infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: remove the need for raw jinja blocks (#1158)

Browse Source 
Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-15 00:03:41 -05:00
1 parent f9481d6202
commit e6fbc6e128
92 files changed
+430 -441
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/renovate.json5
-3
View File
@@ -22,14 +22,12 @@
},
"helm-values": {
"fileMatch": [
"(^|/)addons/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)ansible/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)kubernetes/.+\\.ya?ml(\\.j2)?(\\.j2)?$"
]
},
"kubernetes": {
"fileMatch": [
"(^|/)addons/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)ansible/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)kubernetes/.+\\.ya?ml(\\.j2)?(\\.j2)?$"
]
@@ -225,7 +223,6 @@
"description": "Process various other dependencies",
"fileMatch": [
"(^|/).taskfiles/.+\\.ya?ml$",
"(^|/)addons/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)ansible/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)kubernetes/.+\\.ya?ml(\\.j2)?(\\.j2)?$",
"(^|/)k0s-config.ya?ml(\\.j2)?(\\.j2)?$"
.github/workflows/e2e.yaml
+4 -4
View File
@@ -11,8 +11,8 @@ concurrency:
cancel-in-progress: true
jobs:
e2e-yay:
name: e2e-yay
yay:
name: yay
runs-on: ubuntu-latest
container:
image: greyltc/archlinux-aur:yay
@@ -30,8 +30,8 @@ jobs:
go-task workstation:yay
'
e2e-configure:
name: e2e-configure
configure:
name: configure
runs-on: ubuntu-latest
strategy:
fail-fast: false
.taskfiles/Repo/Taskfile.yaml
+1 -1
View File
@@ -13,9 +13,9 @@ tasks:
# Move bootstrap directory to gitignored directory
- mkdir -p {{.ROOT_DIR}}/.private
- mv {{.BOOTSTRAP_DIR}} {{.ROOT_DIR}}/.private/bootstrap-{{now | date "150405"}}
- mv {{.ROOT_DIR}}/makejinja.toml {{.ROOT_DIR}}/.private/makejinja-{{now | date "150405"}}.toml
# Update renovate.json5
- sed -i {{if eq OS "darwin"}}''{{end}} 's/(..\.j2)\?(..\.j2)\?//g' {{.ROOT_DIR}}/.github/renovate.json5
- sed -i {{if eq OS "darwin"}}''{{end}} '/addons/d' {{.ROOT_DIR}}/.github/renovate.json5
preconditions:
- { msg: "bootstrap dir not found", sh: "test -d {{.BOOTSTRAP_DIR}}" }
- { msg: "renovate.json5 not found", sh: "test -f {{.ROOT_DIR}}/.github/renovate.json5" }
Taskfile.yaml
+4 -10
View File
@@ -65,15 +65,9 @@ tasks:
internal: true
cmds:
- ./.venv/bin/makejinja
--input "{{.BOOTSTRAP_DIR}}/templates"
--output "{{.ROOT_DIR}}"
--data "{{.BOOTSTRAP_DIR}}/vars/config.yaml"
--data "{{.BOOTSTRAP_DIR}}/vars/addons.yaml"
--import-path "{{.BOOTSTRAP_DIR}}/scripts"
--loader "loader:Loader"
--jinja-suffix ".j2" --quiet --force
- find {{.ANSIBLE_DIR}} {{.KUBERNETES_DIR}} -type d -empty -delete
preconditions:
- { msg: "addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" }
- { msg: "config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" }
- { msg: "loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" }
- { msg: "bootstrap addons file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/addons.yaml" }
- { msg: "bootstrap config file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/vars/config.yaml" }
- { msg: "makejinja loader file not found", sh: "test -f {{.BOOTSTRAP_DIR}}/scripts/loader.py" }
- { msg: "makejinja config file not found", sh: "test -f {{.ROOT_DIR}}/makejinja.toml" }
bootstrap/templates/.sops.yaml.j2
+2 -2
View File
@@ -4,8 +4,8 @@ creation_rules:
encrypted_regex: "^(data|stringData)$"
key_groups:
- age:
- "{{ bootstrap_age_public_key }}"
- "<< bootstrap_age_public_key >>"
- path_regex: ansible/.*\.sops\.ya?ml
key_groups:
- age:
- "{{ bootstrap_age_public_key }}"
- "<< bootstrap_age_public_key >>"
bootstrap/templates/ansible/inventory/group_vars/kubernetes/main.yaml.j2
+8 -8
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
#
# Below vars are for the xanmanning.k3s role
@@ -9,17 +9,17 @@
k3s_release_version: "v1.29.0+k3s1"
k3s_install_hard_links: true
k3s_become: true
{% if bootstrap_nodes.master | length > 1 %}
<% if bootstrap_nodes.master | length > 1 %>
k3s_etcd_datastore: true
{% else %}
<% else %>
k3s_etcd_datastore: false
{% endif %}
k3s_registration_address: "{% raw %}{{ kube_api_addr }}{% endraw %}"
<% endif %>
k3s_registration_address: "{{ kube_api_addr }}"
# /var/lib/rancher/k3s/server/manifests
k3s_server_manifests_templates:
- custom-cilium-helmchart.yaml.j2
- custom-coredns-helmchart.yaml.j2
{% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
<% if bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %>
# /var/lib/rancher/k3s/server/manifests
k3s_server_manifests_urls:
- url: https://raw.githubusercontent.com/kube-vip/website/main/content/manifests/rbac.yaml
@@ -27,5 +27,5 @@ k3s_server_manifests_urls:
# /var/lib/rancher/k3s/agent/pod-manifests
k3s_server_pod_manifests_templates:
- kube-vip-static-pod.yaml.j2
{% endif %}
{% endif %}
<% endif %>
<% endif %>
bootstrap/templates/ansible/inventory/group_vars/kubernetes/supplemental.yaml.j2
+15 -15
View File
@@ -1,16 +1,16 @@
---
timezone: "{{ bootstrap_timezone }}"
github_username: "{{ bootstrap_github_username }}"
coredns_addr: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
kube_api_addr: "{{ bootstrap_nodes.master[0].address }}"
{% else %}
kube_api_addr: "{{ bootstrap_kube_api_addr }}"
{% endif %}
cluster_cidr: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
service_cidr: "{{ bootstrap_service_cidr.split(',')[0] }}"
node_cidr: "{{ bootstrap_node_cidr }}"
{% if bootstrap_ipv6_enabled | default(false) %}
cluster_cidr_v6: "{{ bootstrap_cluster_cidr.split(',')[1] }}"
service_cidr_v6: "{{ bootstrap_service_cidr.split(',')[1] }}"
{% endif %}
timezone: "<< bootstrap_timezone >>"
github_username: "<< bootstrap_github_username >>"
coredns_addr: "<< bootstrap_service_cidr.split(',')[0] | nthhost(10) >>"
<% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %>
kube_api_addr: "<< bootstrap_nodes.master[0].address >>"
<% else %>
kube_api_addr: "<< bootstrap_kube_api_addr >>"
<% endif %>
cluster_cidr: "<< bootstrap_cluster_cidr.split(',')[0] >>"
service_cidr: "<< bootstrap_service_cidr.split(',')[0] >>"
node_cidr: "<< bootstrap_node_cidr >>"
<% if bootstrap_ipv6_enabled | default(false) %>
cluster_cidr_v6: "<< bootstrap_cluster_cidr.split(',')[1] >>"
service_cidr_v6: "<< bootstrap_service_cidr.split(',')[1] >>"
<% endif %>
bootstrap/templates/ansible/inventory/group_vars/master/main.yaml.j2
+15 -15
View File
@@ -1,17 +1,17 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
# https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/
# https://github.com/PyratLabs/ansible-role-k3s
k3s_control_node: true
k3s_server:
{% if bootstrap_ipv6_enabled | default(false) %}
node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}"
{% else %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
{% endif %}
<% if bootstrap_ipv6_enabled | default(false) %>
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
<% else %>
node-ip: "{{ ansible_host }}"
<% endif %>
tls-san:
- "{% raw %}{{ kube_api_addr }}{% endraw %}"
- "{{ kube_api_addr }}"
docker: false
flannel-backend: "none" # This needs to be in quotes
disable:
@@ -27,13 +27,13 @@ k3s_server:
write-kubeconfig-mode: "644"
pause-image: registry.k8s.io/pause:3.9
secrets-encryption: true
{% if bootstrap_ipv6_enabled | default(false) %}
cluster-cidr: "{% raw %}{{ cluster_cidr }},{{ cluster_cidr_v6 }}{% endraw %}"
service-cidr: "{% raw %}{{ service_cidr }},{{ service_cidr_v6 }}{% endraw %}"
{% else %}
cluster-cidr: "{% raw %}{{ cluster_cidr }}{% endraw %}"
service-cidr: "{% raw %}{{ service_cidr }}{% endraw %}"
{% endif %}
<% if bootstrap_ipv6_enabled | default(false) %>
cluster-cidr: "{{ cluster_cidr }},{{ cluster_cidr_v6 }}"
service-cidr: "{{ service_cidr }},{{ service_cidr_v6 }}"
<% else %>
cluster-cidr: "{{ cluster_cidr }}"
service-cidr: "{{ service_cidr }}"
<% endif %>
etcd-expose-metrics: true # Required to monitor etcd with kube-prometheus-stack
kube-controller-manager-arg:
- "bind-address=0.0.0.0" # Required to monitor kube-controller-manager with kube-prometheus-stack
@@ -45,4 +45,4 @@ k3s_server:
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
{% endif %}
<% endif %>
bootstrap/templates/ansible/inventory/group_vars/worker/main.yaml.j2
+7 -7
View File
@@ -1,18 +1,18 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
# https://rancher.com/docs/k3s/latest/en/installation/install-options/agent-config/
# https://github.com/PyratLabs/ansible-role-k3s
k3s_control_node: false
k3s_agent:
{% if bootstrap_ipv6_enabled | default(false) %}
node-ip: "{% raw %}{{ ansible_host }},{{ ansible_default_ipv6.address }}{% endraw %}"
{% else %}
node-ip: "{% raw %}{{ ansible_host }}{% endraw %}"
{% endif %}
<% if bootstrap_ipv6_enabled | default(false) %>
node-ip: "{{ ansible_host }},{{ ansible_default_ipv6.address }}"
<% else %>
node-ip: "{{ ansible_host }}"
<% endif %>
pause-image: registry.k8s.io/pause:3.9
# TODO: Move these options to a kubelet config file
kubelet-arg:
- "image-gc-high-threshold=55"
- "image-gc-low-threshold=50"
{% endif %}
<% endif %>
bootstrap/templates/ansible/inventory/hosts.yaml.j2
+20 -20
View File
@@ -3,25 +3,25 @@ kubernetes:
children:
master:
hosts:
{% for item in bootstrap_nodes.master %}
{{ item.name }}:
ansible_user: {{ item.username }}
{% if item.external_address is defined %}
ansible_host: {{ item.external_address }}
{% else %}
ansible_host: {{ item.address }}
{% endif %}
{% endfor %}
{% if bootstrap_nodes.worker | default([]) | length > 0 %}
<% for item in bootstrap_nodes.master %>
<< item.name >>:
ansible_user: << item.username >>
<% if item.external_address is defined %>
ansible_host: << item.external_address >>
<% else %>
ansible_host: << item.address >>
<% endif %>
<% endfor %>
<% if bootstrap_nodes.worker | default([]) | length > 0 %>
worker:
hosts:
{% for item in bootstrap_nodes.worker %}
{{ item.name }}:
ansible_user: {{ item.username }}
{% if item.external_address is defined %}
ansible_host: {{ item.external_address }}
{% else %}
ansible_host: {{ item.address }}
{% endif %}
{% endfor %}
{% endif %}
<% for item in bootstrap_nodes.worker %>
<< item.name >>:
ansible_user: << item.username >>
<% if item.external_address is defined %>
ansible_host: << item.external_address >>
<% else %>
ansible_host: << item.address >>
<% endif %>
<% endfor %>
<% endif %>
bootstrap/templates/ansible/playbooks/cluster-installation.yaml.j2
+5 -5
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
- name: Cluster Installation
hosts: kubernetes
@@ -39,9 +39,9 @@
or k3s_server_manifests_urls | length > 0)
kubernetes.core.k8s_info:
kubeconfig: /etc/rancher/k3s/k3s.yaml
kind: "{% raw %}{{ item.kind }}{% endraw %}"
name: "{% raw %}{{ item.name }}{% endraw %}"
namespace: "{% raw %}{{ item.namespace | default('') }}{% endraw %}"
kind: "{{ item.kind }}"
name: "{{ item.name }}"
namespace: "{{ item.namespace | default('') }}"
wait: true
wait_sleep: 10
wait_timeout: 360
@@ -60,4 +60,4 @@
- name: Cruft
when: k3s_primary_control_node
ansible.builtin.include_tasks: tasks/cruft.yaml
{% endif %}
<% endif %>
bootstrap/templates/ansible/playbooks/cluster-kube-vip.yaml.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
- name: Cluster kube-vip
hosts: master
@@ -21,6 +21,6 @@
- name: Upgrade kube-vip
ansible.builtin.template:
src: templates/kube-vip-static-pod.yaml.j2
dest: "{% raw %}{{ k3s_server_pod_manifests_dir }}{% endraw %}/kube-vip-static-pod.yaml"
dest: "{{ k3s_server_pod_manifests_dir }}/kube-vip-static-pod.yaml"
mode: preserve
{% endif %}
<% endif %>
bootstrap/templates/ansible/playbooks/cluster-nuke.yaml.j2
+10 -10
View File
@@ -21,7 +21,7 @@
ansible.builtin.pause:
seconds: 5
tasks:
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
- name: Stop Kubernetes # noqa: ignore-errors
ignore_errors: true
block:
@@ -31,24 +31,24 @@
public: true
vars:
k3s_state: stopped
{% endif %}
<% endif %>
# https://github.com/k3s-io/docs/blob/main/docs/installation/network-options.md
- name: Networking
block:
- name: Networking | Delete Cilium links
ansible.builtin.command:
cmd: "ip link delete {% raw %}{{ item }}{% endraw %}"
removes: "/sys/class/net/{% raw %}{{ item }}{% endraw %}"
cmd: "ip link delete {{ item }}"
removes: "/sys/class/net/{{ item }}"
loop: ["cilium_host", "cilium_net", "cilium_vxlan"]
- name: Networking | Flush iptables
ansible.builtin.iptables:
table: "{% raw %}{{ item }}{% endraw %}"
table: "{{ item }}"
flush: true
loop: ["filter", "nat", "mangle", "raw"]
- name: Networking | Flush ip6tables
ansible.builtin.iptables:
table: "{% raw %}{{ item }}{% endraw %}"
table: "{{ item }}"
flush: true
ip_version: ipv6
loop: ["filter", "nat", "mangle", "raw"]
@@ -57,7 +57,7 @@
path: /etc/cni/net.d
state: absent
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
- name: Check to see if k3s-killall.sh exits
ansible.builtin.stat:
path: /usr/local/bin/k3s-killall.sh
@@ -89,14 +89,14 @@
- k3s_install_hard_links
- not ansible_check_mode
ansible.builtin.file:
path: "{% raw %}{{ k3s_install_dir }}/{{ item }}{% endraw %}"
path: "{{ k3s_install_dir }}/{{ item }}"
state: absent
loop: ["kubectl", "crictl", "ctr"]
{% endif %}
<% endif %>
- name: Remove local storage path
ansible.builtin.file:
path: "{{ bootstrap_local_storage_path }}"
path: "<< bootstrap_local_storage_path >>"
state: absent
- name: Reboot
bootstrap/templates/ansible/playbooks/cluster-prepare.yaml.j2
+14 -14
View File
@@ -15,7 +15,7 @@
block:
- name: Locale | Set timezone
community.general.timezone:
name: "{% raw %}{{ timezone | default('Etc/UTC') }}{% endraw %}"
name: "{{ timezone | default('Etc/UTC') }}"
- name: Packages
block:
@@ -31,14 +31,14 @@
block:
- name: User Configuration | SSH keys
ansible.posix.authorized_key:
user: "{% raw %}{{ ansible_user }}{% endraw %}"
key: "https://github.com/{% raw %}{{ github_username }}{% endraw %}.keys"
user: "{{ ansible_user }}"
key: "https://github.com/{{ github_username }}.keys"
- name: User Configuration | Silence login
ansible.builtin.file:
dest: "{% raw %}{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}{% endraw %}/.hushlogin"
dest: "{{ '/home/' + ansible_user if ansible_user != 'root' else '/root' }}/.hushlogin"
state: touch
owner: "{% raw %}{{ ansible_user }}{% endraw %}"
group: "{% raw %}{{ ansible_user }}{% endraw %}"
owner: "{{ ansible_user }}"
group: "{{ ansible_user }}"
mode: "0644"
modification_time: preserve
access_time: preserve
@@ -48,12 +48,12 @@
block:
- name: Network Configuration | Set hostname
ansible.builtin.hostname:
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
name: "{{ inventory_hostname }}"
- name: Network Configuration | Update hosts
ansible.builtin.copy:
content: |
127.0.0.1 localhost
127.0.1.1 {% raw %}{{ inventory_hostname }}{% endraw %}
127.0.1.1 {{ inventory_hostname }}
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
@@ -96,15 +96,15 @@
masked: true
- name: System Configuration | Disable swap
ansible.posix.mount:
name: "{% raw %}{{ item }}{% endraw %}"
name: "{{ item }}"
fstype: swap
state: absent
loop: ["none", "swap"]
- name: System Configuration | Create Kernel modules
ansible.builtin.copy:
dest: "/etc/modules-load.d/{% raw %}{{ item }}{% endraw %}.conf"
dest: "/etc/modules-load.d/{{ item }}.conf"
mode: "0644"
content: "{% raw %}{{ item }}{% endraw %}"
content: "{{ item }}"
loop: ["br_netfilter", "ceph", "ip_vs", "ip_vs_rr", "nbd", "overlay", "rbd"]
register: modules_status
- name: System Configuration | Reload Kernel modules # noqa: no-changed-when no-handler
@@ -114,11 +114,11 @@
state: restarted
- name: System Configuration | Sysctl
ansible.posix.sysctl:
name: "{% raw %}{{ item.key }}{% endraw %}"
value: "{% raw %}{{ item.value }}{% endraw %}"
name: "{{ item.key }}"
value: "{{ item.value }}"
sysctl_file: /etc/sysctl.d/99-kubernetes.conf
reload: true
with_dict: "{% raw %}{{ sysctl_config }}{% endraw %}"
with_dict: "{{ sysctl_config }}"
vars:
sysctl_config:
fs.inotify.max_queued_events: 65536
bootstrap/templates/ansible/playbooks/cluster-rollout-update.yaml.j2
+21 -21
View File
@@ -12,13 +12,13 @@
seconds: 5
tasks:
- name: Details
{% if bootstrap_distribution == 'k3s' %}
ansible.builtin.command: "k3s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
{% elif bootstrap_distribution == 'k0s' %}
ansible.builtin.command: "k0s kubectl get node {% raw %}{{ inventory_hostname }}{% endraw %} -o json"
{% endif %}
<% if bootstrap_distribution == 'k3s' %>
ansible.builtin.command: "k3s kubectl get node {{ inventory_hostname }} -o json"
<% elif bootstrap_distribution == 'k0s' %>
ansible.builtin.command: "k0s kubectl get node {{ inventory_hostname }} -o json"
<% endif %>
register: kubectl_get_node
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
delegate_to: "{{ groups['master'][0] }}"
failed_when: false
changed_when: false
@@ -31,23 +31,23 @@
block:
- name: Cordon
kubernetes.core.k8s_drain:
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
{% if bootstrap_distribution == 'k3s' %}
name: "{{ inventory_hostname }}"
<% if bootstrap_distribution == 'k3s' %>
kubeconfig: /etc/rancher/k3s/k3s.yaml
{% elif bootstrap_distribution == 'k0s' %}
<% elif bootstrap_distribution == 'k0s' %>
kubeconfig: /var/lib/k0s/pki/admin.conf
{% endif %}
<% endif %>
state: cordon
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
delegate_to: "{{ groups['master'][0] }}"
- name: Drain
kubernetes.core.k8s_drain:
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
{% if bootstrap_distribution == 'k3s' %}
name: "{{ inventory_hostname }}"
<% if bootstrap_distribution == 'k3s' %>
kubeconfig: /etc/rancher/k3s/k3s.yaml
{% elif bootstrap_distribution == 'k0s' %}
<% elif bootstrap_distribution == 'k0s' %>
kubeconfig: /var/lib/k0s/pki/admin.conf
{% endif %}
<% endif %>
state: drain
delete_options:
delete_emptydir_data: true
@@ -57,7 +57,7 @@
pod_selectors:
# Rook Ceph
- app!=rook-ceph-osd
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
delegate_to: "{{ groups['master'][0] }}"
- name: Update
ansible.builtin.apt:
@@ -78,11 +78,11 @@
- name: Uncordon
kubernetes.core.k8s_drain:
name: "{% raw %}{{ inventory_hostname }}{% endraw %}"
{% if bootstrap_distribution == 'k3s' %}
name: "{{ inventory_hostname }}"
<% if bootstrap_distribution == 'k3s' %>
kubeconfig: /etc/rancher/k3s/k3s.yaml
{% elif bootstrap_distribution == 'k0s' %}
<% elif bootstrap_distribution == 'k0s' %>
kubeconfig: /var/lib/k0s/pki/admin.conf
{% endif %}
<% endif %>
state: uncordon
delegate_to: "{% raw %}{{ groups['master'][0] }}{% endraw %}"
delegate_to: "{{ groups['master'][0] }}"
bootstrap/templates/ansible/playbooks/tasks/cilium.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
- name: Cilium
block:
@@ -55,4 +55,4 @@
definition:
metadata:
finalizers: []
{% endif %}
<% endif %>
bootstrap/templates/ansible/playbooks/tasks/coredns.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
- name: Coredns
block:
@@ -55,4 +55,4 @@
definition:
metadata:
finalizers: []
{% endif %}
<% endif %>
bootstrap/templates/ansible/playbooks/tasks/cruft.yaml.j2
+7 -7
View File
@@ -1,11 +1,11 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
# https://github.com/k3s-io/k3s/issues/1971
- name: Cruft
block:
- name: Cruft | Get list of custom manifests
ansible.builtin.find:
paths: "{% raw %}{{ k3s_server_manifests_dir }}{% endraw %}"
paths: "{{ k3s_server_manifests_dir }}"
file_type: file
use_regex: true
patterns: ["^custom-.*"]
@@ -13,9 +13,9 @@
- name: Cruft | Delete custom manifests
ansible.builtin.file:
path: "{% raw %}{{ item.path }}{% endraw %}"
path: "{{ item.path }}"
state: absent
loop: "{% raw %}{{ custom_manifest.files }}{% endraw %}"
loop: "{{ custom_manifest.files }}"
- name: Cruft | Get list of custom addons
kubernetes.core.k8s_info:
@@ -26,9 +26,9 @@
- name: Cruft | Delete addons
kubernetes.core.k8s:
kubeconfig: /etc/rancher/k3s/k3s.yaml
name: "{% raw %}{{ item.metadata.name }}{% endraw %}"
name: "{{ item.metadata.name }}"
kind: Addon
namespace: kube-system
state: absent
loop: "{% raw %}{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}{% endraw %}"
{% endif %}
loop: "{{ addons_list.resources | selectattr('metadata.name', 'match', '^custom-.*') | list }}"
<% endif %>
bootstrap/templates/ansible/playbooks/tasks/kubeconfig.yaml.j2
+5 -5
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
- name: Get absolute path to this Git repository # noqa: command-instead-of-module
ansible.builtin.command: git rev-parse --show-toplevel
@@ -14,7 +14,7 @@
when: k3s_primary_control_node
ansible.builtin.fetch:
src: /etc/rancher/k3s/k3s.yaml
dest: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
dest: "{{ repository_path.stdout }}/kubeconfig"
flat: true
- name: Update kubeconfig with the correct load balancer address
@@ -22,7 +22,7 @@
become: false
run_once: true
ansible.builtin.replace:
path: "{% raw %}{{ repository_path.stdout }}{% endraw %}/kubeconfig"
path: "{{ repository_path.stdout }}/kubeconfig"
regexp: https://127.0.0.1:6443
replace: "https://{% raw %}{{ k3s_registration_address }}{% endraw %}:6443"
{% endif %}
replace: "https://{{ k3s_registration_address }}:6443"
<% endif %>
bootstrap/templates/ansible/playbooks/templates/custom-cilium-helmchart.yaml.j2.j2
+11 -11
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
# https://docs.k3s.io/helm
apiVersion: helm.cattle.io/v1
@@ -31,29 +31,29 @@ spec:
enabled: false
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "{% raw %}{{ cluster_cidr }}{% endraw %}"
{% if bootstrap_ipv6_enabled | default(false) %}
ipv6NativeRoutingCIDR: "{% raw %}{{ cluster_cidr_v6 }}{% endraw %}"
ipv4NativeRoutingCIDR: "{{ cluster_cidr }}"
<% if bootstrap_ipv6_enabled | default(false) %>
ipv6NativeRoutingCIDR: "{{ cluster_cidr_v6 }}"
ipv6:
enabled: true
{% endif %}
k8sServiceHost: "{% raw %}{{ kube_api_addr }}{% endraw %}"
<% endif %>
k8sServiceHost: "{{ kube_api_addr }}"
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
{% if bootstrap_ipv6_enabled | default(false) %}
<% if bootstrap_ipv6_enabled | default(false) %>
enabled: false
{% else %}
<% else %>
enabled: true
# https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s
leaseRenewDeadline: 60s
leaseRetryPeriod: 1s
{% endif %}
<% endif %>
loadBalancer:
algorithm: maglev
mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >>
localRedirectPolicy: true
operator:
replicas: 1
@@ -62,4 +62,4 @@ spec:
routingMode: native
securityContext:
privileged: true
{% endif %}
<% endif %>
bootstrap/templates/ansible/playbooks/templates/custom-coredns-helmchart.yaml.j2.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
---
# https://docs.k3s.io/helm
apiVersion: helm.cattle.io/v1
@@ -19,7 +19,7 @@ spec:
k8sAppLabelOverride: kube-dns
service:
name: kube-dns
clusterIP: "{% raw %}{{ coredns_addr }}{% endraw %}"
clusterIP: "{{ coredns_addr }}"
serviceAccount:
create: true
deployment:
@@ -76,4 +76,4 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/instance: coredns
{% endif %}
<% endif %>
bootstrap/templates/ansible/playbooks/templates/kube-vip-static-pod.yaml.j2.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %}
<% if bootstrap_distribution == 'k3s' and bootstrap_nodes.master | length > 1 and not bootstrap_kube_api_addr %>
---
apiVersion: v1
kind: Pod
@@ -16,7 +16,7 @@ spec:
args: ["manager"]
env:
- name: address
value: "{% raw %}{{ kube_api_addr }}{% endraw %}"
value: "{{ kube_api_addr }}"
- name: vip_arp
value: "true"
- name: lb_enable
@@ -58,4 +58,4 @@ spec:
- name: kubeconfig
hostPath:
path: /etc/rancher/k3s/k3s.yaml
{% endif %}
<% endif %>
bootstrap/templates/k0s-config.yaml.j2
+42 -42
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == 'k0s' %}
<% if bootstrap_distribution == 'k0s' %>
---
apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
@@ -6,25 +6,25 @@ metadata:
name: k0s-cluster
spec:
hosts:
{% for item in bootstrap_nodes.master %}
- role: {{ item.role | default('controller+worker') }}
<% for item in bootstrap_nodes.master %>
- role: << item.role | default('controller+worker') >>
ssh:
address: {{ item.address }}
user: {{ item.username }}
address: << item.address >>
user: << item.username >>
installFlags:
- --disable-components=metrics-server
{% if item.role | default('') == 'controller+worker' %}
<% if item.role | default('') == 'controller+worker' %>
- --no-taints
{% endif %}
{% endfor %}
{% if bootstrap_nodes.worker | default([]) | length > 0 %}
{% for item in bootstrap_nodes.worker %}
<% endif %>
<% endfor %>
<% if bootstrap_nodes.worker | default([]) | length > 0 %>
<% for item in bootstrap_nodes.worker %>
- role: worker
ssh:
address: {{ item.address }}
user: {{ item.username }}
{% endfor %}
{% endif %}
address: << item.address >>
user: << item.username >>
<% endfor %>
<% endif %>
k0s:
# renovate: datasource=github-releases depName=k0sproject/k0s
version: "v1.28.5+k0s.0"
@@ -43,18 +43,18 @@ spec:
bind-address: "0.0.0.0"
api:
sans:
- {{ bootstrap_kube_api_addr }}
{% if bootstrap_kubeapi_hostname is defined %}
- {{ bootstrap_kubeapi_hostname }}
{% endif %}
{% for item in bootstrap_nodes.master %}
{% if item.address != bootstrap_kube_api_addr %}
- {{ item.address }}
{% endif %}
{% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %}
- {{ item.name }}
{% endif %}
{% endfor %}
- << bootstrap_kube_api_addr >>
<% if bootstrap_kubeapi_hostname is defined %>
- << bootstrap_kubeapi_hostname >>
<% endif %>
<% for item in bootstrap_nodes.master %>
<% if item.address != bootstrap_kube_api_addr %>
- << item.address >>
<% endif %>
<% if (bootstrap_kubeapi_hostname is not defined) or (item.name != bootstrap_kubeapi_hostname) %>
- << item.name >>
<% endif %>
<% endfor %>
extensions:
helm:
repositories:
@@ -84,33 +84,33 @@ spec:
enabled: false
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "{{ bootstrap_cluster_cidr }}"
{% if bootstrap_ipv6_enabled | default(false) %}
ipv6NativeRoutingCIDR: "{{ bootstrap_cluster_cidr_v6 }}"
ipv4NativeRoutingCIDR: "<< bootstrap_cluster_cidr >>"
<% if bootstrap_ipv6_enabled | default(false) %>
ipv6NativeRoutingCIDR: "<< bootstrap_cluster_cidr_v6 >>"
ipv6:
enabled: true
{% endif %}
{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
k8sServiceHost: {{ bootstrap_nodes.master[0].address }}
{% else %}
k8sServiceHost: {{ bootstrap_kube_api_addr }}
{% endif %}
<% endif %>
<% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %>
k8sServiceHost: << bootstrap_nodes.master[0].address >>
<% else %>
k8sServiceHost: << bootstrap_kube_api_addr >>
<% endif %>
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
{% if bootstrap_ipv6_enabled | default(false) %}
<% if bootstrap_ipv6_enabled | default(false) %>
enabled: false
{% else %}
<% else %>
enabled: true
# https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s
leaseRenewDeadline: 60s
leaseRetryPeriod: 1s
{% endif %}
<% endif %>
loadBalancer:
algorithm: maglev
mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >>
localRedirectPolicy: true
operator:
replicas: 1
@@ -122,10 +122,10 @@ spec:
network:
kubeProxy:
disabled: true
{% if bootstrap_nodes.master | length > 1 %}
<% if bootstrap_nodes.master | length > 1 %>
nodeLocalLoadBalancing:
enabled: true
type: EnvoyProxy
{% endif %}
<% endif %>
provider: custom
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml.j2
+4 -4
View File
@@ -28,11 +28,11 @@ spec:
severity: warning
annotations:
description: >
The domain that this cert covers will be unavailable after {% raw %}{{ $value | humanizeDuration }}{% endraw %}.
Clients using endpoints that this cert protects will start to fail in {% raw %}{{ $value | humanizeDuration }}{% endraw %}.
The domain that this cert covers will be unavailable after {{ $value | humanizeDuration }}.
Clients using endpoints that this cert protects will start to fail in {{ $value | humanizeDuration }}.
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
summary: |
The cert {% raw %}{{ $labels.name }}{% endraw %} is {% raw %}{{ $value | humanizeDuration }}{% endraw %} from expiry, it should have renewed over a week ago.
The cert {{ $labels.name }} is {{ $value | humanizeDuration }} from expiry, it should have renewed over a week ago.
- alert: CertManagerCertNotReady
expr: |
max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
@@ -45,7 +45,7 @@ spec:
10m. If the cert is being renewed or there is another valid cert, the ingress
controller _may_ be able to serve that instead.
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
summary: "The cert {% raw %}{{ $labels.name }}{% endraw %} is not ready to serve traffic."
summary: "The cert {{ $labels.name }} is not ready to serve traffic."
- alert: CertManagerHittingRateLimits
expr: |
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
bootstrap/templates/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata:
name: cert-manager-secret
stringData:
api-token: "{{ bootstrap_cloudflare_token }}"
api-token: "<< bootstrap_cloudflare_token >>"
bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if discord_template_notifier.enabled | default(false) %}
<% if discord_template_notifier.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -62,4 +62,4 @@ spec:
- path: /data/config.toml
subPath: config.toml
readOnly: true
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if discord_template_notifier.enabled | default(false) %}
<% if discord_template_notifier.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/discord-template-notifier/app/secret.sops.yaml.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if discord_template_notifier.enabled | default(false) %}
<% if discord_template_notifier.enabled | default(false) %>
---
apiVersion: v1
kind: Secret
@@ -12,5 +12,5 @@ stringData:
interval = "10m"
retry_limit = 5
sink.type = "discord"
sink.url = "{{ discord_template_notifier.webhook_url }}"
{% endif %}
sink.url = "<< discord_template_notifier.webhook_url >>"
<% endif %>
bootstrap/templates/kubernetes/apps/default/discord-template-notifier/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if discord_template_notifier.enabled | default(false) %}
<% if discord_template_notifier.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/homepage/app/configmap.yaml.j2
+5 -5
View File
@@ -1,4 +1,4 @@
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
---
apiVersion: v1
kind: ConfigMap
@@ -38,9 +38,9 @@ data:
description: Cloudflared Tunnel
widget:
type: cloudflared
accountid: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}{% endraw %}"
tunnelid: "{% raw %}{{ HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}{% endraw %}"
key: "{% raw %}{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}{% endraw %}"
accountid: "{{HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID}}"
tunnelid: "{{HOMEPAGE_VAR_CLOUDFLARED_TUNNELID}}"
key: "{{HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN}}"
settings.yaml: |
title: Dashboard
theme: dark
@@ -76,4 +76,4 @@ data:
dateStyle: long
timeStyle: short
hourCycle: h23
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/homepage/app/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -87,4 +87,4 @@ spec:
path: /app/config/widgets.yaml
serviceAccount:
create: true
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/homepage/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
@@ -6,4 +6,4 @@ resources:
- ./configmap.yaml
- ./helmrelease.yaml
- ./secret.sops.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/homepage/app/secret.sops.yaml.j2
+6 -6
View File
@@ -1,13 +1,13 @@
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
---
apiVersion: v1
kind: Secret
metadata:
name: homepage-secret
stringData:
HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "{{ bootstrap_cloudflare_account_tag }}"
HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "{{ bootstrap_cloudflare_tunnel_id }}"
HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "{{ bootstrap_cloudflare_token }}"
HOMEPAGE_VAR_CLOUDFLARED_ACCOUNTID: "<< bootstrap_cloudflare_account_tag >>"
HOMEPAGE_VAR_CLOUDFLARED_TUNNELID: "<< bootstrap_cloudflare_tunnel_id >>"
HOMEPAGE_VAR_CLOUDFLARED_API_TOKEN: "<< bootstrap_cloudflare_token >>"
HOMEPAGE_VAR_GRAFANA_USERNAME: admin
HOMEPAGE_VAR_GRAFANA_PASSWORD: "{{ grafana.password }}"
{% endif %}
HOMEPAGE_VAR_GRAFANA_PASSWORD: "<< grafana.password >>"
<% endif %>
bootstrap/templates/kubernetes/apps/default/homepage/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/default/kustomization.yaml.j2
+4 -4
View File
@@ -3,9 +3,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
- ./homepage/ks.yaml
{% endif %}
{% if discord_template_notifier.enabled | default(false) %}
<% endif %>
<% if discord_template_notifier.enabled | default(false) %>
- ./discord-template-notifier/ks.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata:
name: github-webhook-token-secret
stringData:
token: "{{ bootstrap_flux_github_webhook_token }}"
token: "<< bootstrap_flux_github_webhook_token >>"
bootstrap/templates/kubernetes/apps/flux-system/kustomization.yaml.j2
+2 -2
View File
@@ -4,6 +4,6 @@ kind: Kustomization
resources:
- ./namespace.yaml
- ./addons/ks.yaml
{% if weave_gitops.enabled | default(false) %}
<% if weave_gitops.enabled | default(false) %>
- ./weave-gitops/ks.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml.j2
+4 -4
View File
@@ -1,4 +1,4 @@
{% if weave_gitops.enabled | default(false) %}
<% if weave_gitops.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -32,13 +32,13 @@ spec:
ingress:
enabled: true
className: internal
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/group: Home
gethomepage.dev/name: Weave-gitops
gethomepage.dev/icon: flux-cd.png
{% endif %}
<% endif %>
hosts:
- host: &host "gitops.${SECRET_DOMAIN}"
paths:
@@ -56,4 +56,4 @@ spec:
impersonationResourceNames: ["admin"]
podAnnotations:
secret.reloader.stakater.com/reload: cluster-user-auth
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if weave_gitops.enabled | default(false) %}
<% if weave_gitops.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if weave_gitops.enabled | default(false) %}
<% if weave_gitops.enabled | default(false) %>
---
apiVersion: v1
kind: Secret
@@ -7,5 +7,5 @@ metadata:
type: Opaque
stringData:
username: admin
password: "{{ weave_gitops.password | encrypt }}"
{% endif %}
password: "<< weave_gitops.password | encrypt >>"
<% endif %>
bootstrap/templates/kubernetes/apps/flux-system/weave-gitops/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if weave_gitops.enabled | default(false) %}
<% if weave_gitops.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
+11 -11
View File
@@ -34,11 +34,11 @@ spec:
id: 1
containerRuntime:
integration: containerd
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
socketPath: /var/run/k3s/containerd/containerd.sock
{% else %}
<% else %>
socketPath: /var/run/k0s/containerd.sock
{% endif %}
<% endif %>
endpointRoutes:
enabled: true
hubble:
@@ -70,13 +70,13 @@ spec:
ingress:
enabled: true
className: internal
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/group: Network
gethomepage.dev/name: Cilium
gethomepage.dev/icon: cilium.png
{% endif %}
<% endif %>
hosts:
- "hubble.${SECRET_DOMAIN}"
tls:
@@ -85,28 +85,28 @@ spec:
ipam:
mode: kubernetes
ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
{% if bootstrap_ipv6_enabled | default(false) %}
<% if bootstrap_ipv6_enabled | default(false) %>
ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
ipv6:
enabled: true
{% endif %}
<% endif %>
k8sServiceHost: "${KUBE_API_ADDR}"
k8sServicePort: 6443
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
{% if bootstrap_ipv6_enabled | default(false) %}
<% if bootstrap_ipv6_enabled | default(false) %>
enabled: false
{% else %}
<% else %>
enabled: true
# https://github.com/cilium/cilium/issues/26586
leaseDuration: 120s
leaseRenewDeadline: 60s
leaseRetryPeriod: 1s
{% endif %}
<% endif %>
loadBalancer:
algorithm: maglev
mode: {{ bootstrap_cilium_loadbalancer_mode | default('dsr', true) }}
mode: << bootstrap_cilium_loadbalancer_mode | default('dsr', true) >>
localRedirectPolicy: true
operator:
replicas: 1
bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
+2 -2
View File
@@ -2,7 +2,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
{% if not bootstrap_ipv6_enabled | default(false) %}
<% if not bootstrap_ipv6_enabled | default(false) %>
- ./cilium-l2.yaml
{% endif %}
<% endif %>
- ./helmrelease.yaml
bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -87,4 +87,4 @@ spec:
labelSelector:
matchLabels:
app.kubernetes.io/instance: coredns
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,7 +1,7 @@
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/kube-system/coredns/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/kube-system/kustomization.yaml.j2
+2 -2
View File
@@ -4,7 +4,7 @@ kind: Kustomization
resources:
- ./namespace.yaml
- ./cilium/ks.yaml
{% if bootstrap_distribution == "k3s" %}
<% if bootstrap_distribution == "k3s" %>
- ./coredns/ks.yaml
{% endif %}
<% endif %>
- ./metrics-server/ks.yaml
bootstrap/templates/kubernetes/apps/network/cloudflared/app/secret.sops.yaml.j2
+4 -4
View File
@@ -4,10 +4,10 @@ kind: Secret
metadata:
name: cloudflared-secret
stringData:
TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
TUNNEL_ID: "<< bootstrap_cloudflare_tunnel_id >>"
credentials.json: |
{
"AccountTag": "{{ bootstrap_cloudflare_account_tag }}",
"TunnelSecret": "{{ bootstrap_cloudflare_tunnel_secret }}",
"TunnelID": "{{ bootstrap_cloudflare_tunnel_id }}"
"AccountTag": "<< bootstrap_cloudflare_account_tag >>",
"TunnelSecret": "<< bootstrap_cloudflare_tunnel_secret >>",
"TunnelID": "<< bootstrap_cloudflare_tunnel_id >>"
}
bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2
+3 -3
View File
@@ -71,14 +71,14 @@ spec:
className: external
annotations:
external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
gethomepage.dev/enabled: "true"
gethomepage.dev/group: Network
gethomepage.dev/name: Echo Server
gethomepage.dev/icon: mdi-video-input-antenna
{% endif %}
<% endif %>
hosts:
- host: &host "{% raw %}{{ .Release.Name }}{% endraw %}.${SECRET_DOMAIN}"
- host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
paths:
- path: /
service:
bootstrap/templates/kubernetes/apps/network/external-dns/app/secret.sops.yaml.j2
+1 -1
View File
@@ -4,4 +4,4 @@ kind: Secret
metadata:
name: external-dns-secret
stringData:
api-token: "{{ bootstrap_cloudflare_token }}"
api-token: "<< bootstrap_cloudflare_token >>"
bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2
+1 -1
View File
@@ -31,5 +31,5 @@ spec:
type: LoadBalancer
port: 53
annotations:
io.cilium/lb-ipam-ips: "{{ bootstrap_k8s_gateway_addr }}"
io.cilium/lb-ipam-ips: "<< bootstrap_k8s_gateway_addr >>"
externalTrafficPolicy: Cluster
bootstrap/templates/kubernetes/apps/network/nginx/certificates/kustomization.yaml.j2
+2 -2
View File
@@ -3,6 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./staging.yaml
{% if bootstrap_acme_production_enabled | default(false) %}
<% if bootstrap_acme_production_enabled | default(false) %>
- ./production.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/network/nginx/external/helmrelease.yaml.j2
Vendored
+4 -4
View File
@@ -33,7 +33,7 @@ spec:
service:
annotations:
external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
io.cilium/lb-ipam-ips: "{{ bootstrap_external_ingress_addr }}"
io.cilium/lb-ipam-ips: "<< bootstrap_external_ingress_addr >>"
externalTrafficPolicy: Cluster
ingressClassResource:
name: external
@@ -71,11 +71,11 @@ spec:
namespaceSelector:
any: true
extraArgs:
{% if bootstrap_acme_production_enabled | default(false) %}
<% if bootstrap_acme_production_enabled | default(false) %>
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
{% else %}
<% else %>
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
{% endif %}
<% endif %>
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
bootstrap/templates/kubernetes/apps/network/nginx/internal/helmrelease.yaml.j2
+4 -4
View File
@@ -31,7 +31,7 @@ spec:
service:
annotations:
external-dns.alpha.kubernetes.io/hostname: "internal.${SECRET_DOMAIN}"
io.cilium/lb-ipam-ips: "{{ bootstrap_internal_ingress_addr }}"
io.cilium/lb-ipam-ips: "<< bootstrap_internal_ingress_addr >>"
externalTrafficPolicy: Cluster
ingressClassResource:
name: internal
@@ -69,11 +69,11 @@ spec:
namespaceSelector:
any: true
extraArgs:
{% if bootstrap_acme_production_enabled | default(false) %}
<% if bootstrap_acme_production_enabled | default(false) %>
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
{% else %}
<% else %>
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-staging-tls"
{% endif %}
<% endif %>
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
bootstrap/templates/kubernetes/apps/observability/grafana/app/helmrelease.yaml.j2
+6 -6
View File
@@ -1,4 +1,4 @@
{% if grafana.enabled | default(false) %}
<% if grafana.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -160,7 +160,7 @@ spec:
ingress:
enabled: true
ingressClassName: internal
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/icon: grafana.png
@@ -168,9 +168,9 @@ spec:
gethomepage.dev/group: Observability
gethomepage.dev/widget.type: grafana
gethomepage.dev/widget.url: http://grafana.observability
gethomepage.dev/widget.username: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}{% endraw %}"
gethomepage.dev/widget.password: "{% raw %}{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}{% endraw %}"
{% endif %}
gethomepage.dev/widget.username: "{{`{{HOMEPAGE_VAR_GRAFANA_USERNAME}}`}}"
gethomepage.dev/widget.password: "{{`{{HOMEPAGE_VAR_GRAFANA_PASSWORD}}`}}"
<% endif %>
hosts:
- &host "grafana.${SECRET_DOMAIN}"
tls:
@@ -181,4 +181,4 @@ spec:
storageClassName: openebs-hostpath
testFramework:
enabled: false
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/grafana/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if grafana.enabled | default(false) %}
<% if grafana.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/grafana/app/secret.sops.yaml.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if grafana.enabled | default(false) %}
<% if grafana.enabled | default(false) %>
---
apiVersion: v1
kind: Secret
@@ -6,5 +6,5 @@ metadata:
name: grafana-admin-secret
stringData:
admin-user: admin
admin-password: "{{ grafana.password }}"
{% endif %}
admin-password: "<< grafana.password >>"
<% endif %>
bootstrap/templates/kubernetes/apps/observability/grafana/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if grafana.enabled | default(false) %}
<% if grafana.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/helmrelease.yaml.j2
+18 -18
View File
@@ -1,4 +1,4 @@
{% if kube_prometheus_stack.enabled | default(false) %}
<% if kube_prometheus_stack.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -54,7 +54,7 @@ spec:
enabled: true
serviceMonitor:
metricRelabelings:
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
# Remove duplicate labels provided by k3s
- action: keep
sourceLabels: ["__name__"]
@@ -62,7 +62,7 @@ spec:
- action: replace
sourceLabels: ["node"]
targetLabel: instance
{% endif %}
<% endif %>
# Drop high cardinality labels
- action: labeldrop
regex: (uid)
@@ -75,12 +75,12 @@ spec:
enabled: true
serviceMonitor:
metricRelabelings:
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
# Remove duplicate labels provided by k3s
- action: keep
sourceLabels: ["__name__"]
regex: (aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)
{% endif %}
<% endif %>
# Drop high cardinality labels
- action: drop
sourceLabels: ["__name__"]
@@ -91,49 +91,49 @@ spec:
kubeControllerManager:
enabled: true
endpoints: &endpoints
{% for item in bootstrap_nodes.master %}
- {{ item.address }}
{% endfor %}
{% if bootstrap_distribution == 'k3s' %}
<% for item in bootstrap_nodes.master %>
- << item.address >>
<% endfor %>
<% if bootstrap_distribution == 'k3s' %>
serviceMonitor:
metricRelabelings:
# Remove duplicate labels provided by k3s
- action: keep
sourceLabels: ["__name__"]
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)"
{% endif %}
<% endif %>
kubeEtcd:
{% if bootstrap_nodes.master | length > 1 %}
<% if bootstrap_nodes.master | length > 1 %>
enabled: true
{% else %}
<% else %>
enabled: false
{% endif %}
<% endif %>
endpoints: *endpoints
kubeScheduler:
enabled: true
endpoints: *endpoints
{% if bootstrap_distribution == 'k3s' %}
<% if bootstrap_distribution == 'k3s' %>
serviceMonitor:
metricRelabelings:
# Remove duplicate labels provided by k3s
- action: keep
sourceLabels: ["__name__"]
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)"
{% endif %}
<% endif %>
kubeProxy:
enabled: false # Disabled due to eBPF
prometheus:
ingress:
enabled: true
ingressClassName: internal
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/icon: prometheus.png
gethomepage.dev/name: Prometheus
gethomepage.dev/group: Observability
gethomepage.dev/widget.type: prometheus
{% endif %}
<% endif %>
pathType: Prefix
hosts:
- "prometheus.${SECRET_DOMAIN}"
@@ -164,4 +164,4 @@ spec:
multicluster:
etcd:
enabled: true
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,7 +1,7 @@
{% if kube_prometheus_stack.enabled | default(false) %}
<% if kube_prometheus_stack.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kube-prometheus-stack/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if kube_prometheus_stack.enabled | default(false) %}
<% if kube_prometheus_stack.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/helmrelease.yaml.j2
+4 -4
View File
@@ -1,4 +1,4 @@
{% if kubernetes_dashboard.enabled | default(false) %}
<% if kubernetes_dashboard.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -32,13 +32,13 @@ spec:
ingress:
enabled: true
className: internal
{% if homepage.enabled | default(false) %}
<% if homepage.enabled | default(false) %>
annotations:
gethomepage.dev/enabled: "true"
gethomepage.dev/icon: kubernetes-dashboard.png
gethomepage.dev/name: Kubernetes Dashboard
gethomepage.dev/group: Observability
{% endif %}
<% endif %>
hosts:
- &host "kubernetes.${SECRET_DOMAIN}"
tls:
@@ -46,4 +46,4 @@ spec:
- *host
metricsScraper:
enabled: true
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if kubernetes_dashboard.enabled | default(false) %}
<% if kubernetes_dashboard.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./rbac.yaml
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/app/rbac.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if kubernetes_dashboard.enabled | default(false) %}
<% if kubernetes_dashboard.enabled | default(false) %>
# For dashboard sign in token:
# kubectl -n observability get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
---
@@ -38,4 +38,4 @@ subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: observability
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kubernetes-dashboard/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if kubernetes_dashboard.enabled | default(false) %}
<% if kubernetes_dashboard.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -22,4 +22,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/observability/kustomization.yaml.j2
+6 -6
View File
@@ -3,12 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
{% if grafana.enabled | default(false) %}
<% if grafana.enabled | default(false) %>
- ./grafana/ks.yaml
{% endif %}
{% if kube_prometheus_stack.enabled | default(false) %}
<% endif %>
<% if kube_prometheus_stack.enabled | default(false) %>
- ./kube-prometheus-stack/ks.yaml
{% endif %}
{% if kubernetes_dashboard.enabled | default(false) %}
<% endif %>
<% if kubernetes_dashboard.enabled | default(false) %>
- ./kubernetes-dashboard/ks.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if csi_driver_nfs.enabled | default(false) %}
<% if csi_driver_nfs.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -27,4 +27,4 @@ spec:
values:
externalSnapshotter:
enabled: false
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if csi_driver_nfs.enabled | default(false) %}
<% if csi_driver_nfs.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./storageclass.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/app/storageclass.yaml.j2
+7 -7
View File
@@ -1,16 +1,16 @@
{% if csi_driver_nfs.enabled | default(false) %}
{% for item in csi_driver_nfs.storage_class %}
<% if csi_driver_nfs.enabled | default(false) %>
<% for item in csi_driver_nfs.storage_class %>
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: {{ item.name }}
name: << item.name >>
provisioner: nfs.csi.k8s.io
parameters:
server: {{ item.server }}
share: {{ item.share }}
server: << item.server >>
share: << item.share >>
reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions: ["hard", "noatime"]
{% endfor %}
{% endif %}
<% endfor %>
<% endif %>
bootstrap/templates/kubernetes/apps/storage/csi-driver-nfs/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if csi_driver_nfs.enabled | default(false) %}
<% if csi_driver_nfs.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -19,4 +19,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/kustomization.yaml.j2
+4 -4
View File
@@ -4,9 +4,9 @@ kind: Kustomization
resources:
- ./namespace.yaml
- ./openebs/ks.yaml
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
- ./volsync/ks.yaml
{% endif %}
{% if csi_driver_nfs.enabled | default(false) %}
<% endif %>
<% if csi_driver_nfs.enabled | default(false) %>
- ./csi-driver-nfs/ks.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/openebs/app/helmrelease.yaml.j2
+1 -1
View File
@@ -29,5 +29,5 @@ spec:
enabled: true
name: openebs-hostpath
isDefaultClass: false
basePath: "{{ bootstrap_local_storage_path }}"
basePath: "<< bootstrap_local_storage_path >>"
bootstrap/templates/kubernetes/apps/storage/volsync/app/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -41,4 +41,4 @@ spec:
tag: *tag
metrics:
disableAuth: true
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/volsync/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
- ./prometheusrule.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/volsync/app/prometheusrule.yaml.j2
+3 -3
View File
@@ -1,4 +1,4 @@
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
@@ -17,9 +17,9 @@ spec:
severity: critical
- alert: VolSyncVolumeOutOfSync
annotations:
summary: "{% raw %}{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync.{% endraw %}"
summary: "{{ $labels.obj_namespace }}/{{ $labels.obj_name }} volume is out of sync."
expr: volsync_volume_out_of_sync == 1
for: 15m
labels:
severity: critical
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/volsync/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -39,4 +39,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -32,4 +32,4 @@ spec:
create: true
webhook:
enabled: false
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/storage/volsync/snapshot-controller/kustomization.yaml.j2
+2 -2
View File
@@ -1,7 +1,7 @@
{% if volsync.enabled | default(false) %}
<% if volsync.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/kustomization.yaml.j2
+2 -2
View File
@@ -5,6 +5,6 @@ resources:
- ./namespace.yaml
- ./descheduler/ks.yaml
- ./reloader/ks.yaml
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
- ./system-upgrade-controller/ks.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/reloader/app/helmrelease.yaml.j2
+1 -1
View File
@@ -29,4 +29,4 @@ spec:
readOnlyRootFileSystem: true
podMonitor:
enabled: true
namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}"
namespace: "{{ .Release.Namespace }}"
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/helmrelease.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
@@ -103,4 +103,4 @@ spec:
globalMounts:
- path: /etc/ca-certificates
readOnly: true
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/kustomization.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
@@ -7,4 +7,4 @@ resources:
- https://github.com/rancher/system-upgrade-controller/releases/download/v0.13.2/crd.yaml
- helmrelease.yaml
- rbac.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/app/rbac.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
@@ -12,4 +12,4 @@ subjects:
- kind: ServiceAccount
name: system-upgrade
namespace: tools
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/ks.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
@@ -41,4 +41,4 @@ spec:
interval: 30m
retryInterval: 1m
timeout: 5m
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/agent.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: upgrade.cattle.io/v1
kind: Plan
@@ -17,4 +17,4 @@ spec:
args: ["prepare", "server"]
upgrade:
image: rancher/k3s-upgrade
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/kustomization.yaml.j2
+2 -2
View File
@@ -1,8 +1,8 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./server.yaml
- ./agent.yaml
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/apps/tools/system-upgrade-controller/plans/server.yaml.j2
+2 -2
View File
@@ -1,4 +1,4 @@
{% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %}
<% if bootstrap_distribution == "k3s" and system_upgrade_controller.enabled | default(false) %>
---
apiVersion: upgrade.cattle.io/v1
kind: Plan
@@ -22,4 +22,4 @@ spec:
- {key: CriticalAddonsOnly, operator: Exists}
upgrade:
image: rancher/k3s-upgrade
{% endif %}
<% endif %>
bootstrap/templates/kubernetes/flux/config/cluster.yaml.j2
+6 -6
View File
@@ -7,14 +7,14 @@ metadata:
spec:
interval: 30m
ref:
branch: {{ bootstrap_github_repository_branch | default('main', true) }}
{% if bootstrap_private_github_repo | default(false) %}
branch: << bootstrap_github_repository_branch | default('main', true) >>
<% if bootstrap_private_github_repo | default(false) %>
secretRef:
name: github-deploy-key
url: "ssh://github.com/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}"
{% else %}
url: "https://github.com/{{ bootstrap_github_username }}/{{ bootstrap_github_repository_name }}.git"
{% endif %}
url: "ssh://github.com/<< bootstrap_github_username >>/<< bootstrap_github_repository_name >>"
<% else %>
url: "https://github.com/<< bootstrap_github_username >>/<< bootstrap_github_repository_name >>.git"
<% endif %>
ignore: |
# exclude all
/*
bootstrap/templates/kubernetes/flux/vars/cluster-secrets.sops.yaml.j2
+3 -3
View File
@@ -5,6 +5,6 @@ metadata:
name: cluster-secrets
namespace: flux-system
stringData:
SECRET_DOMAIN: "{{ bootstrap_cloudflare_domain }}"
SECRET_ACME_EMAIL: "{{ bootstrap_acme_email }}"
SECRET_CLOUDFLARE_TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
SECRET_DOMAIN: "<< bootstrap_cloudflare_domain >>"
SECRET_ACME_EMAIL: "<< bootstrap_acme_email >>"
SECRET_CLOUDFLARE_TUNNEL_ID: "<< bootstrap_cloudflare_tunnel_id >>"
bootstrap/templates/kubernetes/flux/vars/cluster-settings.yaml.j2
+14 -14
View File
@@ -5,17 +5,17 @@ metadata:
name: cluster-settings
namespace: flux-system
data:
TIMEZONE: "{{ bootstrap_timezone }}"
COREDNS_ADDR: "{{ bootstrap_service_cidr.split(',')[0] | nthhost(10) }}"
{% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %}
KUBE_API_ADDR: "{{ bootstrap_nodes.master[0].address }}"
{% else %}
KUBE_API_ADDR: "{{ bootstrap_kube_api_addr }}"
{% endif %}
CLUSTER_CIDR: "{{ bootstrap_cluster_cidr.split(',')[0] }}"
SERVICE_CIDR: "{{ bootstrap_service_cidr.split(',')[0] }}"
NODE_CIDR: "{{ bootstrap_node_cidr }}"
{% if bootstrap_ipv6_enabled | default(false) %}
CLUSTER_CIDR_V6: "{{ bootstrap_cluster_cidr.split(',')[1] }}"
SERVICE_CIDR_V6: "{{ bootstrap_service_cidr.split(',')[1] }}"
{% endif %}
TIMEZONE: "<< bootstrap_timezone >>"
COREDNS_ADDR: "<< bootstrap_service_cidr.split(',')[0] | nthhost(10) >>"
<% if bootstrap_nodes.master | length == 1 and not bootstrap_kube_api_addr %>
KUBE_API_ADDR: "<< bootstrap_nodes.master[0].address >>"
<% else %>
KUBE_API_ADDR: "<< bootstrap_kube_api_addr >>"
<% endif %>
CLUSTER_CIDR: "<< bootstrap_cluster_cidr.split(',')[0] >>"
SERVICE_CIDR: "<< bootstrap_service_cidr.split(',')[0] >>"
NODE_CIDR: "<< bootstrap_node_cidr >>"
<% if bootstrap_ipv6_enabled | default(false) %>
CLUSTER_CIDR_V6: "<< bootstrap_cluster_cidr.split(',')[1] >>"
SERVICE_CIDR_V6: "<< bootstrap_service_cidr.split(',')[1] >>"
<% endif %>
bootstrap/validate.yaml
-17
View File
@@ -26,20 +26,3 @@
- name: Verify configuration
ansible.builtin.include_tasks: tasks/validation/main.yaml
# - name: Template Sops configuration
# ansible.builtin.include_tasks: tasks/sops/main.yaml
# - name: Template k0s configuration
# when: bootstrap_distribution == "k0s"
# ansible.builtin.include_tasks: tasks/k0s/main.yaml
# - name: Template Ansible configuration
# when: bootstrap_distribution == "k0s" or bootstrap_distribution == "k3s"
# ansible.builtin.include_tasks: tasks/ansible/main.yaml
# - name: Template Kubernetes configuration
# ansible.builtin.include_tasks: tasks/kubernetes/main.yaml
# - name: Template Kubernetes addon configuration
# ansible.builtin.include_tasks: tasks/addons/main.yaml
makejinja.toml
+15
View File
@@ -0,0 +1,15 @@
[makejinja]
inputs = ["./bootstrap/templates"]
output = "./"
data = ["./bootstrap/vars/addons.yaml", "./bootstrap/vars/config.yaml"]
import_paths = ["./bootstrap/scripts"]
loaders = ["loader:Loader"]
jinja_suffix = ".j2"
[makejinja.delimiter]
block_start = "<%"
block_end = "%>"
comment_start = "<#"
comment_end = "#>"
variable_start = "<<"
variable_end = ">>"