infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: move kubernetes dir into templates to support jinja2 across all files (#831)

Browse Source
This commit is contained in:
Devin Buhl authored and GitHub committed 2023-07-05 21:17:10 -04:00
1 parent 7b0a154fed
commit fe41cf6ea5
134 files changed
+192 -177
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
-42
View File
@@ -1,42 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 30m
chart:
spec:
chart: cert-manager
version: v1.12.2
sourceRef:
kind: HelmRepository
name: jetstack
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
installCRDs: true
extraArgs:
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
- --dns01-recursive-nameservers-only
podDnsPolicy: None
podDnsConfig:
nameservers:
- "1.1.1.1"
- "9.9.9.9"
prometheus:
enabled: true
servicemonitor:
enabled: true
prometheusInstance: monitoring
kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: cert-manager
resources:
- ./helmrelease.yaml
- ./prometheusrule.yaml
kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml
-68
View File
@@ -1,68 +0,0 @@
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: cert-manager.rules
namespace: cert-manager
spec:
groups:
- name: cert-manager
rules:
- alert: CertManagerAbsent
expr: |
absent(up{job="cert-manager"})
for: 15m
labels:
severity: critical
annotations:
description:
"New certificates will not be able to be minted, and existing
ones can't be renewed until cert-manager is back."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
summary: "Cert Manager has dissapeared from Prometheus service discovery."
- name: certificates
rules:
- alert: CertManagerCertExpirySoon
expr: |
avg by (exported_namespace, namespace, name) (
certmanager_certificate_expiration_timestamp_seconds - time())
< (21 * 24 * 3600)
for: 15m
labels:
severity: warning
annotations:
description:
"The domain that this cert covers will be unavailable after
{{ $value | humanizeDuration }}. Clients using endpoints that this cert
protects will start to fail in {{ $value | humanizeDuration }}."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
summary:
"The cert {{ $labels.name }} is {{ $value | humanizeDuration }}
from expiry, it should have renewed over a week ago."
- alert: CertManagerCertNotReady
expr: |
max by (name, exported_namespace, namespace, condition) (
certmanager_certificate_ready_status{condition!="True"} == 1)
for: 15m
labels:
severity: critical
annotations:
description:
"This certificate has not been ready to serve traffic for at least
10m. If the cert is being renewed or there is another valid cert, the ingress
controller _may_ be able to serve that instead."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
summary: "The cert {{ $labels.name }} is not ready to serve traffic."
- alert: CertManagerHittingRateLimits
expr: |
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m]))
> 0
for: 15m
labels:
severity: critical
annotations:
description:
"Depending on the rate limit, cert-manager may be unable to generate
certificates for up to a week."
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
summary: "Cert manager hitting LetsEncrypt rate limits."
kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml
-39
View File
@@ -1,39 +0,0 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-production
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: "${SECRET_ACME_EMAIL}"
privateKeySecretRef:
name: letsencrypt-production
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cert-manager-secret
key: api-token
selector:
dnsZones:
- "${SECRET_DOMAIN}"
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: "${SECRET_ACME_EMAIL}"
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cert-manager-secret
key: api-token
selector:
dnsZones:
- "${SECRET_DOMAIN}"
kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./issuers.yaml
kubernetes/apps/cert-manager/cert-manager/ks.yaml
-34
View File
@@ -1,34 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-cert-manager
namespace: flux-system
spec:
path: ./kubernetes/apps/cert-manager/cert-manager/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-cert-manager-issuers
namespace: flux-system
spec:
dependsOn:
- name: cluster-apps-cert-manager
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/cert-manager/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cert-manager/ks.yaml
kubernetes/apps/cert-manager/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/default/echo-server/app/helmrelease.yaml
-77
View File
@@ -1,77 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: echo-server
namespace: default
spec:
interval: 30m
chart:
spec:
chart: app-template
version: 1.5.1
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: ingress-nginx
namespace: networking
values:
controller:
strategy: RollingUpdate
image:
repository: docker.io/jmalloc/echo-server
tag: 0.3.5
service:
main:
ports:
http:
port: &port 8080
probes:
liveness: &probes
enabled: true
custom: true
spec:
httpGet:
path: /health
port: *port
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
readiness: *probes
startup:
enabled: false
ingress:
main:
enabled: true
ingressClassName: nginx
annotations:
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
hajimari.io/icon: video-input-antenna
hosts:
- host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
resources:
requests:
cpu: 5m
memory: 10Mi
limits:
memory: 50Mi
kubernetes/apps/default/echo-server/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./helmrelease.yaml
kubernetes/apps/default/echo-server/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-echo-server
namespace: flux-system
spec:
path: ./kubernetes/apps/default/echo-server/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/default/hajimari/app/helmrelease.yaml
-70
View File
@@ -1,70 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: hajimari
namespace: default
spec:
interval: 30m
chart:
spec:
chart: hajimari
version: 2.0.2
sourceRef:
kind: HelmRepository
name: hajimari
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: ingress-nginx
namespace: networking
values:
hajimari:
title: Apps
darkTheme: espresso
alwaysTargetBlank: true
showGreeting: false
showAppGroups: false
showAppStatus: false
showBookmarkGroups: false
showGlobalBookmarks: false
showAppUrls: false
defaultEnable: true
namespaceSelector:
matchNames:
- default
- monitoring
ingress:
main:
enabled: true
ingressClassName: nginx
annotations:
hajimari.io/enable: "false"
hosts:
- host: &host "hajimari.${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
podAnnotations:
configmap.reloader.stakater.com/reload: hajimari-settings
persistence:
data:
enabled: true
type: emptyDir
resources:
requests:
cpu: 100m
memory: 128M
kubernetes/apps/default/hajimari/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./helmrelease.yaml
kubernetes/apps/default/hajimari/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-hajimari
namespace: flux-system
spec:
path: ./kubernetes/apps/default/hajimari/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/default/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./echo-server/ks.yaml
- ./hajimari/ks.yaml
kubernetes/apps/default/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: default
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/flux-system/addons/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-flux-webhooks
namespace: flux-system
spec:
path: ./kubernetes/apps/flux-system/addons/webhooks
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
-25
View File
@@ -1,25 +0,0 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: flux-webhook
namespace: flux-system
annotations:
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
hajimari.io/enable: "false"
spec:
ingressClassName: nginx
rules:
- host: &host "flux-webhook.${SECRET_DOMAIN}"
http:
paths:
- path: /hook/
pathType: Prefix
backend:
service:
name: webhook-receiver
port:
number: 80
tls:
- hosts:
- *host
kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./secret.sops.yaml
- ./ingress.yaml
- ./receiver.yaml
kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml
-26
View File
@@ -1,26 +0,0 @@
---
apiVersion: notification.toolkit.fluxcd.io/v1
kind: Receiver
metadata:
name: github-receiver
namespace: flux-system
spec:
type: github
events:
- ping
- push
secretRef:
name: github-webhook-token-secret
resources:
- apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
name: home-kubernetes
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
name: cluster
namespace: flux-system
- apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
name: cluster-apps
namespace: flux-system
kubernetes/apps/flux-system/addons/webhooks/kustomization.yaml
-5
View File
@@ -1,5 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./github
kubernetes/apps/flux-system/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./addons/ks.yaml
- ./weave-gitops/ks.yaml
kubernetes/apps/flux-system/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
-54
View File
@@ -1,54 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: weave-gitops
namespace: flux-system
spec:
interval: 30m
chart:
spec:
chart: weave-gitops
version: 4.0.24
sourceRef:
kind: HelmRepository
name: weave-gitops
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
adminUser:
create: true
createSecret: false
username: admin
ingress:
enabled: true
className: nginx
annotations:
hajimari.io/icon: sawtooth-wave
hosts:
- host: &host "gitops.${SECRET_DOMAIN}"
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- *host
networkPolicy:
create: false
metrics:
enabled: true
rbac:
create: true
impersonationResourceNames: ["admin"]
podAnnotations:
secret.reloader.stakater.com/reload: cluster-user-auth
kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: flux-system
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/flux-system/weave-gitops/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-weave-gitops
namespace: flux-system
spec:
path: ./kubernetes/apps/flux-system/weave-gitops/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/kube-system/cilium/app/cilium-l2.yaml
-22
View File
@@ -1,22 +0,0 @@
---
# https://docs.cilium.io/en/latest/network/l2-announcements
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
name: policy
spec:
loadBalancerIPs: true
# NOTE: This might need to be set if you have more than one active NIC on your nodes
# interfaces:
# - ^eno[0-9]+
nodeSelector:
matchLabels:
kubernetes.io/os: linux
---
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: pool
spec:
cidrs:
- cidr: "${NODE_CIDR}"
kubernetes/apps/kube-system/cilium/app/helmrelease.yaml
-99
View File
@@ -1,99 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: cilium
version: 1.14.0-rc.0
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
autoDirectNodeRoutes: true
bpf:
masquerade: true
bgp:
enabled: false
cluster:
name: home-cluster
id: 1
containerRuntime:
integration: containerd
socketPath: /var/run/k3s/containerd/containerd.sock
endpointRoutes:
enabled: true
hubble:
enabled: true
metrics:
enabled:
- dns:query
- drop
- tcp
- flow
- port-distribution
- icmp
- http
serviceMonitor:
enabled: true
relay:
enabled: true
rollOutPods: true
prometheus:
serviceMonitor:
enabled: true
ui:
enabled: true
rollOutPods: true
ingress:
enabled: true
className: nginx
annotations:
hajimari.io/icon: simple-icons:cilium
hosts:
- &host "hubble.${SECRET_DOMAIN}"
tls:
- hosts:
- *host
ipam:
mode: kubernetes
k8sServiceHost: ${KUBE_VIP_ADDR}
k8sServicePort: 6443
ipv4NativeRoutingCIDR: ${CLUSTER_CIDR}
kubeProxyReplacement: strict
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
operator:
rollOutPods: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
prometheus:
enabled: true
serviceMonitor:
enabled: true
rollOutCiliumPods: true
l2announcements:
enabled: true
loadBalancer:
algorithm: maglev
mode: dsr
securityContext:
privileged: true
tunnel: disabled
kubernetes/apps/kube-system/cilium/app/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./cilium-l2.yaml
- ./helmrelease.yaml
kubernetes/apps/kube-system/cilium/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-cilium
namespace: flux-system
spec:
path: ./kubernetes/apps/kube-system/cilium/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/kube-system/coredns/app/helmrelease.yaml
-88
View File
@@ -1,88 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: coredns
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: coredns
version: 1.24.1
sourceRef:
kind: HelmRepository
name: coredns
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
fullnameOverride: coredns
replicaCount: 1
service:
clusterIP: "${COREDNS_ADDR}"
serviceAccount:
create: true
deployment:
annotations:
reloader.stakater.com/auto: "true"
servers:
- zones:
- zone: .
scheme: dns://
use_tcp: true
port: 53
plugins:
- name: log
- name: errors
- name: health
configBlock: |-
lameduck 5s
- name: ready
- name: kubernetes
parameters: cluster.local in-addr.arpa ip6.arpa
configBlock: |-
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
- name: prometheus
parameters: 0.0.0.0:9153
- name: forward
parameters: . /etc/resolv.conf
- name: cache
parameters: 30
- name: loop
- name: reload
- name: loadbalance
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
- key: node-role.kubernetes.io/master
operator: Exists
effect: NoSchedule
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/instance: coredns
kubernetes/apps/kube-system/coredns/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/coredns/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-coredns
namespace: flux-system
spec:
path: ./kubernetes/apps/kube-system/coredns/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/kube-system/kustomization.yaml
-10
View File
@@ -1,10 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cilium/ks.yaml
- ./coredns/ks.yaml
- ./local-path-provisioner/ks.yaml
- ./metrics-server/ks.yaml
- ./reloader/ks.yaml
kubernetes/apps/kube-system/local-path-provisioner/app/helmrelease.yaml
-72
View File
@@ -1,72 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: local-path-provisioner
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: ./deploy/chart/local-path-provisioner
sourceRef:
kind: GitRepository
name: local-path-provisioner
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
helperImage:
repository: public.ecr.aws/docker/library/busybox
tag: latest
storageClass:
defaultClass: false
nodePathMap:
- node: DEFAULT_PATH_FOR_NON_LISTED_NODES
paths: ["/var/lib/rancher/k3s/storage"]
# NOTE: Do not enable Flux variable substitution on this HelmRelease
configmap:
setup: |-
#!/bin/sh
while getopts "m:s:p:" opt
do
case $opt in
p)
absolutePath=$OPTARG
;;
s)
sizeInBytes=$OPTARG
;;
m)
volMode=$OPTARG
;;
esac
done
mkdir -m 0777 -p ${absolutePath}
chmod 701 ${absolutePath}/..
teardown: |-
#!/bin/sh
while getopts "m:s:p:" opt
do
case $opt in
p)
absolutePath=$OPTARG
;;
s)
sizeInBytes=$OPTARG
;;
m)
volMode=$OPTARG
;;
esac
done
rm -rf ${absolutePath}
kubernetes/apps/kube-system/local-path-provisioner/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/local-path-provisioner/ks.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-local-path-provisioner
namespace: flux-system
labels:
substitution.flux.home.arpa/disabled: "true"
spec:
path: ./kubernetes/apps/kube-system/local-path-provisioner/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: metrics-server
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: metrics-server
version: 3.10.0
sourceRef:
kind: HelmRepository
name: metrics-server
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
args:
- --kubelet-insecure-tls
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
metrics:
enabled: true
serviceMonitor:
enabled: true
kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/metrics-server/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-metrics-server
namespace: flux-system
spec:
path: ./kubernetes/apps/kube-system/metrics-server/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/kube-system/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/kube-system/reloader/app/helmrelease.yaml
-34
View File
@@ -1,34 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: reloader
namespace: &namespace kube-system
spec:
interval: 30m
chart:
spec:
chart: reloader
version: 1.0.29
sourceRef:
kind: HelmRepository
name: stakater
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
fullnameOverride: reloader
reloader:
reloadStrategy: annotations
podMonitor:
enabled: true
namespace: *namespace
kubernetes/apps/kube-system/reloader/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./helmrelease.yaml
kubernetes/apps/kube-system/reloader/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-reloader
namespace: flux-system
spec:
path: ./kubernetes/apps/kube-system/reloader/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
-100
View File
@@ -1,100 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: grafana
namespace: monitoring
spec:
interval: 30m
chart:
spec:
chart: grafana
version: 6.57.4
sourceRef:
kind: HelmRepository
name: grafana
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: local-path-provisioner
namespace: kube-system
- name: ingress-nginx
namespace: networking
values:
deploymentStrategy:
type: Recreate
admin:
existingSecret: grafana-admin-secret
env:
GF_EXPLORE_ENABLED: true
GF_SERVER_ROOT_URL: "https://grafana.${SECRET_DOMAIN}"
grafana.ini:
analytics:
check_for_updates: false
check_for_plugin_updates: false
dashboardProviders:
dashboardproviders.yaml:
apiVersion: 1
providers:
- name: default
orgId: 1
folder: ""
type: file
disableDeletion: false
editable: true
options:
path: /var/lib/grafana/dashboards/default
datasources:
datasources.yaml:
apiVersion: 1
datasources:
- name: Prometheus
type: prometheus
access: proxy
url: http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090
isDefault: true
dashboards:
default:
cert-manager:
url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
datasource: Prometheus
flux-cluster:
url: https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/monitoring/monitoring-config/dashboards/cluster.json
datasource: Prometheus
flux-control-plane:
url: https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/monitoring/monitoring-config/dashboards/control-plane.json
datasource: Prometheus
sidecar:
dashboards:
enabled: true
searchNamespace: ALL
datasources:
enabled: true
searchNamespace: ALL
serviceMonitor:
enabled: true
ingress:
enabled: true
ingressClassName: nginx
annotations:
hajimari.io/icon: simple-icons:grafana
hosts:
- &host "grafana.${SECRET_DOMAIN}"
tls:
- hosts:
- *host
persistence:
enabled: true
storageClassName: local-path
testFramework:
enabled: false
kubernetes/apps/monitoring/grafana/app/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: monitoring
resources:
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/monitoring/grafana/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-grafana
namespace: flux-system
spec:
path: ./kubernetes/apps/monitoring/grafana/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/monitoring/kube-prometheus-stack/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: monitoring
resources:
- ./helmrelease.yaml
kubernetes/apps/monitoring/kube-prometheus-stack/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-kube-prometheus-stack
namespace: flux-system
spec:
path: ./kubernetes/apps/monitoring/kube-prometheus-stack/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/monitoring/kubernetes-dashboard/app/helmrelease.yaml
-54
View File
@@ -1,54 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: kubernetes-dashboard
namespace: monitoring
spec:
interval: 30m
chart:
spec:
chart: kubernetes-dashboard
version: 6.0.8
sourceRef:
kind: HelmRepository
name: kubernetes-dashboard
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: ingress-nginx
namespace: networking
values:
env:
TZ: "${TIMEZONE}"
extraArgs:
- --enable-skip-login
- --disable-settings-authorizer
- --enable-insecure-login
- --token-ttl=43200
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-staging
hajimari.io/icon: mdi:kubernetes
hosts:
- &host "kubernetes.${SECRET_DOMAIN}"
tls:
- hosts:
- *host
secretName: kubernetes-dashboard-tls
metricsScraper:
enabled: true
serviceMonitor:
enabled: false
kubernetes/apps/monitoring/kubernetes-dashboard/app/kustomization.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: monitoring
resources:
- ./rbac.yaml
- ./helmrelease.yaml
kubernetes/apps/monitoring/kubernetes-dashboard/app/rbac.yaml
-41
View File
@@ -1,41 +0,0 @@
# For dashboard sign in token:
# kubectl -n monitoring get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubernetes-dashboard
namespace: monitoring
labels:
app.kubernetes.io/managed-by: Helm
annotations:
meta.helm.sh/release-name: kubernetes-dashboard
meta.helm.sh/release-namespace: monitoring
secrets:
- name: kubernetes-dashboard
---
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
name: kubernetes-dashboard
namespace: monitoring
labels:
app.kubernetes.io/managed-by: Helm
annotations:
meta.helm.sh/release-name: kubernetes-dashboard
meta.helm.sh/release-namespace: monitoring
kubernetes.io/service-account.name: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system:kubernetes-dashboard
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: kubernetes-dashboard
namespace: monitoring
kubernetes/apps/monitoring/kubernetes-dashboard/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-kubernetes-dashboard
namespace: flux-system
spec:
path: ./kubernetes/apps/monitoring/kubernetes-dashboard/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/monitoring/kustomization.yaml
-8
View File
@@ -1,8 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./grafana/ks.yaml
- ./kube-prometheus-stack/ks.yaml
- ./kubernetes-dashboard/ks.yaml
kubernetes/apps/monitoring/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: monitoring
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/networking/cloudflared/app/configs/config.yaml
-15
View File
@@ -1,15 +0,0 @@
---
originRequest:
http2Origin: true
# https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/ingress
ingress:
- hostname: "${SECRET_DOMAIN}"
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
originRequest:
originServerName: "ingress.${SECRET_DOMAIN}"
- hostname: "*.${SECRET_DOMAIN}"
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
originRequest:
originServerName: "ingress.${SECRET_DOMAIN}"
- service: http_status:404
kubernetes/apps/networking/cloudflared/app/dnsendpoint.yaml
-13
View File
@@ -1,13 +0,0 @@
---
apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
name: cloudflared
namespace: networking
annotations:
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
spec:
endpoints:
- dnsName: "ingress.${SECRET_DOMAIN}"
recordType: CNAME
targets: ["${SECRET_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"]
kubernetes/apps/networking/cloudflared/app/helmrelease.yaml
-102
View File
@@ -1,102 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cloudflared
namespace: networking
spec:
interval: 30m
chart:
spec:
chart: app-template
version: 1.5.1
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
controller:
replicas: 1
strategy: RollingUpdate
annotations:
reloader.stakater.com/auto: "true"
image:
repository: docker.io/cloudflare/cloudflared
tag: 2023.6.1
env:
NO_AUTOUPDATE: "true"
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
TUNNEL_METRICS: 0.0.0.0:8080
TUNNEL_TRANSPORT_PROTOCOL: auto
TUNNEL_ID:
valueFrom:
secretKeyRef:
name: cloudflared-secret
key: TUNNEL_ID
args:
- tunnel
- --config
- /etc/cloudflared/config/config.yaml
- run
- "$(TUNNEL_ID)"
service:
main:
ports:
http:
port: 8080
serviceMonitor:
main:
enabled: true
endpoints:
- port: http
scheme: http
path: /metrics
interval: 1m
scrapeTimeout: 30s
probes:
liveness: &probes
enabled: true
custom: true
spec:
httpGet:
path: /ready
port: http
initialDelaySeconds: 0
periodSeconds: 10
timeoutSeconds: 1
failureThreshold: 3
readiness: *probes
startup:
enabled: false
persistence:
config:
enabled: true
type: configMap
name: cloudflared-configmap
subPath: config.yaml
mountPath: /etc/cloudflared/config/config.yaml
readOnly: true
creds:
enabled: true
type: secret
name: cloudflared-secret
subPath: credentials.json
mountPath: /etc/cloudflared/creds/credentials.json
readOnly: true
resources:
requests:
cpu: 5m
memory: 10Mi
limits:
memory: 256Mi
kubernetes/apps/networking/cloudflared/app/kustomization.yaml
-14
View File
@@ -1,14 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./dnsendpoint.yaml
- ./secret.sops.yaml
- ./helmrelease.yaml
configMapGenerator:
- name: cloudflared-configmap
files:
- ./configs/config.yaml
generatorOptions:
disableNameSuffixHash: true
kubernetes/apps/networking/cloudflared/ks.yaml
-18
View File
@@ -1,18 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-cloudflared
namespace: flux-system
spec:
dependsOn:
- name: cluster-apps-external-dns
path: ./kubernetes/apps/networking/cloudflared/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/networking/external-dns/app/dnsendpoint-crd.yaml
-93
View File
@@ -1,93 +0,0 @@
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.5.0
api-approved.kubernetes.io: "https://github.com/kubernetes-sigs/external-dns/pull/2007"
creationTimestamp: null
name: dnsendpoints.externaldns.k8s.io
spec:
group: externaldns.k8s.io
names:
kind: DNSEndpoint
listKind: DNSEndpointList
plural: dnsendpoints
singular: dnsendpoint
scope: Namespaced
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: DNSEndpointSpec defines the desired state of DNSEndpoint
properties:
endpoints:
items:
description: Endpoint is a high-level way of a connection between a service and an IP
properties:
dnsName:
description: The hostname of the DNS record
type: string
labels:
additionalProperties:
type: string
description: Labels stores labels defined for the Endpoint
type: object
providerSpecific:
description: ProviderSpecific stores provider specific config
items:
description: ProviderSpecificProperty holds the name and value of a configuration which is specific to individual DNS providers
properties:
name:
type: string
value:
type: string
type: object
type: array
recordTTL:
description: TTL for the record
format: int64
type: integer
recordType:
description: RecordType type of record, e.g. CNAME, A, SRV, TXT etc
type: string
setIdentifier:
description: Identifier to distinguish multiple records with the same name and type (e.g. Route53 records with routing policies other than 'simple')
type: string
targets:
description: The targets the DNS record points to
items:
type: string
type: array
type: object
type: array
type: object
status:
description: DNSEndpointStatus defines the observed state of DNSEndpoint
properties:
observedGeneration:
description: The generation observed by the external-dns controller.
format: int64
type: integer
type: object
type: object
served: true
storage: true
subresources:
status: {}
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
kubernetes/apps/networking/external-dns/app/helmrelease.yaml
-50
View File
@@ -1,50 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: &app external-dns
namespace: networking
spec:
interval: 30m
chart:
spec:
chart: external-dns
version: 1.13.0
sourceRef:
kind: HelmRepository
name: external-dns
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
fullnameOverride: *app
provider: cloudflare
env:
- name: CF_API_TOKEN
valueFrom:
secretKeyRef:
name: external-dns-secret
key: api-token
extraArgs:
- --annotation-filter=external-dns.alpha.kubernetes.io/target
- --cloudflare-proxied
- --crd-source-apiversion=externaldns.k8s.io/v1alpha1
- --crd-source-kind=DNSEndpoint
policy: sync
sources: ["crd", "ingress"]
txtPrefix: k8s.
txtOwnerId: default
domainFilters: ["${SECRET_DOMAIN}"]
serviceMonitor:
enabled: true
podAnnotations:
secret.reloader.stakater.com/reload: external-dns-secret
kubernetes/apps/networking/external-dns/app/kustomization.yaml
-8
View File
@@ -1,8 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./dnsendpoint-crd.yaml
- ./secret.sops.yaml
- ./helmrelease.yaml
kubernetes/apps/networking/external-dns/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-external-dns
namespace: flux-system
spec:
path: ./kubernetes/apps/networking/external-dns/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/networking/ingress-nginx/app/helmrelease.yaml
-71
View File
@@ -1,71 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: ingress-nginx
namespace: networking
spec:
interval: 30m
chart:
spec:
chart: ingress-nginx
version: 4.7.1
sourceRef:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
dependsOn:
- name: cloudflared
namespace: networking
values:
controller:
extraEnvs:
- name: TZ
value: "${TIMEZONE}"
service:
annotations:
external-dns.alpha.kubernetes.io/hostname: "ingress.${SECRET_DOMAIN}"
io.cilium/lb-ipam-ips: "${INGRESS_NGINX_ADDR}"
externalTrafficPolicy: Cluster
publishService:
enabled: true
ingressClassResource:
default: true
config:
client-header-timeout: 120
client-body-buffer-size: "100M"
client-body-timeout: 120
enable-brotli: "true"
hsts-max-age: "31449600"
keep-alive: 120
keep-alive-requests: 10000
proxy-body-size: "100M"
ssl-protocols: "TLSv1.3 TLSv1.2"
metrics:
enabled: true
serviceMonitor:
enabled: true
namespace: networking
namespaceSelector:
any: true
extraArgs:
default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
resources:
requests:
cpu: 10m
memory: 250Mi
limits:
memory: 500Mi
defaultBackend:
enabled: false
kubernetes/apps/networking/ingress-nginx/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./helmrelease.yaml
kubernetes/apps/networking/ingress-nginx/certificates/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./staging.yaml
# - ./production.yaml
kubernetes/apps/networking/ingress-nginx/certificates/production.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: "${SECRET_DOMAIN/./-}-production"
namespace: networking
spec:
secretName: "${SECRET_DOMAIN/./-}-production-tls"
issuerRef:
name: letsencrypt-production
kind: ClusterIssuer
commonName: "${SECRET_DOMAIN}"
dnsNames:
- "${SECRET_DOMAIN}"
- "*.${SECRET_DOMAIN}"
kubernetes/apps/networking/ingress-nginx/certificates/staging.yaml
-15
View File
@@ -1,15 +0,0 @@
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: "${SECRET_DOMAIN/./-}-staging"
namespace: networking
spec:
secretName: "${SECRET_DOMAIN/./-}-staging-tls"
issuerRef:
name: letsencrypt-staging
kind: ClusterIssuer
commonName: "${SECRET_DOMAIN}"
dnsNames:
- "${SECRET_DOMAIN}"
- "*.${SECRET_DOMAIN}"
kubernetes/apps/networking/ingress-nginx/ks.yaml
-36
View File
@@ -1,36 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-ingress-nginx-certificates
namespace: flux-system
spec:
dependsOn:
- name: cluster-apps-cert-manager-issuers
path: ./kubernetes/apps/networking/ingress-nginx/certificates
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-ingress-nginx
namespace: flux-system
spec:
dependsOn:
- name: cluster-apps-ingress-nginx-certificates
path: ./kubernetes/apps/networking/ingress-nginx/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/networking/k8s-gateway/app/helmrelease.yaml
-37
View File
@@ -1,37 +0,0 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: k8s-gateway
namespace: networking
spec:
interval: 30m
chart:
spec:
chart: k8s-gateway
version: 2.0.4
sourceRef:
kind: HelmRepository
name: k8s-gateway
namespace: flux-system
maxHistory: 2
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
fullnameOverride: k8s-gateway
domain: "${SECRET_DOMAIN}"
ttl: 1
service:
type: LoadBalancer
port: 53
annotations:
io.cilium/lb-ipam-ips: "${K8S_GATEWAY_ADDR}"
externalTrafficPolicy: Cluster
kubernetes/apps/networking/k8s-gateway/app/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: networking
resources:
- ./helmrelease.yaml
kubernetes/apps/networking/k8s-gateway/ks.yaml
-16
View File
@@ -1,16 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-k8s-gateway
namespace: flux-system
spec:
path: ./kubernetes/apps/networking/k8s-gateway/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/networking/kustomization.yaml
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./cloudflared/ks.yaml
- ./external-dns/ks.yaml
- ./ingress-nginx/ks.yaml
- ./k8s-gateway/ks.yaml
kubernetes/apps/networking/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: networking
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/system-upgrade/kustomization.yaml
-9
View File
@@ -1,9 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
# NOTE: Only enable system-upgrade-controller if you also update the version of k3s in the following file
# otherwise if you run ansible against an already provisioned cluster you might downgrade it
# https://github.com/onedr0p/flux-cluster-template/blob/main/ansible/inventory/group_vars/kubernetes/main.yaml
# - ./system-upgrade-controller/ks.yaml
kubernetes/apps/system-upgrade/namespace.yaml
-7
View File
@@ -1,7 +0,0 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
kubernetes/apps/system-upgrade/system-upgrade-controller/app/kustomization.yaml
-20
View File
@@ -1,20 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
# renovate: datasource=docker image=rancher/system-upgrade-controller
- https://github.com/rancher/system-upgrade-controller/releases/download/v0.11.0/crd.yaml
- https://github.com/rancher/system-upgrade-controller?ref=v0.11.0
images:
- name: rancher/system-upgrade-controller
newTag: v0.11.0
commonLabels:
app.kubernetes.io/name: system-upgrade-controller
app.kubernetes.io/instance: system-upgrade-controller
patchesStrategicMerge:
- |
$patch: delete
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
kubernetes/apps/system-upgrade/system-upgrade-controller/ks.yaml
-34
View File
@@ -1,34 +0,0 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-system-upgrade-controller
namespace: flux-system
spec:
path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: true
interval: 30m
retryInterval: 1m
timeout: 5m
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-system-upgrade-controller-plans
namespace: flux-system
spec:
dependsOn:
- name: cluster-apps-system-upgrade-controller
path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
prune: true
sourceRef:
kind: GitRepository
name: home-kubernetes
wait: false # no flux ks dependents
interval: 30m
retryInterval: 1m
timeout: 5m
kubernetes/apps/system-upgrade/system-upgrade-controller/plans/agent.yaml
-19
View File
@@ -1,19 +0,0 @@
---
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: agent
namespace: system-upgrade
spec:
# renovate: datasource=github-releases depName=k3s-io/k3s
version: "v1.27.3+k3s1"
serviceAccountName: system-upgrade
concurrency: 1
nodeSelector:
matchExpressions:
- {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist}
prepare:
image: rancher/k3s-upgrade
args: ["prepare", "server"]
upgrade:
image: rancher/k3s-upgrade
kubernetes/apps/system-upgrade/system-upgrade-controller/plans/kustomization.yaml
-6
View File
@@ -1,6 +0,0 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./server.yaml
- ./agent.yaml
kubernetes/apps/system-upgrade/system-upgrade-controller/plans/server.yaml
-24
View File
@@ -1,24 +0,0 @@
---
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: server
namespace: system-upgrade
spec:
# renovate: datasource=github-releases depName=k3s-io/k3s
version: "v1.27.3+k3s1"
serviceAccountName: system-upgrade
concurrency: 1
cordon: true
nodeSelector:
matchExpressions:
- { key: node-role.kubernetes.io/control-plane, operator: Exists }
tolerations:
- { effect: NoSchedule, operator: Exists }
- { effect: NoExecute, operator: Exists }
- { key: node-role.kubernetes.io/control-plane, effect: NoSchedule, operator: Exists }
- { key: node-role.kubernetes.io/master, effect: NoSchedule, operator: Exists }
- { key: node-role.kubernetes.io/etcd, effect: NoExecute, operator: Exists }
- { key: CriticalAddonsOnly, operator: Exists }
upgrade:
image: rancher/k3s-upgrade