From f49c4d89b4723d2bc2ff3369655fea426c90e017 Mon Sep 17 00:00:00 2001 From: Devin Buhl Date: Wed, 14 Apr 2021 12:34:44 -0400 Subject: [PATCH] feat: add cert-manager --- README.md | 28 ++++++++------ cluster/base/cluster-secrets.yaml | 1 + .../core/crds/cert-manager/kustomization.yaml | 5 +++ cluster/core/crds/kustomization.yaml | 4 ++ .../cert-manager/kustomization.yaml | 6 +++ .../cert-manager/letsencrypt-production.yaml | 18 +++++++++ .../cert-manager/letsencrypt-staging.yaml | 18 +++++++++ .../cert-manager/secret.enc.yaml | 8 ++++ .../core/infrastructure/kustomization.yaml | 5 +++ .../infrastructure/metallb/helm-release.yaml | 37 +++++++++++++++++++ .../infrastructure/metallb/kustomization.yaml | 4 ++ cluster/core/kustomization.yaml | 6 +++ cluster/core/namespaces/cert-manger.yaml | 5 +++ cluster/core/namespaces/kustomization.yaml | 5 +++ cluster/core/namespaces/networking.yaml | 5 +++ .../operators/cert-manager/helm-release.yaml | 37 +++++++++++++++++++ .../operators/cert-manager/kustomization.yaml | 4 ++ cluster/core/operators/kustomization.yaml | 4 ++ 18 files changed, 189 insertions(+), 11 deletions(-) create mode 100644 cluster/core/crds/cert-manager/kustomization.yaml create mode 100644 cluster/core/crds/kustomization.yaml create mode 100644 cluster/core/infrastructure/cert-manager/kustomization.yaml create mode 100644 cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml create mode 100644 cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml create mode 100644 cluster/core/infrastructure/cert-manager/secret.enc.yaml create mode 100644 cluster/core/infrastructure/kustomization.yaml create mode 100644 cluster/core/infrastructure/metallb/helm-release.yaml create mode 100644 cluster/core/infrastructure/metallb/kustomization.yaml create mode 100644 cluster/core/kustomization.yaml create mode 100644 cluster/core/namespaces/cert-manger.yaml create mode 100644 cluster/core/namespaces/kustomization.yaml create mode 100644 cluster/core/namespaces/networking.yaml create mode 100644 cluster/core/operators/cert-manager/helm-release.yaml create mode 100644 cluster/core/operators/cert-manager/kustomization.yaml create mode 100644 cluster/core/operators/kustomization.yaml diff --git a/README.md b/README.md index aa287481..39002d69 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,15 @@ # cluster-k3s -Template for creating a k3s cluster with [k3sup](https://github.com/alexellis/k3sup), [Flux](https://toolkit.fluxcd.io/) and [SOPS](https://github.com/mozilla/sops) +Template for creating a [k3s](https://k3s.io/) cluster with [k3sup](https://github.com/alexellis/k3sup), [Flux](https://toolkit.fluxcd.io/) and [SOPS](https://github.com/mozilla/sops) -This template will bootstrap the nodes you want with the following components +This template will bootstrap the nodes you want with the following components: -- k3s -- flux -- metallb -- flannel +- [k3s](https://k3s.io/) +- [flannel](https://github.com/flannel-io/flannel) +- [local-path-provisioner](https://github.com/rancher/local-path-provisioner) +- [flux](https://toolkit.fluxcd.io/) +- [metallb](https://metallb.universe.tf/) +- [cert-manager](https://cert-manager.io/) with Cloudflare DNS challenge ## :memo:  Prerequisites @@ -112,8 +114,8 @@ k3sup join \ ```sh kubectl --kubeconfig=./kubeconfig get nodes # NAME STATUS ROLES AGE VERSION -# k8s-master-a Ready control-plane,master 4d14h v1.20.5+k3s1 -# k8s-worker-a Ready worker 4d14h v1.20.5+k3s1 +# k8s-master-a Ready control-plane,master 4d20h v1.20.5+k3s1 +# k8s-worker-a Ready worker 4d20h v1.20.5+k3s1 ``` ### GitOps with Flux @@ -137,21 +139,25 @@ kubectl --kubeconfig=./kubeconfig create secret generic sops-gpg \ ```sh export BOOTSTRAP_GITHUB_REPOSITORY="k8s-at-home/home-cluster" -export BOOTSTRAP_DOMAIN="k8s-at-home.com" export BOOTSTRAP_METALLB_LB_RANGE="169.254.1.10-169.254.1.20" +export BOOTSTRAP_DOMAIN="k8s-at-home.com" +export BOOTSTRAP_CLOUDFLARE_TOKEN="dsKq41iLAbXE37GV" envsubst < ./.sops.yaml envsubst < ./cluster/cluster-secrets.yaml envsubst < ./cluster/cluster-settings.yaml envsubst < ./cluster/base/flux-system/gotk-sync.yaml +envsubst < ./cluster/core/infrastructure/cert-manager/secret.enc.yaml ``` 4. **Verify** all the above files have the correct information present -5. Encrypt `cluster-settings.yaml` with SOPS +5. Encrypt `cluster-settings.yaml` and `secret.enc.yaml` with SOPS ```sh +export GPG_TTY=$(tty) sops --encrypt --in-place ./cluster/base/cluster-secrets.yaml +sops --encrypt --in-place ./cluster/core/infrastructure/cert-manager/secret.enc.yaml ``` 6. **Verify** this file **is encrypted** with SOPS @@ -180,4 +186,4 @@ pre-commit install-hooks ## :handshake:  Thanks -A lot of inspiration for my cluster came from the people that have shared their clusters over at [awesome-home-kubernetes](https://github.com/k8s-at-home/awesome-home-kubernetes) \ No newline at end of file +Big shout out to all the authors and contributors to the projects that we are using in this repository. \ No newline at end of file diff --git a/cluster/base/cluster-secrets.yaml b/cluster/base/cluster-secrets.yaml index 3cc08d38..2ea1b1a5 100644 --- a/cluster/base/cluster-secrets.yaml +++ b/cluster/base/cluster-secrets.yaml @@ -6,3 +6,4 @@ metadata: namespace: flux-system stringData: SECRET_DOMAIN: $BOOTSTRAP_DOMAIN + SECRET_CLOUDFLARE_EMAIL: $BOOTSTRAP_CLOUDFLARE_EMAIL diff --git a/cluster/core/crds/cert-manager/kustomization.yaml b/cluster/core/crds/cert-manager/kustomization.yaml new file mode 100644 index 00000000..ad900c87 --- /dev/null +++ b/cluster/core/crds/cert-manager/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +# renovate: registryUrl=https://charts.jetstack.io chart=cert-manager +- https://github.com/jetstack/cert-manager/releases/download/v1.3.0/cert-manager.crds.yaml diff --git a/cluster/core/crds/kustomization.yaml b/cluster/core/crds/kustomization.yaml new file mode 100644 index 00000000..75b65cfc --- /dev/null +++ b/cluster/core/crds/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cert-manager diff --git a/cluster/core/infrastructure/cert-manager/kustomization.yaml b/cluster/core/infrastructure/cert-manager/kustomization.yaml new file mode 100644 index 00000000..cf778581 --- /dev/null +++ b/cluster/core/infrastructure/cert-manager/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- letsencrypt-production.yaml +- letsencrypt-staging.yaml +- secret.enc.yaml diff --git a/cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml b/cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml new file mode 100644 index 00000000..e2efbfe5 --- /dev/null +++ b/cluster/core/infrastructure/cert-manager/letsencrypt-production.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: "${SECRET_CLOUDFLARE_EMAIL}" + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiKeySecretRef: + name: cloudflare-token-secret + key: cloudflare-token diff --git a/cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml b/cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml new file mode 100644 index 00000000..a92ebcb6 --- /dev/null +++ b/cluster/core/infrastructure/cert-manager/letsencrypt-staging.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: "${SECRET_CLOUDFLARE_EMAIL}" + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - dns01: + cloudflare: + email: "${SECRET_CLOUDFLARE_EMAIL}" + apiKeySecretRef: + name: cloudflare-token-secret + key: cloudflare-token diff --git a/cluster/core/infrastructure/cert-manager/secret.enc.yaml b/cluster/core/infrastructure/cert-manager/secret.enc.yaml new file mode 100644 index 00000000..6308663c --- /dev/null +++ b/cluster/core/infrastructure/cert-manager/secret.enc.yaml @@ -0,0 +1,8 @@ +# yamllint disable +apiVersion: v1 +kind: Secret +metadata: + name: cloudflare-token-secret + namespace: cert-manager +stringData: + cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN} diff --git a/cluster/core/infrastructure/kustomization.yaml b/cluster/core/infrastructure/kustomization.yaml new file mode 100644 index 00000000..749e1da3 --- /dev/null +++ b/cluster/core/infrastructure/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cert-manager +- metallb diff --git a/cluster/core/infrastructure/metallb/helm-release.yaml b/cluster/core/infrastructure/metallb/helm-release.yaml new file mode 100644 index 00000000..b9266346 --- /dev/null +++ b/cluster/core/infrastructure/metallb/helm-release.yaml @@ -0,0 +1,37 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: metallb + namespace: networking +spec: + interval: 5m + chart: + spec: + chart: metallb + version: 2.3.5 + sourceRef: + kind: HelmRepository + name: bitnami-charts + namespace: flux-system + interval: 10m + values: + controller: + image: + repository: metallb/controller + tag: v0.9.6 + speaker: + image: + repository: metallb/speaker + tag: v0.9.6 + prometheus: + serviceMonitor: + enabled: false + prometheusRule: + enabled: false + configInline: + address-pools: + - name: default + protocol: layer2 + addresses: + - "${METALLB_LB_RANGE}" diff --git a/cluster/core/infrastructure/metallb/kustomization.yaml b/cluster/core/infrastructure/metallb/kustomization.yaml new file mode 100644 index 00000000..761d2252 --- /dev/null +++ b/cluster/core/infrastructure/metallb/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- helm-release.yaml diff --git a/cluster/core/kustomization.yaml b/cluster/core/kustomization.yaml new file mode 100644 index 00000000..83238395 --- /dev/null +++ b/cluster/core/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- crds +- infrastructure +- namespaces diff --git a/cluster/core/namespaces/cert-manger.yaml b/cluster/core/namespaces/cert-manger.yaml new file mode 100644 index 00000000..6bc19f4c --- /dev/null +++ b/cluster/core/namespaces/cert-manger.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: cert-manager diff --git a/cluster/core/namespaces/kustomization.yaml b/cluster/core/namespaces/kustomization.yaml new file mode 100644 index 00000000..8b2d090b --- /dev/null +++ b/cluster/core/namespaces/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cert-manager.yaml +- networking.yaml diff --git a/cluster/core/namespaces/networking.yaml b/cluster/core/namespaces/networking.yaml new file mode 100644 index 00000000..fa9575ea --- /dev/null +++ b/cluster/core/namespaces/networking.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: networking diff --git a/cluster/core/operators/cert-manager/helm-release.yaml b/cluster/core/operators/cert-manager/helm-release.yaml new file mode 100644 index 00000000..d1bbca45 --- /dev/null +++ b/cluster/core/operators/cert-manager/helm-release.yaml @@ -0,0 +1,37 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: cert-manager + namespace: cert-manager +spec: + interval: 5m + chart: + spec: + # renovate: registryUrl=https://charts.jetstack.io/ + chart: cert-manager + version: v1.3.0 + sourceRef: + kind: HelmRepository + name: jetstack-charts + namespace: flux-system + interval: 5m + values: + installCRDs: false + webhook: + enabled: true + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53 + - --dns01-recursive-nameservers-only + cainjector: + replicaCount: 1 + podDnsPolicy: "None" + podDnsConfig: + nameservers: + - "1.1.1.1" + - "8.8.8.8" + prometheus: + enabled: false + servicemonitor: + enabled: false + prometheusInstance: monitoring diff --git a/cluster/core/operators/cert-manager/kustomization.yaml b/cluster/core/operators/cert-manager/kustomization.yaml new file mode 100644 index 00000000..761d2252 --- /dev/null +++ b/cluster/core/operators/cert-manager/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- helm-release.yaml diff --git a/cluster/core/operators/kustomization.yaml b/cluster/core/operators/kustomization.yaml new file mode 100644 index 00000000..75b65cfc --- /dev/null +++ b/cluster/core/operators/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- cert-manager