infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: more changes to templating (#1218)

Browse Source 
* feat: clean up more jinja default references

Signed-off-by: Devin Buhl <devin@buhl.casa>

* feat: add additional tls sans force kube-vip on k3s

Signed-off-by: Devin Buhl <devin@buhl.casa>

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-21 11:39:12 -05:00
1 parent 8339d142b7
commit e1330d734c
30 files changed
+65 -118
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
+1 -1
View File
@@ -2,7 +2,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
#% if not bootstrap_ipv6_enabled|default(false) %#
#% if not bootstrap_ipv6_enabled %#
- ./cilium-l2.yaml
#% endif %#
- ./helmrelease.yaml
bootstrap/templates/kubernetes/apps/network/nginx/certificates/kustomization.yaml.j2
+1 -1
View File
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./staging.yaml
#% if bootstrap_acme_production_enabled|default(false) %#
#% if bootstrap_acme_production_enabled %#
- ./production.yaml
#% endif %#
bootstrap/templates/kubernetes/apps/network/nginx/external/helmrelease.yaml.j2
Vendored
+1 -1
View File
@@ -70,7 +70,7 @@ spec:
namespaceSelector:
any: true
extraArgs:
#% if bootstrap_acme_production_enabled|default(false) %#
#% if bootstrap_acme_production_enabled %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
#% else %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
bootstrap/templates/kubernetes/apps/network/nginx/internal/helmrelease.yaml.j2
+1 -1
View File
@@ -68,7 +68,7 @@ spec:
namespaceSelector:
any: true
extraArgs:
#% if bootstrap_acme_production_enabled|default(false) %#
#% if bootstrap_acme_production_enabled %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
#% else %#
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
bootstrap/templates/kubernetes/apps/storage/csi-driver-smb/app/storageclass.yaml.j2
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
provisioner: smb.csi.k8s.io
parameters:
source: "#{ item.source }#"
csi.storage.k8s.io/node-stage-secret-name: "#{ item.existing_secret_name|default(item.name+"-secret") }#"
csi.storage.k8s.io/node-stage-secret-name: "#{ item.existing_secret_name|default(item.name + '-secret') }#"
#% if item.existing_secret_name and item.existing_secret_namespace %#
csi.storage.k8s.io/node-stage-secret-namespace: "#{ item.existing_secret_namespace }#"
#% else %#
bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2
+2 -2
View File
@@ -7,8 +7,8 @@ metadata:
spec:
interval: 30m
ref:
branch: "#{ bootstrap_github_repository_branch|default('main', true) }#"
#% if bootstrap_private_github_repo|default(false) %#
branch: "#{ bootstrap_github_repository_branch }#"
#% if bootstrap_private_github_repo %#
secretRef:
name: github-deploy-key
url: "ssh://github.com/#{ bootstrap_github_username }#/#{ bootstrap_github_repository_name }#"
bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2
+1 -5
View File
@@ -7,15 +7,11 @@ metadata:
data:
TIMEZONE: "#{ bootstrap_timezone }#"
COREDNS_ADDR: "#{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }#"
#% if bootstrap_nodes.master | length > 1 or bootstrap_kube_api_addr|default('') %#
KUBE_API_ADDR: "#{ bootstrap_kube_api_addr }#"
#% else %#
KUBE_API_ADDR: "#{ bootstrap_nodes.master[0].address }#"
#% endif %#
CLUSTER_CIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
SERVICE_CIDR: "#{ bootstrap_service_cidr.split(',')[0] }#"
NODE_CIDR: "#{ bootstrap_node_cidr }#"
#% if bootstrap_ipv6_enabled|default(false) %#
#% if bootstrap_ipv6_enabled %#
CLUSTER_CIDR_V6: "#{ bootstrap_cluster_cidr.split(',')[1] }#"
SERVICE_CIDR_V6: "#{ bootstrap_service_cidr.split(',')[1] }#"
#% endif %#
bootstrap/templates/kubernetes/k0s/k0sctl.yaml.j2
+5 -8
View File
@@ -49,7 +49,7 @@ spec:
hooks: *hooks
#% endif %#
#% endfor %#
#% if bootstrap_nodes.worker|default([]) | length > 0 %#
#% if bootstrap_nodes.worker | length > 0 %#
#% for item in bootstrap_nodes.worker %#
- role: worker
ssh:
@@ -81,17 +81,14 @@ spec:
listen-metrics-urls: http://0.0.0.0:2381 # Required to monitor etcd with kube-prometheus-stack
api:
sans:
#% if bootstrap_kube_api_addr %#
- "#{ bootstrap_kube_api_addr }#"
#% if bootstrap_kube_api_hostname|default('') %#
- "#{ bootstrap_kube_api_hostname }#"
#% endif %#
#% for item in bootstrap_kube_additional_tls_sans %#
- "#{ item }#"
#% endfor %#
#% for item in bootstrap_nodes.master %#
#% if item.address != bootstrap_kube_api_addr %#
- "#{ item.address }#"
#% endif %#
#% if (not bootstrap_kube_api_hostname|default('')) or (item.name != bootstrap_kube_api_hostname|default('')) %#
- "#{ item.name }#"
#% endif %#
#% endfor %#
network:
podCIDR: "#{ bootstrap_cluster_cidr.split(',')[0] }#"
bootstrap/templates/kubernetes/k0s/resources/hooks/apply-system.sh.j2
+2 -2
View File
@@ -16,13 +16,13 @@ apt-get install -y --no-install-recommends \
nvme-cli open-iscsi parted psmisc python3 python3-apt python3-kubernetes python3-yaml \
smartmontools socat software-properties-common unzip util-linux
#% if bootstrap_advanced_flags|default({}) and bootstrap_advanced_flags.update_resolv_conf|default(true) %#
#% if bootstrap_advanced_flags.update_resolv_conf %#
# Update DNS
chattr -i /etc/resolv.conf
rm -f /etc/resolv.conf
cat <<EOF > /etc/resolv.conf
search .
nameserver #{ bootstrap_dns_server|default('1.1.1.1', true) }#
nameserver #{ bootstrap_dns_server }#
EOF
chattr +i /etc/resolv.conf
#% endif %#
bootstrap/templates/kubernetes/talos/talconfig.yaml.j2
+6 -10
View File
@@ -8,11 +8,7 @@ kubernetesVersion: 1.29.1
clusterName: &cluster home-kubernetes
#% if bootstrap_kube_api_hostname|default('') %#
endpoint: https://#{ bootstrap_kube_api_hostname }#:6443
#% else %#
endpoint: https://#{ bootstrap_kube_api_addr }#:6443
#% endif %#
clusterPodNets:
- "#{ bootstrap_cluster_cidr.split(',')[0] }#"
@@ -21,10 +17,10 @@ clusterSvcNets:
additionalApiServerCertSans: &sans
- "#{ bootstrap_kube_api_addr }#"
- 127.0.0.1 #KubePrism
#% if bootstrap_kube_api_hostname|default('') %#
- "#{ bootstrap_kube_api_hostname }#"
#% endif %#
- 127.0.0.1 # KubePrism
#% for item in bootstrap_kube_additional_tls_sans %#
- "#{ item }#"
#% endfor %#
additionalMachineCertSans: *sans
@@ -48,7 +44,7 @@ nodes:
vip:
ip: "#{ bootstrap_kube_api_addr }#"
#% endfor %#
#% if bootstrap_nodes.worker|default([]) | length > 0 %#
#% if bootstrap_nodes.worker | length > 0 %#
#% for item in bootstrap_nodes.worker %#
- hostname: "#{ item.name }#"
ipAddress: "#{ item.address }#"
@@ -123,7 +119,7 @@ controlPlane:
machine:
network:
nameservers:
- "#{ bootstrap_dns_server|default('1.1.1.1', true) }#"
- "#{ bootstrap_dns_server }#"
# Configure NTP
- &ntpPatch |-