{ item }}" - "{{ item }}"
#% endfor %# {% endfor %}
write-kubeconfig-mode: "644" write-kubeconfig-mode: "644"
bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2
+5 -5
View File
@@ -4,9 +4,9 @@ k3s_agent:
kubelet-arg: kubelet-arg:
- "image-gc-high-threshold=55" - "image-gc-high-threshold=55"
- "image-gc-low-threshold=50" - "image-gc-low-threshold=50"
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}" node-ip: "{% raw %}{{ ansible_host }}{% endraw %},{% raw %}{{ ansible_default_ipv6.address }}{% endraw %}"
#% else %# {% else %}
node-ip: "{{ ansible_host }}" node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
#% endif %# {% endif %}
pause-image: registry.k8s.io/pause:3.9 pause-image: registry.k8s.io/pause:3.9
bootstrap/templates/ansible/inventory/hosts.yaml.j2
+16 -16
View File
@@ -3,21 +3,21 @@ kubernetes:
children: children:
master: master:
hosts: hosts:
#% for item in cluster.nodes.inventory %# {% for item in cluster.nodes.inventory %}
#% if item.controller %# {% if item.controller %}
"#{ item.name }#": "{{ item.name }}":
ansible_user: "#{ item.ssh_username }#" ansible_user: "{{ item.ssh_username }}"
ansible_host: "#{ item.address }#" ansible_host: "{{ item.address }}"
#% endif %# {% endif %}
#% endfor %# {% endfor %}
#% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %# {% if cluster.nodes.inventory | selectattr('controller', 'equalto', False) | list | length %}
worker: worker:
hosts: hosts:
#% for item in cluster.nodes.inventory %# {% for item in cluster.nodes.inventory %}
#% if not item.controller %# {% if not item.controller %}
"#{ item.name }#": "{{ item.name }}":
ansible_user: "#{ item.ssh_username }#" ansible_user: "{{ item.ssh_username }}"
ansible_host: "#{ item.address }#" ansible_host: "{{ item.address }}"
#% endif %# {% endif %}
#% endfor %# {% endfor %}
#% endif %# {% endif %}
bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2
+5 -5
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
--- ---
- name: Cluster Installation - name: Cluster Installation
hosts: kubernetes hosts: kubernetes
@@ -39,9 +39,9 @@
or k3s_server_manifests_urls | length > 0) or k3s_server_manifests_urls | length > 0)
kubernetes.core.k8s_info: kubernetes.core.k8s_info:
kubeconfig: /etc/rancher/k3s/k3s.yaml kubeconfig: /etc/rancher/k3s/k3s.yaml
kind: "{{ item.kind }}" kind: "{% raw %}{{ item.kind }}{% endraw %}"
name: "{{ item.name }}" name: "{% raw %}{{ item.name }}{% endraw %}"
namespace: "{{ item.namespace | default('') }}" namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
wait: true wait: true
wait_sleep: 10 wait_sleep: 10
wait_timeout: 360 wait_timeout: 360
@@ -55,4 +55,4 @@
- name: Cruft - name: Cruft
when: k3s_primary_control_node when: k3s_primary_control_node
ansible.builtin.include_tasks: tasks/cruft.yaml ansible.builtin.include_tasks: tasks/cruft.yaml
#% endif %# {% endif %}
bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2
+6 -6
View File
@@ -10,20 +10,20 @@
ansible.builtin.pause: ansible.builtin.pause:
seconds: 5 seconds: 5
tasks: tasks:
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
- name: Ensure Kubernetes is running - name: Ensure Kubernetes is running
ansible.builtin.include_role: ansible.builtin.include_role:
name: xanmanning.k3s name: xanmanning.k3s
public: true public: true
vars: vars:
k3s_state: started k3s_state: started
#% endif %# {% endif %}
- name: Upgrade kube-vip - name: Upgrade kube-vip
ansible.builtin.template: ansible.builtin.template:
src: templates/kube-vip-ds.yaml.j2 src: templates/kube-vip-ds.yaml.j2
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
dest: "{{ k3s_server_manifests_dir }}/kube-vip-ds.yaml" dest: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}/kube-vip-ds.yaml"
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml" dest: "/var/lib/k0s/manifests/kube-vip/kube-vip-ds.yaml"
#% endif %# {% endif %}
mode: preserve mode: preserve
bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2
+7 -7
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
--- ---
- name: Cluster Nuke - name: Cluster Nuke
hosts: kubernetes hosts: kubernetes
@@ -37,17 +37,17 @@
block: block:
- name: Networking | Delete Cilium links - name: Networking | Delete Cilium links
ansible.builtin.command: ansible.builtin.command:
cmd: "ip link delete {{ item }}" cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
removes: "/sys/class/net/{{ item }}" removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
loop: ["cilium_host", "cilium_net", "cilium_vxlan"] loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
- name: Networking | Flush iptables - name: Networking | Flush iptables
ansible.builtin.iptables: ansible.builtin.iptables:
table: "{{ item }}" table: "{% raw %}{{ item }}{% endraw %}"
flush: true flush: true
loop: ["filter", "nat", "mangle", "raw"] loop: ["filter", "nat", "mangle", "raw"]
- name: Networking | Flush ip6tables - name: Networking | Flush ip6tables
ansible.builtin.iptables: ansible.builtin.iptables:
table: "{{ item }}" table: "{% raw %}{{ item }}{% endraw %}"
flush: true flush: true
ip_version: ipv6 ip_version: ipv6
loop: ["filter", "nat", "mangle", "raw"] loop: ["filter", "nat", "mangle", "raw"]
@@ -87,7 +87,7 @@
- k3s_install_hard_links - k3s_install_hard_links
- not ansible_check_mode - not ansible_check_mode
ansible.builtin.file: ansible.builtin.file:
path: "{{ k3s_install_dir }}/{{ item }}" path: "{% raw %}{{ k3s_install_dir }}{% endraw %}/{% raw %}{{ item }}{% endraw %}"
state: absent state: absent
loop: ["kubectl", "crictl", "ctr"] loop: ["kubectl", "crictl", "ctr"]
@@ -100,4 +100,4 @@
ansible.builtin.reboot: ansible.builtin.reboot:
msg: Rebooting hosts msg: Rebooting hosts
reboot_timeout: 3600 reboot_timeout: 3600
#% endif %# {% endif %}
bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2
+15 -15
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
--- ---
- name: Prepare System - name: Prepare System
hosts: kubernetes hosts: kubernetes
@@ -16,7 +16,7 @@
block: block:
- name: Locale | Set timezone - name: Locale | Set timezone
community.general.timezone: community.general.timezone:
name: "#{ timezone }#" name: "{{ timezone }}"
- name: Packages - name: Packages
block: block:
@@ -33,12 +33,12 @@
block: block:
- name: Network Configuration | Set hostname - name: Network Configuration | Set hostname
ansible.builtin.hostname: ansible.builtin.hostname:
name: "{{ inventory_hostname }}" name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
- name: Network Configuration | Update hosts - name: Network Configuration | Update hosts
ansible.builtin.copy: ansible.builtin.copy:
content: | content: |
127.0.0.1 localhost 127.0.0.1 localhost
127.0.1.1 {{ inventory_hostname }} 127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
# The following lines are desirable for IPv6 capable hosts # The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback ::1 localhost ip6-localhost ip6-loopback
@@ -62,10 +62,10 @@
mode: '0644' mode: '0644'
dest: /etc/resolv.conf dest: /etc/resolv.conf
content: | content: |
search #{ cluster.nodes.search_domain|default('.', true) }# search {{ cluster.nodes.search_domain|default('.', true) }}
#% for item in cluster.nodes.dns_servers %# {% for item in cluster.nodes.dns_servers %}
nameserver #{ item }# nameserver {{ item }}
#% endfor %# {% endfor %}
- name: System Configuration - name: System Configuration
notify: Reboot notify: Reboot
@@ -78,15 +78,15 @@
masked: true masked: true
- name: System Configuration | Disable swap - name: System Configuration | Disable swap
ansible.posix.mount: ansible.posix.mount:
name: "{{ item }}" name: "{% raw %}{{ item }}{% endraw %}"
fstype: swap fstype: swap
state: absent state: absent
loop: ["none", "swap"] loop: ["none", "swap"]
- name: System Configuration | Create Kernel modules - name: System Configuration | Create Kernel modules
ansible.builtin.copy: ansible.builtin.copy:
dest: "/etc/modules-load.d/{{ item }}.conf" dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
mode: "0644" mode: "0644"
content: "{{ item }}" content: "{% raw %}{{ item }}{% endraw %}"
loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"] loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
register: modules_status register: modules_status
- name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler - name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
@@ -96,11 +96,11 @@
state: restarted state: restarted
- name: System Configuration | Sysctl - name: System Configuration | Sysctl
ansible.posix.sysctl: ansible.posix.sysctl:
name: "{{ item.key }}" name: "{% raw %}{{ item.key }}{% endraw %}"
value: "{{ item.value }}" value: "{% raw %}{{ item.value }}{% endraw %}"
sysctl_file: /etc/sysctl.d/99-kubernetes.conf sysctl_file: /etc/sysctl.d/99-kubernetes.conf
reload: true reload: true
with_dict: "{{ sysctl_config }}" with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
vars: vars:
sysctl_config: sysctl_config:
fs.inotify.max_queued_events: 65536 fs.inotify.max_queued_events: 65536
@@ -112,4 +112,4 @@
ansible.builtin.reboot: ansible.builtin.reboot:
msg: Rebooting hosts msg: Rebooting hosts
reboot_timeout: 3600 reboot_timeout: 3600
#% endif %# {% endif %}
bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2
+21 -21
View File
@@ -12,13 +12,13 @@
seconds: 5 seconds: 5
tasks: tasks:
- name: Details - name: Details
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json" ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json" ansible.builtin.command: "k0s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
#% endif %# {% endif %}
register: kubectl_get_node register: kubectl_get_node
delegate_to: "{{ groups['master'][0] }}" delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
failed_when: false failed_when: false
changed_when: false changed_when: false
@@ -31,23 +31,23 @@
block: block:
- name: Cordon - name: Cordon
kubernetes.core.k8s_drain: kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}" name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
kubeconfig: /etc/rancher/k3s/k3s.yaml kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
kubeconfig: /var/lib/k0s/pki/admin.conf kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %# {% endif %}
state: cordon state: cordon
delegate_to: "{{ groups['master'][0] }}" delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
- name: Drain - name: Drain
kubernetes.core.k8s_drain: kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}" name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
kubeconfig: /etc/rancher/k3s/k3s.yaml kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
kubeconfig: /var/lib/k0s/pki/admin.conf kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %# {% endif %}
state: drain state: drain
delete_options: delete_options:
delete_emptydir_data: true delete_emptydir_data: true
@@ -56,7 +56,7 @@
wait_timeout: 900 wait_timeout: 900
pod_selectors: pod_selectors:
- app!=rook-ceph-osd # Rook Ceph - app!=rook-ceph-osd # Rook Ceph
delegate_to: "{{ groups['master'][0] }}" delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
- name: Update - name: Update
ansible.builtin.apt: ansible.builtin.apt:
@@ -77,11 +77,11 @@
- name: Uncordon - name: Uncordon
kubernetes.core.k8s_drain: kubernetes.core.k8s_drain:
name: "{{ inventory_hostname }}" name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
kubeconfig: /etc/rancher/k3s/k3s.yaml kubeconfig: /etc/rancher/k3s/k3s.yaml
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
kubeconfig: /var/lib/k0s/pki/admin.conf kubeconfig: /var/lib/k0s/pki/admin.conf
#% endif %# {% endif %}
state: uncordon state: uncordon
delegate_to: "{{ groups['master'][0] }}" delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2
+5 -5
View File
@@ -4,7 +4,7 @@
block: block:
- name: Cruft | Get list of custom manifests - name: Cruft | Get list of custom manifests
ansible.builtin.find: ansible.builtin.find:
paths: "{{ k3s_server_manifests_dir }}" paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
file_type: file file_type: file
use_regex: true use_regex: true
patterns: ["^custom-.*"] patterns: ["^custom-.*"]
@@ -12,9 +12,9 @@
- name: Cruft | Delete custom manifests - name: Cruft | Delete custom manifests
ansible.builtin.file: ansible.builtin.file:
path: "{{ item.path }}" path: "{% raw %}{{ item.path }}{% endraw %}"
state: absent state: absent
loop: "{{ custom_manifest.files }}" loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
- name: Cruft | Get list of custom addons - name: Cruft | Get list of custom addons
kubernetes.core.k8s_info: kubernetes.core.k8s_info:
@@ -25,8 +25,8 @@
- name: Cruft | Delete addons - name: Cruft | Delete addons
kubernetes.core.k8s: kubernetes.core.k8s:
kubeconfig: /etc/rancher/k3s/k3s.yaml kubeconfig: /etc/rancher/k3s/k3s.yaml
name: "{{ item.metadata.name }}" name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
kind: Addon kind: Addon
namespace: kube-system namespace: kube-system
state: absent state: absent
loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}" loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2
+3 -3
View File
@@ -13,7 +13,7 @@
when: k3s_primary_control_node when: k3s_primary_control_node
ansible.builtin.fetch: ansible.builtin.fetch:
src: /etc/rancher/k3s/k3s.yaml src: /etc/rancher/k3s/k3s.yaml
dest: "{{ repository_path.stdout }}/kubeconfig" dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
flat: true flat: true
- name: Update kubeconfig with the correct load balancer address - name: Update kubeconfig with the correct load balancer address
@@ -21,6 +21,6 @@
become: false become: false
run_once: true run_once: true
ansible.builtin.replace: ansible.builtin.replace:
path: "{{ repository_path.stdout }}/kubeconfig" path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
regexp: https://127.0.0.1:6443 regexp: https://127.0.0.1:6443
replace: "https://{{ k3s_registration_address }}:6443" replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2
+3 -3
View File
@@ -13,6 +13,6 @@ spec:
targetNamespace: kube-system targetNamespace: kube-system
bootstrap: true bootstrap: true
valuesContent: |- valuesContent: |-
#% filter indent(width=4, first=True) %# {% filter indent(width=4, first=True) %}
#% include 'partials/cilium-values-init.partial.yaml.j2' %# {% include 'partials/cilium-values-init.partial.yaml.j2' %}
#% endfilter %# {% endfilter %}
bootstrap/templates/ansible/playbooks/templates/kube-vip-ds.yaml.j2
+1 -1
View File
@@ -1,2 +1,2 @@
--- ---
#% include 'partials/kube-vip-ds.partial.yaml.j2' %# {% include 'partials/kube-vip-ds.partial.yaml.j2' %}
bootstrap/templates/ansible/playbooks/templates/kube-vip-rbac.yaml.j2
+1 -1
View File
@@ -1,2 +1,2 @@
--- ---
#% include 'partials/kube-vip-rbac.partial.yaml.j2' %# {% include 'partials/kube-vip-rbac.partial.yaml.j2' %}
bootstrap/templates/ansible/requirements.yaml.j2
+2 -2
View File
@@ -8,9 +8,9 @@ collections:
version: 8.2.0 version: 8.2.0
- name: kubernetes.core - name: kubernetes.core
version: 3.0.0 version: 3.0.0
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
roles: roles:
- name: xanmanning.k3s - name: xanmanning.k3s
src: https://github.com/PyratLabs/ansible-role-k3s src: https://github.com/PyratLabs/ansible-role-k3s
version: v3.4.4 version: v3.4.4
#% endif %# {% endif %}
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2
-1
View File
@@ -3,4 +3,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./helmrelease.yaml - ./helmrelease.yaml
- ./prometheusrule.yaml
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2
-59
View File
@@ -1,59 +0,0 @@
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-manager.rules
spec:
groups:
- name: cert-manager
rules:
- alert: CertManagerAbsent
expr: |
absent(up{job="cert-manager"})
for: 15m
labels:
severity: critical
annotations:
description: >
New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
summary: "Cert Manager has dissapeared from Prometheus service discovery."
- name: certificates
rules:
- alert: CertManagerCertExpirySoon
expr: |
avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
for: 15m
labels:
severity: warning
annotations:
description: >
The domain that this cert covers will be unavailable after {{ $value | humanizeDuration }}.
Clients using endpoints that this cert protects will start to fail in {{ $value | humanizeDuration }}.
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
summary: |
The cert {{ $labels.name }} is {{ $value | humanizeDuration }} from expiry, it should have renewed over a week ago.
- alert: CertManagerCertNotReady
expr: |
max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
for: 15m
labels:
severity: critical
annotations:
description: >
This certificate has not been ready to serve traffic for at least
10m. If the cert is being renewed or there is another valid cert, the ingress
controller _may_ be able to serve that instead.
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
summary: "The cert {{ $labels.name }} is not ready to serve traffic."
- alert: CertManagerHittingRateLimits
expr: |
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
for: 15m
labels:
severity: critical
annotations:
description: >
Depending on the rate limit, cert-manager may be unable to generate certificates for up to a week.
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
summary: "Cert manager hitting LetsEncrypt rate limits."
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata: metadata:
name: cert-manager-secret name: cert-manager-secret
stringData: stringData:
api-token: "#{ cloudflare.token }#" api-token: "{{ cloudflare.token }}"
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
+2 -2
View File
@@ -18,7 +18,7 @@ spec:
interval: 30m interval: 30m
retryInterval: 1m retryInterval: 1m
timeout: 5m timeout: 5m
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
--- ---
apiVersion: kustomize.toolkit.fluxcd.io/v1 apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization kind: Kustomization
@@ -41,4 +41,4 @@ spec:
interval: 30m interval: 30m
retryInterval: 1m retryInterval: 1m
timeout: 5m timeout: 5m
#% endif %# {% endif %}
bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/ingress.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
@@ -22,4 +22,4 @@ spec:
tls: tls:
- hosts: - hosts:
- *host - *host
#% endif %# {% endif %}
bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/kustomization.yaml.j2
+2 -2
View File
@@ -3,7 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./secret.sops.yaml - ./secret.sops.yaml
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
- ./ingress.yaml - ./ingress.yaml
#% endif %# {% endif %}
- ./receiver.yaml - ./receiver.yaml
bootstrap/templates/kubernetes/apps/flux-system/webhooks/app/github/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata: metadata:
name: github-webhook-token-secret name: github-webhook-token-secret
stringData: stringData:
token: "#{ flux.github.webhook.token }#" token: "{{ flux.github.webhook.token }}"
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
+3 -3
View File
@@ -23,6 +23,6 @@ spec:
uninstall: uninstall:
keepHistory: false keepHistory: false
values: values:
#% filter indent(width=4, first=True) %# {% filter indent(width=4, first=True) %}
#% include 'partials/cilium-values-full.partial.yaml.j2' %# {% include 'partials/cilium-values-full.partial.yaml.j2' %}
#% endfilter %# {% endfilter %}
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
+2 -2
View File
@@ -2,7 +2,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
#% if not feature_gates.dual_stack_ipv4_first %# {% if not feature_gates.dual_stack_ipv4_first %}
- ./cilium-l2.yaml - ./cilium-l2.yaml
#% endif %# {% endif %}
- ./helmrelease.yaml - ./helmrelease.yaml
bootstrap/templates/kubernetes/apps/kube-system/kubelet-csr-approver/app/helmrelease.yaml.j2
+3 -3
View File
@@ -23,6 +23,6 @@ spec:
uninstall: uninstall:
keepHistory: false keepHistory: false
values: values:
#% filter indent(width=4, first=True) %# {% filter indent(width=4, first=True) %}
#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %# {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
#% endfilter %# {% endfilter %}
bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
+4 -4
View File
@@ -4,11 +4,11 @@ kind: Kustomization
resources: resources:
- ./namespace.yaml - ./namespace.yaml
- ./cilium/ks.yaml - ./cilium/ks.yaml
#% if distribution in ['talos'] %# {% if distribution in ['talos'] %}
- ./kubelet-csr-approver/ks.yaml - ./kubelet-csr-approver/ks.yaml
#% endif %# {% endif %}
- ./metrics-server/ks.yaml - ./metrics-server/ks.yaml
#% if distribution in ['k0s', 'talos'] %# {% if distribution in ['k0s', 'talos'] %}
- ./spegel/ks.yaml - ./spegel/ks.yaml
#% endif %# {% endif %}
- ./reloader/ks.yaml - ./reloader/ks.yaml
bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2
+3 -3
View File
@@ -24,13 +24,13 @@ spec:
keepHistory: false keepHistory: false
values: values:
spegel: spegel:
#% if distribution in ['k0s'] %# {% if distribution in ['k0s'] %}
containerdSock: /run/k0s/containerd.sock containerdSock: /run/k0s/containerd.sock
containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d containerdRegistryConfigPath: /var/lib/k0s/containerd/certs.d
#% elif distribution in ['talos'] %# {% elif distribution in ['talos'] %}
containerdSock: /run/containerd/containerd.sock containerdSock: /run/containerd/containerd.sock
containerdRegistryConfigPath: /etc/cri/conf.d/hosts containerdRegistryConfigPath: /etc/cri/conf.d/hosts
#% endif %# {% endif %}
service: service:
registry: registry:
hostPort: 29999 hostPort: 29999
bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2
+4 -4
View File
@@ -4,10 +4,10 @@ kind: Secret
metadata: metadata:
name: cloudflared-secret name: cloudflared-secret
stringData: stringData:
TUNNEL_ID: "#{ cloudflare.tunnel.id }#" TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
credentials.json: | credentials.json: |
{ {
"AccountTag": "#{ cloudflare.tunnel.account_id }#", "AccountTag": "{{ cloudflare.tunnel.account_id }}",
"TunnelSecret": "#{ cloudflare.tunnel.secret }#", "TunnelSecret": "{{ cloudflare.tunnel.secret }}",
"TunnelID": "#{ cloudflare.tunnel.id }#" "TunnelID": "{{ cloudflare.tunnel.id }}"
} }
bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2
+2 -2
View File
@@ -70,7 +70,7 @@ spec:
annotations: annotations:
external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}" external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
hosts: hosts:
- host: &host "{{ .Release.Name }}-external.${SECRET_DOMAIN}" - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-external.${SECRET_DOMAIN}"
paths: paths:
- path: / - path: /
service: service:
@@ -83,7 +83,7 @@ spec:
enabled: true enabled: true
className: internal className: internal
hosts: hosts:
- host: &host "{{ .Release.Name }}-internal.${SECRET_DOMAIN}" - host: &host "{% raw %}{{ .Release.Name }}{% endraw %}-internal.${SECRET_DOMAIN}"
paths: paths:
- path: / - path: /
service: service:
bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata: metadata:
name: external-dns-secret name: external-dns-secret
stringData: stringData:
api-token: "#{ cloudflare.token }#" api-token: "{{ cloudflare.token }}"
bootstrap/templates/kubernetes/apps/network/ingress-nginx/certificates/kustomization.yaml.j2
+2 -2
View File
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./staging.yaml - ./staging.yaml
#% if cloudflare.acme.production %# {% if cloudflare.acme.production %}
- ./production.yaml - ./production.yaml
#% endif %# {% endif %}
bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2
Vendored
+4 -4
View File
@@ -32,7 +32,7 @@ spec:
service: service:
annotations: annotations:
external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}" external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
io.cilium/lb-ipam-ips: "#{ cloudflare.tunnel.ingress_vip }#" io.cilium/lb-ipam-ips: "{{ cloudflare.tunnel.ingress_vip }}"
externalTrafficPolicy: Cluster externalTrafficPolicy: Cluster
ingressClassResource: ingressClassResource:
name: external name: external
@@ -64,11 +64,11 @@ spec:
proxy-buffer-size: 16k proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2 ssl-protocols: TLSv1.3 TLSv1.2
extraArgs: extraArgs:
#% if cloudflare.acme.production %# {% if cloudflare.acme.production %}
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
#% else %# {% else %}
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
#% endif %# {% endif %}
topologySpreadConstraints: topologySpreadConstraints:
- maxSkew: 1 - maxSkew: 1
topologyKey: kubernetes.io/hostname topologyKey: kubernetes.io/hostname
bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2
+4 -4
View File
@@ -29,7 +29,7 @@ spec:
replicaCount: 1 replicaCount: 1
service: service:
annotations: annotations:
io.cilium/lb-ipam-ips: "#{ cloudflare.ingress_vip }#" io.cilium/lb-ipam-ips: "{{ cloudflare.ingress_vip }}"
externalTrafficPolicy: Cluster externalTrafficPolicy: Cluster
ingressClassResource: ingressClassResource:
name: internal name: internal
@@ -61,11 +61,11 @@ spec:
proxy-buffer-size: 16k proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2 ssl-protocols: TLSv1.3 TLSv1.2
extraArgs: extraArgs:
#% if cloudflare.acme.production %# {% if cloudflare.acme.production %}
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls" default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
#% else %# {% else %}
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls" default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
#% endif %# {% endif %}
topologySpreadConstraints: topologySpreadConstraints:
- maxSkew: 1 - maxSkew: 1
topologyKey: kubernetes.io/hostname topologyKey: kubernetes.io/hostname
bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2
+1 -1
View File
@@ -30,5 +30,5 @@ spec:
type: LoadBalancer type: LoadBalancer
port: 53 port: 53
annotations: annotations:
io.cilium/lb-ipam-ips: "#{ cloudflare.gateway_vip }#" io.cilium/lb-ipam-ips: "{{ cloudflare.gateway_vip }}"
externalTrafficPolicy: Cluster externalTrafficPolicy: Cluster
bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2
+4 -4
View File
@@ -6,13 +6,13 @@ metadata:
namespace: flux-system namespace: flux-system
spec: spec:
interval: 30m interval: 30m
url: "#{ flux.github.address }#" url: "{{ flux.github.address }}"
#% if flux.github.address.startswith('ssh://') %# {% if flux.github.address.startswith('ssh://') %}
secretRef: secretRef:
name: github-deploy-key name: github-deploy-key
#% endif %# {% endif %}
ref: ref:
branch: "#{ flux.github.branch|default('main', true) }#" branch: "{{ flux.github.branch|default('main', true) }}"
ignore: | ignore: |
# exclude all # exclude all
/* /*
bootstrap/templates/kubernetes/flux/repositories/helm/external-dns.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
--- ---
apiVersion: source.toolkit.fluxcd.io/v1beta2 apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
spec: spec:
interval: 1h interval: 1h
url: https://kubernetes-sigs.github.io/external-dns url: https://kubernetes-sigs.github.io/external-dns
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/repositories/helm/ingress-nginx.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
--- ---
apiVersion: source.toolkit.fluxcd.io/v1beta2 apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
spec: spec:
interval: 1h interval: 1h
url: https://kubernetes.github.io/ingress-nginx url: https://kubernetes.github.io/ingress-nginx
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/repositories/helm/k8s-gateway.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
--- ---
apiVersion: source.toolkit.fluxcd.io/v1beta2 apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
spec: spec:
interval: 1h interval: 1h
url: https://ori-edge.github.io/k8s_gateway url: https://ori-edge.github.io/k8s_gateway
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/repositories/helm/kustomization.yaml.j2
+6 -6
View File
@@ -4,18 +4,18 @@ kind: Kustomization
resources: resources:
- ./bjw-s.yaml - ./bjw-s.yaml
- ./cilium.yaml - ./cilium.yaml
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
- ./external-dns.yaml - ./external-dns.yaml
- ./ingress-nginx.yaml - ./ingress-nginx.yaml
- ./k8s-gateway.yaml - ./k8s-gateway.yaml
#% endif %# {% endif %}
- ./jetstack.yaml - ./jetstack.yaml
- ./metrics-server.yaml - ./metrics-server.yaml
- ./openebs.yaml - ./openebs.yaml
#% if distribution in ['talos'] %# {% if distribution in ['talos'] %}
- ./postfinance.yaml - ./postfinance.yaml
#% endif %# {% endif %}
- ./stakater.yaml - ./stakater.yaml
#% if distribution in ['k0s', 'talos'] %# {% if distribution in ['k0s', 'talos'] %}
- ./xenitab.yaml - ./xenitab.yaml
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/repositories/helm/postfinance.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if distribution in ['talos'] %# {% if distribution in ['talos'] %}
--- ---
apiVersion: source.toolkit.fluxcd.io/v1beta2 apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository kind: HelmRepository
@@ -8,4 +8,4 @@ metadata:
spec: spec:
interval: 1h interval: 1h
url: https://postfinance.github.io/kubelet-csr-approver url: https://postfinance.github.io/kubelet-csr-approver
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/repositories/helm/xenitab.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
#% if distribution in ['k0s', 'talos'] %# {% if distribution in ['k0s', 'talos'] %}
--- ---
apiVersion: source.toolkit.fluxcd.io/v1beta2 apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository kind: HelmRepository
@@ -9,4 +9,4 @@ spec:
type: oci type: oci
interval: 5m interval: 5m
url: oci://ghcr.io/xenitab/helm-charts url: oci://ghcr.io/xenitab/helm-charts
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2
+5 -5
View File
@@ -6,8 +6,8 @@ metadata:
namespace: flux-system namespace: flux-system
stringData: stringData:
SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit... SECRET_EXAMPLE: Neque porro quisquam est qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit...
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
SECRET_DOMAIN: "#{ cloudflare.domain }#" SECRET_DOMAIN: "{{ cloudflare.domain }}"
SECRET_ACME_EMAIL: "#{ cloudflare.acme.email }#" SECRET_ACME_EMAIL: "{{ cloudflare.acme.email }}"
SECRET_CLOUDFLARE_TUNNEL_ID: "#{ cloudflare.tunnel.id }#" SECRET_CLOUDFLARE_TUNNEL_ID: "{{ cloudflare.tunnel.id }}"
#% endif %# {% endif %}
bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2
+6 -6
View File
@@ -5,9 +5,9 @@ metadata:
name: cluster-settings name: cluster-settings
namespace: flux-system namespace: flux-system
data: data:
TIMEZONE: "#{ timezone }#" TIMEZONE: "{{ timezone }}"
CLUSTER_CIDR: "#{ cluster.pod_network.split(',')[0] }#" CLUSTER_CIDR: "{{ cluster.pod_network.split(',')[0] }}"
NODE_CIDR: "#{ cluster.nodes.host_network }#" NODE_CIDR: "{{ cluster.nodes.host_network }}"
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
CLUSTER_CIDR_V6: "#{ cluster.pod_network.split(',')[1] }#" CLUSTER_CIDR_V6: "{{ cluster.pod_network.split(',')[1] }}"
#% endif %# {% endif %}
bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2
+29 -29
View File
@@ -5,36 +5,36 @@ metadata:
name: home-kubernetes name: home-kubernetes
spec: spec:
hosts: hosts:
#% for item in cluster.nodes.inventory %# {% for item in cluster.nodes.inventory %}
#% if item.controller %# {% if item.controller %}
- role: controller+worker - role: controller+worker
#% else %# {% else %}
- role: worker - role: worker
#% endif %# {% endif %}
ssh: ssh:
address: "#{ item.address }#" address: "{{ item.address }}"
user: "#{ item.ssh_username }#" user: "{{ item.ssh_username }}"
#% if item.controller %# {% if item.controller %}
installFlags: installFlags:
- --disable-components=metrics-server - --disable-components=metrics-server
- --no-taints - --no-taints
#% endif %# {% endif %}
files: files:
- name: bootstrap-scripts - name: bootstrap-scripts
src: scripts src: scripts
hooks: hooks:
apply: apply:
before: before:
- bash ~/apply-system.sh "#{ item.name }#" - bash ~/apply-system.sh "{{ item.name }}"
#% if item.controller %# {% if item.controller %}
- bash ~/apply-kube-vip.sh - bash ~/apply-kube-vip.sh
#% endif %# {% endif %}
reset: reset:
before: before:
- bash ~/reset-cilium.sh - bash ~/reset-cilium.sh
after: after:
- bash ~/reset-system.sh - bash ~/reset-system.sh
#% endfor %# {% endfor %}
k0s: k0s:
# renovate: datasource=github-releases depName=k0sproject/k0s # renovate: datasource=github-releases depName=k0sproject/k0s
version: v1.29.1+k0s.0 version: v1.29.1+k0s.0
@@ -55,21 +55,21 @@ spec:
listen-metrics-urls: http://0.0.0.0:2381 listen-metrics-urls: http://0.0.0.0:2381
api: api:
sans: sans:
#% if cluster.endpoint_vip %# {% if cluster.endpoint_vip %}
- "#{ cluster.endpoint_vip }#" - "{{ cluster.endpoint_vip }}"
#% endif %# {% endif %}
#% for item in cluster.tls_sans %# {% for item in cluster.tls_sans %}
- "#{ item }#" - "{{ item }}"
#% endfor %# {% endfor %}
#% for item in controllers %# {% for item in controllers %}
#% if item.controller %# {% if item.controller %}
- "#{ item.address }#" - "{{ item.address }}"
- "#{ item.name }#" - "{{ item.name }}"
#% endif %# {% endif %}
#% endfor %# {% endfor %}
network: network:
podCIDR: "#{ cluster.pod_network.split(',')[0] }#" podCIDR: "{{ cluster.pod_network.split(',')[0] }}"
serviceCIDR: "#{ cluster.service_network.split(',')[0] }#" serviceCIDR: "{{ cluster.service_network.split(',')[0] }}"
provider: custom provider: custom
kubeProxy: kubeProxy:
disabled: true disabled: true
@@ -88,6 +88,6 @@ spec:
version: 1.14.6 version: 1.14.6
namespace: kube-system namespace: kube-system
values: |2 values: |2
#% filter indent(width=18, first=True) %# {% filter indent(width=18, first=True) %}
#% include 'partials/cilium-values-init.partial.yaml.j2' %# {% include 'partials/cilium-values-init.partial.yaml.j2' %}
#% endfilter %# {% endfilter %}
bootstrap/templates/kubernetes/k0s/scripts/apply-kube-vip.sh.j2
+2 -2
View File
@@ -9,10 +9,10 @@ mkdir -p /var/lib/k0s/manifests/kube-vip
# Create kube-vip rbac # Create kube-vip rbac
cat <<EOF > /var/lib/k0s/manifests/kube-vip/rbac.yaml cat <<EOF > /var/lib/k0s/manifests/kube-vip/rbac.yaml
#% include 'partials/kube-vip-rbac.partial.yaml.j2' %# {% include 'partials/kube-vip-rbac.partial.yaml.j2' %}
EOF EOF
# Create kube-vip daemonset # Create kube-vip daemonset
cat <<EOF > /var/lib/k0s/manifests/kube-vip/ds.yaml cat <<EOF > /var/lib/k0s/manifests/kube-vip/ds.yaml
#% include 'partials/kube-vip-ds.partial.yaml.j2' %# {% include 'partials/kube-vip-ds.partial.yaml.j2' %}
EOF EOF
bootstrap/templates/kubernetes/k0s/scripts/apply-system.sh.j2
+5 -5
View File
@@ -22,7 +22,7 @@ EOF
fi fi
# Timezone # Timezone
timedatectl set-timezone "#{ timezone }#" timedatectl set-timezone "{{ timezone }}"
# Install Packages # Install Packages
apt-get install -y --no-install-recommends \ apt-get install -y --no-install-recommends \
@@ -35,10 +35,10 @@ apt-get install -y --no-install-recommends \
chattr -i /etc/resolv.conf chattr -i /etc/resolv.conf
rm -f /etc/resolv.conf rm -f /etc/resolv.conf
cat <<EOF > /etc/resolv.conf cat <<EOF > /etc/resolv.conf
search #{ cluster.nodes.search_domain|default('.', true) }# search {{ cluster.nodes.search_domain|default('.', true) }}
#% for item in cluster.nodes.dns_servers %# {% for item in cluster.nodes.dns_servers %}
nameserver #{ item }# nameserver {{ item }}
#% endfor %# {% endfor %}
EOF EOF
chattr +i /etc/resolv.conf chattr +i /etc/resolv.conf
bootstrap/templates/kubernetes/talos/cilium/values.yaml.j2
+3 -3
View File
@@ -1,4 +1,4 @@
--- ---
#% filter indent(width=0, first=True) %# {% filter indent(width=0, first=True) %}
#% include 'partials/cilium-values-init.partial.yaml.j2' %# {% include 'partials/cilium-values-init.partial.yaml.j2' %}
#% endfilter %# {% endfilter %}
bootstrap/templates/kubernetes/talos/kubelet-csr-approver/kustomization.yaml.j2
+3 -3
View File
@@ -9,9 +9,9 @@ helmCharts:
releaseName: kubelet-csr-approver releaseName: kubelet-csr-approver
namespace: kube-system namespace: kube-system
valuesInline: valuesInline:
#% filter indent(width=6, first=True) %# {% filter indent(width=6, first=True) %}
#% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %# {% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
#% endfilter %# {% endfilter %}
commonAnnotations: commonAnnotations:
meta.helm.sh/release-name: kubelet-csr-approver meta.helm.sh/release-name: kubelet-csr-approver
meta.helm.sh/release-namespace: kube-system meta.helm.sh/release-namespace: kube-system
bootstrap/templates/kubernetes/talos/talconfig.yaml.j2
+29 -29
View File
@@ -6,50 +6,50 @@ talosVersion: v1.6.3
kubernetesVersion: v1.29.1 kubernetesVersion: v1.29.1
clusterName: &cluster home-kubernetes clusterName: &cluster home-kubernetes
endpoint: https://#{ cluster.endpoint_vip }#:6443 endpoint: https://{{ cluster.endpoint_vip }}:6443
clusterPodNets: clusterPodNets:
- "#{ cluster.pod_network.split(',')[0] }#" - "{{ cluster.pod_network.split(',')[0] }}"
clusterSvcNets: clusterSvcNets:
- "#{ cluster.service_network.split(',')[0] }#" - "{{ cluster.service_network.split(',')[0] }}"
additionalApiServerCertSans: &sans additionalApiServerCertSans: &sans
- "#{ cluster.endpoint_vip }#" - "{{ cluster.endpoint_vip }}"
- 127.0.0.1 - 127.0.0.1
#% for item in cluster.tls_sans %# {% for item in cluster.tls_sans %}
- "#{ item }#" - "{{ item }}"
#% endfor %# {% endfor %}
additionalMachineCertSans: *sans additionalMachineCertSans: *sans
cniConfig: cniConfig:
name: none name: none
nodes: nodes:
#% for item in cluster.nodes.inventory %# {% for item in cluster.nodes.inventory %}
- hostname: "#{ item.name }#" - hostname: "{{ item.name }}"
ipAddress: "#{ item.address }#" ipAddress: "{{ item.address }}"
#% if item.talos_disk_device.startswith('/') %# {% if item.talos_disk_device.startswith('/') %}
installDisk: "#{ item.talos_disk_device }#" installDisk: "{{ item.talos_disk_device }}"
#% else %# {% else %}
installDiskSelector: installDiskSelector:
serial: "#{ item.talos_disk_device }#" serial: "{{ item.talos_disk_device }}"
#% endif %# {% endif %}
#% if item.controller %# {% if item.controller %}
controlPlane: true controlPlane: true
#% else %# {% else %}
controlPlane: false controlPlane: false
#% endif %# {% endif %}
networkInterfaces: networkInterfaces:
- interface: eth0 - interface: eth0
dhcp: false dhcp: false
addresses: addresses:
- "#{ item.address }#/#{ cluster.nodes.host_network.split('/') | last }#" - "{{ item.address }}/{{ cluster.nodes.host_network.split('/') | last }}"
mtu: 1500 mtu: 1500
routes: routes:
- network: 0.0.0.0/0 - network: 0.0.0.0/0
gateway: "#{ cluster.nodes.host_network | nthhost(1) }#" gateway: "{{ cluster.nodes.host_network | nthhost(1) }}"
#% if item.controller %# {% if item.controller %}
vip: vip:
ip: "#{ cluster.endpoint_vip }#" ip: "{{ cluster.endpoint_vip }}"
#% endif %# {% endif %}
#% endfor %# {% endfor %}
controlPlane: controlPlane:
patches: patches:
@@ -92,7 +92,7 @@ controlPlane:
rotate-server-certificates: true rotate-server-certificates: true
nodeIP: nodeIP:
validSubnets: validSubnets:
- "#{ cluster.nodes.host_network }#" - "{{ cluster.nodes.host_network }}"
# Enable KubePrism # Enable KubePrism
- &kubePrismPatch |- - &kubePrismPatch |-
@@ -107,9 +107,9 @@ controlPlane:
machine: machine:
network: network:
nameservers: nameservers:
#% for item in cluster.nodes.dns_servers %# {% for item in cluster.nodes.dns_servers %}
- #{ item }# - {{ item }}
#% endfor %# {% endfor %}
# Configure NTP # Configure NTP
- &ntpPatch |- - &ntpPatch |-
@@ -147,7 +147,7 @@ controlPlane:
extraArgs: extraArgs:
listen-metrics-urls: http://0.0.0.0:2381 listen-metrics-urls: http://0.0.0.0:2381
advertisedSubnets: advertisedSubnets:
- "#{ cluster.nodes.host_network }#" - "{{ cluster.nodes.host_network }}"
# Disable default API server admission plugins. # Disable default API server admission plugins.
- |- - |-
bootstrap/templates/partials/cilium-values-full.partial.yaml.j2
+15 -15
View File
@@ -8,14 +8,14 @@ cluster:
id: 1 id: 1
containerRuntime: containerRuntime:
integration: containerd integration: containerd
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
socketPath: /var/run/k3s/containerd/containerd.sock socketPath: /var/run/k3s/containerd/containerd.sock
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
socketPath: /var/run/k0s/containerd.sock socketPath: /var/run/k0s/containerd.sock
#% endif %# {% endif %}
endpointRoutes: endpointRoutes:
enabled: true enabled: true
#% if cloudflare.enabled %# {% if cloudflare.enabled %}
hubble: hubble:
enabled: true enabled: true
metrics: metrics:
@@ -50,41 +50,41 @@ hubble:
tls: tls:
- hosts: - hosts:
- "hubble.${SECRET_DOMAIN}" - "hubble.${SECRET_DOMAIN}"
#% else %# {% else %}
hubble: hubble:
enabled: false enabled: false
#% endif %# {% endif %}
ipam: ipam:
mode: kubernetes mode: kubernetes
ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}" ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}" ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
ipv6: ipv6:
enabled: true enabled: true
#% endif %# {% endif %}
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
k8sServiceHost: 127.0.0.1 k8sServiceHost: 127.0.0.1
k8sServicePort: 6444 k8sServicePort: 6444
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
k8sServiceHost: localhost k8sServiceHost: localhost
k8sServicePort: 7443 k8sServicePort: 7443
#% elif distribution in ['talos'] %# {% elif distribution in ['talos'] %}
k8sServiceHost: 127.0.0.1 k8sServiceHost: 127.0.0.1
k8sServicePort: 7445 k8sServicePort: 7445
#% endif %# {% endif %}
kubeProxyReplacement: true kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements: l2announcements:
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
# https://github.com/cilium/cilium/issues/28985 # https://github.com/cilium/cilium/issues/28985
enabled: false enabled: false
#% else %# {% else %}
enabled: true enabled: true
# https://github.com/cilium/cilium/issues/26586 # https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s leaseDuration: 120s
leaseRenewDeadline: 60s leaseRenewDeadline: 60s
leaseRetryPeriod: 1s leaseRetryPeriod: 1s
#% endif %# {% endif %}
loadBalancer: loadBalancer:
algorithm: maglev algorithm: maglev
mode: dsr mode: dsr
bootstrap/templates/partials/cilium-values-init.partial.yaml.j2
+14 -14
View File
@@ -8,46 +8,46 @@ cluster:
id: 1 id: 1
containerRuntime: containerRuntime:
integration: containerd integration: containerd
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
socketPath: /var/run/k3s/containerd/containerd.sock socketPath: /var/run/k3s/containerd/containerd.sock
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
socketPath: /var/run/k0s/containerd.sock socketPath: /var/run/k0s/containerd.sock
#% endif %# {% endif %}
endpointRoutes: endpointRoutes:
enabled: true enabled: true
hubble: hubble:
enabled: false enabled: false
ipam: ipam:
mode: kubernetes mode: kubernetes
ipv4NativeRoutingCIDR: "#{ cluster.pod_network }#" ipv4NativeRoutingCIDR: "{{ cluster.pod_network }}"
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
ipv6NativeRoutingCIDR: "#{ cluster.pod_network_v6 }#" ipv6NativeRoutingCIDR: "{{ cluster.pod_network_v6 }}"
ipv6: ipv6:
enabled: true enabled: true
#% endif %# {% endif %}
#% if distribution in ['k3s'] %# {% if distribution in ['k3s'] %}
k8sServiceHost: 127.0.0.1 k8sServiceHost: 127.0.0.1
k8sServicePort: 6444 k8sServicePort: 6444
#% elif distribution in ['k0s'] %# {% elif distribution in ['k0s'] %}
k8sServiceHost: localhost k8sServiceHost: localhost
k8sServicePort: 7443 k8sServicePort: 7443
#% elif distribution in ['talos'] %# {% elif distribution in ['talos'] %}
k8sServiceHost: 127.0.0.1 k8sServiceHost: 127.0.0.1
k8sServicePort: 7445 k8sServicePort: 7445
#% endif %# {% endif %}
kubeProxyReplacement: true kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements: l2announcements:
#% if feature_gates.dual_stack_ipv4_first %# {% if feature_gates.dual_stack_ipv4_first %}
# https://github.com/cilium/cilium/issues/28985 # https://github.com/cilium/cilium/issues/28985
enabled: false enabled: false
#% else %# {% else %}
enabled: true enabled: true
# https://github.com/cilium/cilium/issues/26586 # https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s leaseDuration: 120s
leaseRenewDeadline: 60s leaseRenewDeadline: 60s
leaseRetryPeriod: 1s leaseRetryPeriod: 1s
#% endif %# {% endif %}
loadBalancer: loadBalancer:
algorithm: maglev algorithm: maglev
mode: dsr mode: dsr
bootstrap/templates/partials/kube-vip-ds.partial.yaml.j2
+1 -1
View File
@@ -21,7 +21,7 @@ spec:
args: ["manager"] args: ["manager"]
env: env:
- name: address - name: address
value: "#{ cluster.endpoint_vip }#" value: "{{ cluster.endpoint_vip }}"
- name: vip_arp - name: vip_arp
value: "true" value: "true"
- name: lb_enable - name: lb_enable
bootstrap/templates/partials/kubelet-csr-approver-values.partial.yaml.j2
+1 -1
View File
@@ -1,2 +1,2 @@
providerRegex: ^(#{ (nodes | map(attribute='name') | join('|')) }#)$ providerRegex: ^({{ (cluster.nodes.inventory | map(attribute='name') | join('|')) }})$
bypassDnsResolution: true bypassDnsResolution: true
makejinja.toml
+6 -9
View File
@@ -9,13 +9,10 @@ jinja_suffix = ".j2"
force = true force = true
undefined = "chainable" undefined = "chainable"
# Block and comment delimiters are changed to avoid conflicts with Renovate
# Variable delimiters are changed to avoid conflicts with Renovate and Go templates
# https://github.com/renovatebot/renovate/discussions/18470
[makejinja.delimiter] [makejinja.delimiter]
block_start = "#%" block_start = "{%"
block_end = "%#" block_end = "%}"
comment_start = "#|" comment_start = "{#"
comment_end = "|#" comment_end = "#}"
variable_start = "#{" variable_start = "{{"
variable_end = "}#" variable_end = "}}"