feat: move namespaces defs into apps and utilize fluxcd.io/prune label

Signed-off-by: Devin Buhl <devin@buhl.casa>
2022-06-16 19:44:26 -04:00
1 parent fc7ddff94a
commit fb5b38e7a8
@@ -17,11 +17,16 @@ spec:
      interval: 5m
  install:
    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
  values:
    global:
      nameOverride: *app
    controller:
-      replicas: 2
+      replicas: 1
      strategy: RollingUpdate
    image:
      repository: docker.io/jmalloc/echo-server
@@ -84,15 +89,6 @@ spec:
          - hosts:
              - *host
            secretName: "echo-server-tls"
-    # # FIXME: Uncomment this block to ensure multiple
-    # # replicas of the pod are scheduled on different nodes
-    # topologySpreadConstraints:
-    #   - maxSkew: 1
-    #     topologyKey: kubernetes.io/hostname
-    #     whenUnsatisfiable: DoNotSchedule
-    #     labelSelector:
-    #       matchLabels:
-    #         app.kubernetes.io/name: *app
    resources:
      requests:
        cpu: 50m
@@ -2,5 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - echo-server
  - hajimari
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rbac.yaml
+  - daemon-set.yaml
+labels:
+  - pairs:
+      kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-vip
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  name: system:kube-vip-role
+rules:
+  - apiGroups: [""]
+    resources: ["services", "services/status", "nodes"]
+    verbs: ["list", "get", "watch", "update"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["list", "get", "watch", "update", "create"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: system:kube-vip-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:kube-vip-role
+subjects:
+  - kind: ServiceAccount
+    name: kube-vip
+    namespace: kube-system
@@ -2,6 +2,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
+  - kube-vip
  # - kured
  - metrics-server
  - reflector
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -2,7 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - system-upgrade
  - default
+  - flux-system
  - kube-system
+  - metallb-system
  - networking
+  # - system-upgrade
@@ -15,9 +15,6 @@ spec:
        name: k8s-at-home
        namespace: flux-system
      interval: 5m
-  dependsOn:
-    - name: traefik
-      namespace: networking
  install:
    createNamespace: true
    remediation:
@@ -25,6 +22,9 @@ spec:
  upgrade:
    remediation:
      retries: 3
+  dependsOn:
+    - name: traefik
+      namespace: networking
  values:
    image:
      repository: ghcr.io/tarampampam/error-pages
@@ -17,6 +17,11 @@ spec:
      interval: 5m
  install:
    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
  values:
    interval: 5m
    logLevel: debug
@@ -15,6 +15,16 @@ spec:
        name: k8s-gateway
        namespace: flux-system
      interval: 5m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: metallb
+      namespace: networking
  values:
    fullnameOverride: k8s-gateway
    domain: ${SECRET_DOMAIN}
@@ -25,17 +35,3 @@ spec:
      annotations:
        metallb.universe.tf/loadBalancerIPs: "${METALLB_K8S_GATEWAY_ADDR}"
      externalTrafficPolicy: Local
-    # Increase replicaCount and set an anti-affinity if you wish to scale this
-    # replicaCount: 1
-    # affinity:
-    #   podAntiAffinity:
-    #     preferredDuringSchedulingIgnoredDuringExecution:
-    #       - weight: 100
-    #         podAffinityTerm:
-    #           labelSelector:
-    #             matchExpressions:
-    #               - key: app.kubernetes.io/name
-    #                 operator: In
-    #                 values:
-    #                   - k8s-gateway
-    #           topologyKey: kubernetes.io/hostname
@@ -2,6 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - error-pages
  - cloudflare-ddns
  - external-dns
@@ -0,0 +1,30 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: metallb
+  namespace: networking
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: metallb
+      version: 0.12.1
+      sourceRef:
+        kind: HelmRepository
+        name: metallb
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    configInline:
+      address-pools:
+        - name: default
+          protocol: layer2
+          addresses:
+            - "${METALLB_LB_RANGE}"
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: networking
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -15,9 +15,6 @@ spec:
        name: traefik
        namespace: flux-system
      interval: 5m
-  dependsOn:
-    - name: cert-manager
-      namespace: cert-manager
  install:
    createNamespace: true
    remediation:
@@ -25,6 +22,11 @@ spec:
  upgrade:
    remediation:
      retries: 3
+  dependsOn:
+    - name: cert-manager
+      namespace: cert-manager
+    - name: metallb
+      namespace: networking
  values:
    deployment:
      kind: Deployment
@@ -2,4 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - system-upgrade-controller
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: system-upgrade
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -8,5 +8,14 @@ images:
  - name: rancher/system-upgrade-controller
    newName: docker.io/rancher/system-upgrade-controller
    newTag: v0.9.1
+commonLabels:
+  app.kubernetes.io/name: system-upgrade-controller
+  app.kubernetes.io/instance: system-upgrade-controller
 patchesStrategicMerge:
-  - ./system-upgrade-patches.yaml
+  # Delete namespace resource
+  - |
+    $patch: delete
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: system-upgrade
@@ -1,9 +0,0 @@
---
-# Namespace should already exist
-# Delete the system-upgrade namespace
-# from the kustomization
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: system-upgrade