feat: move kubernetes dir into templates to support jinja2 across all files (#831)
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
7b0a154fed
commit
fe41cf6ea5
134 files changed
+192
-177
No files matched your search
@@ -0,0 +1,42 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: v1.12.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: jetstack
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
installCRDs: true
|
||||
extraArgs:
|
||||
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
|
||||
- --dns01-recursive-nameservers-only
|
||||
podDnsPolicy: None
|
||||
podDnsConfig:
|
||||
nameservers:
|
||||
- "1.1.1.1"
|
||||
- "9.9.9.9"
|
||||
prometheus:
|
||||
enabled: true
|
||||
servicemonitor:
|
||||
enabled: true
|
||||
prometheusInstance: monitoring
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: cert-manager
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
- ./prometheusrule.yaml
|
||||
+62
@@ -0,0 +1,62 @@
|
||||
#jinja2: trim_blocks: True
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: cert-manager.rules
|
||||
namespace: cert-manager
|
||||
spec:
|
||||
groups:
|
||||
- name: cert-manager
|
||||
rules:
|
||||
- alert: CertManagerAbsent
|
||||
expr: |
|
||||
absent(up{job="cert-manager"})
|
||||
for: 15m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
description: >
|
||||
New certificates will not be able to be minted, and existing ones can't be renewed until cert-manager is back.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
|
||||
summary: "Cert Manager has dissapeared from Prometheus service discovery."
|
||||
- name: certificates
|
||||
rules:
|
||||
- alert: CertManagerCertExpirySoon
|
||||
expr: |
|
||||
avg by (exported_namespace, namespace, name) (certmanager_certificate_expiration_timestamp_seconds - time()) < (21 * 24 * 3600)
|
||||
for: 15m
|
||||
labels:
|
||||
severity: warning
|
||||
annotations:
|
||||
description: >
|
||||
The domain that this cert covers will be unavailable after
|
||||
{% raw %}{{ $value | humanizeDuration }}{% endraw %}. Clients using endpoints that this cert
|
||||
protects will start to fail in {% raw %}{{ $value | humanizeDuration }}{% endraw %}.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
|
||||
summary: |
|
||||
The cert {% raw %}{{ $labels.name }}{% endraw %} is {% raw %}{{ $value | humanizeDuration }}{% endraw %} from expiry, it should have renewed over a week ago.
|
||||
- alert: CertManagerCertNotReady
|
||||
expr: |
|
||||
max by (name, exported_namespace, namespace, condition) (certmanager_certificate_ready_status{condition!="True"} == 1)
|
||||
for: 15m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
description: >
|
||||
This certificate has not been ready to serve traffic for at least
|
||||
10m. If the cert is being renewed or there is another valid cert, the ingress
|
||||
controller _may_ be able to serve that instead.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
|
||||
summary: "The cert {% raw %}{{ $labels.name }}{% endraw %} is not ready to serve traffic."
|
||||
- alert: CertManagerHittingRateLimits
|
||||
expr: |
|
||||
sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m])) > 0
|
||||
for: 15m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
description: >
|
||||
Depending on the rate limit, cert-manager may be unable to generate certificates for up to a week.
|
||||
runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
|
||||
summary: "Cert manager hitting LetsEncrypt rate limits."
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-production
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: "${SECRET_ACME_EMAIL}"
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-production
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
apiTokenSecretRef:
|
||||
name: cert-manager-secret
|
||||
key: api-token
|
||||
selector:
|
||||
dnsZones:
|
||||
- "${SECRET_DOMAIN}"
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: "${SECRET_ACME_EMAIL}"
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
apiTokenSecretRef:
|
||||
name: cert-manager-secret
|
||||
key: api-token
|
||||
selector:
|
||||
dnsZones:
|
||||
- "${SECRET_DOMAIN}"
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./issuers.yaml
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cert-manager-secret
|
||||
namespace: cert-manager
|
||||
stringData:
|
||||
api-token: "{{ bootstrap_cloudflare_token }}"
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cert-manager
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/cert-manager/cert-manager/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cert-manager-issuers
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-cert-manager
|
||||
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cert-manager/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: cert-manager
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,78 @@
|
||||
#jinja2: trim_blocks: True
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: echo-server
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 1.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
controller:
|
||||
strategy: RollingUpdate
|
||||
image:
|
||||
repository: docker.io/jmalloc/echo-server
|
||||
tag: 0.3.5
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: &port 8080
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: *port
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
ingress:
|
||||
main:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
|
||||
hajimari.io/icon: video-input-antenna
|
||||
hosts:
|
||||
- host: &host "{% raw %}{{ .Release.Name }}{% endraw %}.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 10Mi
|
||||
limits:
|
||||
memory: 50Mi
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-echo-server
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/default/echo-server/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: hajimari
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: hajimari
|
||||
version: 2.0.2
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: hajimari
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
hajimari:
|
||||
title: Apps
|
||||
darkTheme: espresso
|
||||
alwaysTargetBlank: true
|
||||
showGreeting: false
|
||||
showAppGroups: false
|
||||
showAppStatus: false
|
||||
showBookmarkGroups: false
|
||||
showGlobalBookmarks: false
|
||||
showAppUrls: false
|
||||
defaultEnable: true
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- default
|
||||
- monitoring
|
||||
ingress:
|
||||
main:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
hajimari.io/enable: "false"
|
||||
hosts:
|
||||
- host: &host "hajimari.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
podAnnotations:
|
||||
configmap.reloader.stakater.com/reload: hajimari-settings
|
||||
persistence:
|
||||
data:
|
||||
enabled: true
|
||||
type: emptyDir
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128M
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-hajimari
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/default/hajimari/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./echo-server/ks.yaml
|
||||
- ./hajimari/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: default
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-flux-webhooks
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/flux-system/addons/webhooks
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: flux-webhook
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
|
||||
hajimari.io/enable: "false"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: &host "flux-webhook.${SECRET_DOMAIN}"
|
||||
http:
|
||||
paths:
|
||||
- path: /hook/
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: webhook-receiver
|
||||
port:
|
||||
number: 80
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./ingress.yaml
|
||||
- ./receiver.yaml
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
---
|
||||
apiVersion: notification.toolkit.fluxcd.io/v1
|
||||
kind: Receiver
|
||||
metadata:
|
||||
name: github-receiver
|
||||
namespace: flux-system
|
||||
spec:
|
||||
type: github
|
||||
events:
|
||||
- ping
|
||||
- push
|
||||
secretRef:
|
||||
name: github-webhook-token-secret
|
||||
resources:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
namespace: flux-system
|
||||
- apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
name: cluster
|
||||
namespace: flux-system
|
||||
- apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
name: cluster-apps
|
||||
namespace: flux-system
|
||||
+8
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: github-webhook-token-secret
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
token: "{{ bootstrap_flux_github_webhook_token }}"
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./github
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./addons/ks.yaml
|
||||
- ./weave-gitops/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: flux-system
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: weave-gitops
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: weave-gitops
|
||||
version: 4.0.24
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: weave-gitops
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
adminUser:
|
||||
create: true
|
||||
createSecret: false
|
||||
username: admin
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: sawtooth-wave
|
||||
hosts:
|
||||
- host: &host "gitops.${SECRET_DOMAIN}"
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
networkPolicy:
|
||||
create: false
|
||||
metrics:
|
||||
enabled: true
|
||||
rbac:
|
||||
create: true
|
||||
impersonationResourceNames: ["admin"]
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: cluster-user-auth
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: flux-system
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cluster-user-auth
|
||||
namespace: flux-system
|
||||
type: Opaque
|
||||
stringData:
|
||||
username: admin
|
||||
password: "{{ bootstrap_weave_gitops_admin_password | password_hash('bcrypt', rounds=10) }}"
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-weave-gitops
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/flux-system/weave-gitops/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
# https://docs.cilium.io/en/latest/network/l2-announcements
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
spec:
|
||||
loadBalancerIPs: true
|
||||
# NOTE: This might need to be set if you have more than one active NIC on your nodes
|
||||
# interfaces:
|
||||
# - ^eno[0-9]+
|
||||
nodeSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: pool
|
||||
spec:
|
||||
cidrs:
|
||||
- cidr: "{{ bootstrap_node_cidr }}"
|
||||
@@ -0,0 +1,99 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: cilium
|
||||
version: 1.14.0-rc.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cilium
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
autoDirectNodeRoutes: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
bgp:
|
||||
enabled: false
|
||||
cluster:
|
||||
name: home-cluster
|
||||
id: 1
|
||||
containerRuntime:
|
||||
integration: containerd
|
||||
socketPath: /var/run/k3s/containerd/containerd.sock
|
||||
endpointRoutes:
|
||||
enabled: true
|
||||
hubble:
|
||||
enabled: true
|
||||
metrics:
|
||||
enabled:
|
||||
- dns:query
|
||||
- drop
|
||||
- tcp
|
||||
- flow
|
||||
- port-distribution
|
||||
- icmp
|
||||
- http
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
relay:
|
||||
enabled: true
|
||||
rollOutPods: true
|
||||
prometheus:
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
ui:
|
||||
enabled: true
|
||||
rollOutPods: true
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: simple-icons:cilium
|
||||
hosts:
|
||||
- &host "hubble.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
ipam:
|
||||
mode: kubernetes
|
||||
k8sServiceHost: "{{ bootstrap_kube_vip_addr }}"
|
||||
k8sServicePort: 6443
|
||||
ipv4NativeRoutingCIDR: "{{ bootstrap_cluster_cidr }}"
|
||||
kubeProxyReplacement: strict
|
||||
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||
operator:
|
||||
rollOutPods: true
|
||||
prometheus:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
prometheus:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
rollOutCiliumPods: true
|
||||
l2announcements:
|
||||
enabled: true
|
||||
loadBalancer:
|
||||
algorithm: maglev
|
||||
mode: dsr
|
||||
securityContext:
|
||||
privileged: true
|
||||
tunnel: disabled
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./cilium-l2.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cilium
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/cilium/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: coredns
|
||||
version: 1.24.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: coredns
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: coredns
|
||||
replicaCount: 1
|
||||
service:
|
||||
clusterIP: "{{ bootstrap_coredns_addr }}"
|
||||
serviceAccount:
|
||||
create: true
|
||||
deployment:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
servers:
|
||||
- zones:
|
||||
- zone: .
|
||||
scheme: dns://
|
||||
use_tcp: true
|
||||
port: 53
|
||||
plugins:
|
||||
- name: log
|
||||
- name: errors
|
||||
- name: health
|
||||
configBlock: |-
|
||||
lameduck 5s
|
||||
- name: ready
|
||||
- name: kubernetes
|
||||
parameters: cluster.local in-addr.arpa ip6.arpa
|
||||
configBlock: |-
|
||||
pods insecure
|
||||
fallthrough in-addr.arpa ip6.arpa
|
||||
ttl 30
|
||||
- name: prometheus
|
||||
parameters: 0.0.0.0:9153
|
||||
- name: forward
|
||||
parameters: . /etc/resolv.conf
|
||||
- name: cache
|
||||
parameters: 30
|
||||
- name: loop
|
||||
- name: reload
|
||||
- name: loadbalance
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
tolerations:
|
||||
- key: CriticalAddonsOnly
|
||||
operator: Exists
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: coredns
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-coredns
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/coredns/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cilium/ks.yaml
|
||||
- ./coredns/ks.yaml
|
||||
- ./local-path-provisioner/ks.yaml
|
||||
- ./metrics-server/ks.yaml
|
||||
- ./reloader/ks.yaml
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: local-path-provisioner
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: ./deploy/chart/local-path-provisioner
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: local-path-provisioner
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
helperImage:
|
||||
repository: public.ecr.aws/docker/library/busybox
|
||||
tag: latest
|
||||
storageClass:
|
||||
defaultClass: false
|
||||
nodePathMap:
|
||||
- node: DEFAULT_PATH_FOR_NON_LISTED_NODES
|
||||
paths: ["/var/lib/rancher/k3s/storage"]
|
||||
# NOTE: Do not enable Flux variable substitution on this HelmRelease
|
||||
configmap:
|
||||
setup: |-
|
||||
#!/bin/sh
|
||||
while getopts "m:s:p:" opt
|
||||
do
|
||||
case $opt in
|
||||
p)
|
||||
absolutePath=$OPTARG
|
||||
;;
|
||||
s)
|
||||
sizeInBytes=$OPTARG
|
||||
;;
|
||||
m)
|
||||
volMode=$OPTARG
|
||||
;;
|
||||
esac
|
||||
done
|
||||
mkdir -m 0777 -p ${absolutePath}
|
||||
chmod 701 ${absolutePath}/..
|
||||
teardown: |-
|
||||
#!/bin/sh
|
||||
while getopts "m:s:p:" opt
|
||||
do
|
||||
case $opt in
|
||||
p)
|
||||
absolutePath=$OPTARG
|
||||
;;
|
||||
s)
|
||||
sizeInBytes=$OPTARG
|
||||
;;
|
||||
m)
|
||||
volMode=$OPTARG
|
||||
;;
|
||||
esac
|
||||
done
|
||||
rm -rf ${absolutePath}
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-local-path-provisioner
|
||||
namespace: flux-system
|
||||
labels:
|
||||
substitution.flux.home.arpa/disabled: "true"
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/local-path-provisioner/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: metrics-server
|
||||
namespace: kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: metrics-server
|
||||
version: 3.10.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: metrics-server
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
args:
|
||||
- --kubelet-insecure-tls
|
||||
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
|
||||
- --kubelet-use-node-status-port
|
||||
- --metric-resolution=15s
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-metrics-server
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/metrics-server/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kube-system
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: reloader
|
||||
namespace: &namespace kube-system
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: reloader
|
||||
version: 1.0.29
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: stakater
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: reloader
|
||||
reloader:
|
||||
reloadStrategy: annotations
|
||||
podMonitor:
|
||||
enabled: true
|
||||
namespace: *namespace
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-reloader
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/kube-system/reloader/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,100 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: grafana
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: grafana
|
||||
version: 6.57.4
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: local-path-provisioner
|
||||
namespace: kube-system
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
deploymentStrategy:
|
||||
type: Recreate
|
||||
admin:
|
||||
existingSecret: grafana-admin-secret
|
||||
env:
|
||||
GF_EXPLORE_ENABLED: true
|
||||
GF_SERVER_ROOT_URL: "https://grafana.${SECRET_DOMAIN}"
|
||||
grafana.ini:
|
||||
analytics:
|
||||
check_for_updates: false
|
||||
check_for_plugin_updates: false
|
||||
dashboardProviders:
|
||||
dashboardproviders.yaml:
|
||||
apiVersion: 1
|
||||
providers:
|
||||
- name: default
|
||||
orgId: 1
|
||||
folder: ""
|
||||
type: file
|
||||
disableDeletion: false
|
||||
editable: true
|
||||
options:
|
||||
path: /var/lib/grafana/dashboards/default
|
||||
datasources:
|
||||
datasources.yaml:
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
- name: Prometheus
|
||||
type: prometheus
|
||||
access: proxy
|
||||
url: http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090
|
||||
isDefault: true
|
||||
dashboards:
|
||||
default:
|
||||
cert-manager:
|
||||
url: https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
|
||||
datasource: Prometheus
|
||||
flux-cluster:
|
||||
url: https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/monitoring/monitoring-config/dashboards/cluster.json
|
||||
datasource: Prometheus
|
||||
flux-control-plane:
|
||||
url: https://raw.githubusercontent.com/fluxcd/flux2/main/manifests/monitoring/monitoring-config/dashboards/control-plane.json
|
||||
datasource: Prometheus
|
||||
sidecar:
|
||||
dashboards:
|
||||
enabled: true
|
||||
searchNamespace: ALL
|
||||
datasources:
|
||||
enabled: true
|
||||
searchNamespace: ALL
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
hajimari.io/icon: simple-icons:grafana
|
||||
hosts:
|
||||
- &host "grafana.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClassName: local-path
|
||||
testFramework:
|
||||
enabled: false
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: grafana-admin-secret
|
||||
namespace: monitoring
|
||||
stringData:
|
||||
admin-user: admin
|
||||
admin-password: "{{ bootstrap_grafana_admin_password }}"
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-grafana
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/monitoring/grafana/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+142
@@ -0,0 +1,142 @@
|
||||
#jinja2: trim_blocks: True, lstrip_blocks: True
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kube-prometheus-stack
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 30m
|
||||
timeout: 15m
|
||||
chart:
|
||||
spec:
|
||||
chart: kube-prometheus-stack
|
||||
version: 47.1.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
crds: CreateReplace
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: local-path-provisioner
|
||||
namespace: kube-system
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
cleanPrometheusOperatorObjectNames: true
|
||||
alertmanager:
|
||||
enabled: false
|
||||
grafana:
|
||||
enabled: false
|
||||
forceDeployDashboards: true
|
||||
sidecar:
|
||||
dashboards:
|
||||
multicluster:
|
||||
etcd:
|
||||
enabled: true
|
||||
kube-state-metrics:
|
||||
metricLabelsAllowlist:
|
||||
- "pods=[*]"
|
||||
- "deployments=[*]"
|
||||
- "persistentvolumeclaims=[*]"
|
||||
prometheus:
|
||||
monitor:
|
||||
enabled: true
|
||||
relabelings:
|
||||
- action: replace
|
||||
regex: (.*)
|
||||
replacement: $1
|
||||
sourceLabels: ["__meta_kubernetes_pod_node_name"]
|
||||
targetLabel: kubernetes_node
|
||||
kubelet:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authentication_token|cadvisor_version|container_blkio|container_cpu|container_fs|container_last|container_memory|container_network|container_oom|container_processes|container|csi_operations|disabled_metric|get_token|go|hidden_metric|kubelet_certificate|kubelet_cgroup|kubelet_container|kubelet_containers|kubelet_cpu|kubelet_device|kubelet_graceful|kubelet_http|kubelet_lifecycle|kubelet_managed|kubelet_node|kubelet_pleg|kubelet_pod|kubelet_run|kubelet_running|kubelet_runtime|kubelet_server|kubelet_started|kubelet_volume|kubernetes_build|kubernetes_feature|machine_cpu|machine_memory|machine_nvm|machine_scrape|node_namespace|plugin_manager|prober_probe|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|storage_operation|volume_manager|volume_operation|workqueue)_(.+)"
|
||||
action: keep
|
||||
- sourceLabels: ["node"]
|
||||
targetLabel: instance
|
||||
action: replace
|
||||
kubeApiServer:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(aggregator_openapi|aggregator_unavailable|apiextensions_openapi|apiserver_admission|apiserver_audit|apiserver_cache|apiserver_cel|apiserver_client|apiserver_crd|apiserver_current|apiserver_envelope|apiserver_flowcontrol|apiserver_init|apiserver_kube|apiserver_longrunning|apiserver_request|apiserver_requested|apiserver_response|apiserver_selfrequest|apiserver_storage|apiserver_terminated|apiserver_tls|apiserver_watch|apiserver_webhooks|authenticated_user|authentication|disabled_metric|etcd_bookmark|etcd_lease|etcd_request|field_validation|get_token|go|grpc_client|hidden_metric|kube_apiserver|kubernetes_build|kubernetes_feature|node_authorizer|pod_security|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scrape_duration|scrape_samples|scrape_series|serviceaccount_legacy|serviceaccount_stale|serviceaccount_valid|watch_cache|workqueue)_(.+)"
|
||||
action: keep
|
||||
# Remove high cardinality metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: (apiserver|etcd|rest_client)_request(|_sli|_slo)_duration_seconds_bucket
|
||||
action: drop
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: (apiserver_response_sizes_bucket|apiserver_watch_events_sizes_bucket)
|
||||
action: drop
|
||||
kubeControllerManager:
|
||||
enabled: true
|
||||
endpoints: &cp
|
||||
{% for item in bootstrap_hosts.master %}
|
||||
- {{ item.address }}
|
||||
{% endfor %}
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|attachdetach_controller|authenticated_user|authentication|cronjob_controller|disabled_metric|endpoint_slice|ephemeral_volume|garbagecollector_controller|get_token|go|hidden_metric|job_controller|kubernetes_build|kubernetes_feature|leader_election|node_collector|node_ipam|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|pv_collector|registered_metric|replicaset_controller|rest_client|retroactive_storageclass|root_ca|running_managed|scrape_duration|scrape_samples|scrape_series|service_controller|storage_count|storage_operation|ttl_after|volume_operation|workqueue)_(.+)"
|
||||
action: keep
|
||||
kubeEtcd:
|
||||
enabled: true
|
||||
endpoints: *cp
|
||||
kubeProxy:
|
||||
enabled: false # Disabled because eBPF
|
||||
kubeScheduler:
|
||||
enabled: true
|
||||
endpoints: *cp
|
||||
serviceMonitor:
|
||||
metricRelabelings:
|
||||
# Remove duplicate metrics
|
||||
- sourceLabels: ["__name__"]
|
||||
regex: "(apiserver_audit|apiserver_client|apiserver_delegated|apiserver_envelope|apiserver_storage|apiserver_webhooks|authenticated_user|authentication|disabled_metric|go|hidden_metric|kubernetes_build|kubernetes_feature|leader_election|process_cpu|process_max|process_open|process_resident|process_start|process_virtual|registered_metric|rest_client|scheduler|scrape_duration|scrape_samples|scrape_series|workqueue)_(.+)"
|
||||
action: keep
|
||||
prometheus:
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
annotations:
|
||||
hajimari.io/appName: Prometheus
|
||||
hajimari.io/icon: simple-icons:prometheus
|
||||
pathType: Prefix
|
||||
hosts:
|
||||
- &host "prometheus.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
prometheusSpec:
|
||||
ruleSelectorNilUsesHelmValues: false
|
||||
serviceMonitorSelectorNilUsesHelmValues: false
|
||||
podMonitorSelectorNilUsesHelmValues: false
|
||||
probeSelectorNilUsesHelmValues: false
|
||||
enableAdminAPI: true
|
||||
walCompression: true
|
||||
retentionSize: 8GB
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: local-path
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-kube-prometheus-stack
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/monitoring/kube-prometheus-stack/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+54
@@ -0,0 +1,54 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: kubernetes-dashboard
|
||||
version: 6.0.8
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: kubernetes-dashboard
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: ingress-nginx
|
||||
namespace: networking
|
||||
values:
|
||||
env:
|
||||
TZ: "${TIMEZONE}"
|
||||
extraArgs:
|
||||
- --enable-skip-login
|
||||
- --disable-settings-authorizer
|
||||
- --enable-insecure-login
|
||||
- --token-ttl=43200
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
hajimari.io/icon: mdi:kubernetes
|
||||
hosts:
|
||||
- &host "kubernetes.${SECRET_DOMAIN}"
|
||||
tls:
|
||||
- hosts:
|
||||
- *host
|
||||
secretName: kubernetes-dashboard-tls
|
||||
metricsScraper:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- ./rbac.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,41 @@
|
||||
# For dashboard sign in token:
|
||||
# kubectl -n monitoring get secret kubernetes-dashboard -o jsonpath='{.data.token}' | base64 -d
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
meta.helm.sh/release-name: kubernetes-dashboard
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
secrets:
|
||||
- name: kubernetes-dashboard
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: kubernetes.io/service-account-token
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
meta.helm.sh/release-name: kubernetes-dashboard
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
kubernetes.io/service-account.name: kubernetes-dashboard
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: system:kubernetes-dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: monitoring
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-kubernetes-dashboard
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/monitoring/kubernetes-dashboard/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./grafana/ks.yaml
|
||||
- ./kube-prometheus-stack/ks.yaml
|
||||
- ./kubernetes-dashboard/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: monitoring
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
originRequest:
|
||||
http2Origin: true
|
||||
|
||||
# https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/ingress
|
||||
ingress:
|
||||
- hostname: "${SECRET_DOMAIN}"
|
||||
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
|
||||
originRequest:
|
||||
originServerName: "ingress.${SECRET_DOMAIN}"
|
||||
- hostname: "*.${SECRET_DOMAIN}"
|
||||
service: https://ingress-nginx-controller.networking.svc.cluster.local:443
|
||||
originRequest:
|
||||
originServerName: "ingress.${SECRET_DOMAIN}"
|
||||
- service: http_status:404
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: externaldns.k8s.io/v1alpha1
|
||||
kind: DNSEndpoint
|
||||
metadata:
|
||||
name: cloudflared
|
||||
namespace: networking
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/target: "ingress.${SECRET_DOMAIN}"
|
||||
spec:
|
||||
endpoints:
|
||||
- dnsName: "ingress.${SECRET_DOMAIN}"
|
||||
recordType: CNAME
|
||||
targets: ["${SECRET_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"]
|
||||
@@ -0,0 +1,102 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cloudflared
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: app-template
|
||||
version: 1.5.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bjw-s
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
controller:
|
||||
replicas: 1
|
||||
strategy: RollingUpdate
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
image:
|
||||
repository: docker.io/cloudflare/cloudflared
|
||||
tag: 2023.6.1
|
||||
env:
|
||||
NO_AUTOUPDATE: "true"
|
||||
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
|
||||
TUNNEL_METRICS: 0.0.0.0:8080
|
||||
TUNNEL_TRANSPORT_PROTOCOL: auto
|
||||
TUNNEL_ID:
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: cloudflared-secret
|
||||
key: TUNNEL_ID
|
||||
args:
|
||||
- tunnel
|
||||
- --config
|
||||
- /etc/cloudflared/config/config.yaml
|
||||
- run
|
||||
- "$(TUNNEL_ID)"
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 8080
|
||||
serviceMonitor:
|
||||
main:
|
||||
enabled: true
|
||||
endpoints:
|
||||
- port: http
|
||||
scheme: http
|
||||
path: /metrics
|
||||
interval: 1m
|
||||
scrapeTimeout: 30s
|
||||
probes:
|
||||
liveness: &probes
|
||||
enabled: true
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
failureThreshold: 3
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
type: configMap
|
||||
name: cloudflared-configmap
|
||||
subPath: config.yaml
|
||||
mountPath: /etc/cloudflared/config/config.yaml
|
||||
readOnly: true
|
||||
creds:
|
||||
enabled: true
|
||||
type: secret
|
||||
name: cloudflared-secret
|
||||
subPath: credentials.json
|
||||
mountPath: /etc/cloudflared/creds/credentials.json
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 10Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./dnsendpoint.yaml
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
configMapGenerator:
|
||||
- name: cloudflared-configmap
|
||||
files:
|
||||
- ./configs/config.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cloudflared-secret
|
||||
namespace: networking
|
||||
stringData:
|
||||
TUNNEL_ID: "{{ bootstrap_cloudflare_tunnel_id }}"
|
||||
credentials.json: |
|
||||
{
|
||||
"AccountTag": "{{ bootstrap_cloudflare_account_tag }}",
|
||||
"TunnelSecret": "{{ bootstrap_cloudflare_tunnel_secret }}",
|
||||
"TunnelID": "{{ bootstrap_cloudflare_tunnel_id }}"
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-cloudflared
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-external-dns
|
||||
path: ./kubernetes/apps/networking/cloudflared/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+93
@@ -0,0 +1,93 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.5.0
|
||||
api-approved.kubernetes.io: "https://github.com/kubernetes-sigs/external-dns/pull/2007"
|
||||
creationTimestamp: null
|
||||
name: dnsendpoints.externaldns.k8s.io
|
||||
spec:
|
||||
group: externaldns.k8s.io
|
||||
names:
|
||||
kind: DNSEndpoint
|
||||
listKind: DNSEndpointList
|
||||
plural: dnsendpoints
|
||||
singular: dnsendpoint
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: DNSEndpointSpec defines the desired state of DNSEndpoint
|
||||
properties:
|
||||
endpoints:
|
||||
items:
|
||||
description: Endpoint is a high-level way of a connection between a service and an IP
|
||||
properties:
|
||||
dnsName:
|
||||
description: The hostname of the DNS record
|
||||
type: string
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Labels stores labels defined for the Endpoint
|
||||
type: object
|
||||
providerSpecific:
|
||||
description: ProviderSpecific stores provider specific config
|
||||
items:
|
||||
description: ProviderSpecificProperty holds the name and value of a configuration which is specific to individual DNS providers
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
recordTTL:
|
||||
description: TTL for the record
|
||||
format: int64
|
||||
type: integer
|
||||
recordType:
|
||||
description: RecordType type of record, e.g. CNAME, A, SRV, TXT etc
|
||||
type: string
|
||||
setIdentifier:
|
||||
description: Identifier to distinguish multiple records with the same name and type (e.g. Route53 records with routing policies other than 'simple')
|
||||
type: string
|
||||
targets:
|
||||
description: The targets the DNS record points to
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: DNSEndpointStatus defines the observed state of DNSEndpoint
|
||||
properties:
|
||||
observedGeneration:
|
||||
description: The generation observed by the external-dns controller.
|
||||
format: int64
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,50 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: &app external-dns
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: external-dns
|
||||
version: 1.13.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: external-dns
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: *app
|
||||
provider: cloudflare
|
||||
env:
|
||||
- name: CF_API_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: external-dns-secret
|
||||
key: api-token
|
||||
extraArgs:
|
||||
- --annotation-filter=external-dns.alpha.kubernetes.io/target
|
||||
- --cloudflare-proxied
|
||||
- --crd-source-apiversion=externaldns.k8s.io/v1alpha1
|
||||
- --crd-source-kind=DNSEndpoint
|
||||
policy: sync
|
||||
sources: ["crd", "ingress"]
|
||||
txtPrefix: k8s.
|
||||
txtOwnerId: default
|
||||
domainFilters: ["${SECRET_DOMAIN}"]
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: external-dns-secret
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./dnsendpoint-crd.yaml
|
||||
- ./secret.sops.yaml
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,8 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: external-dns-secret
|
||||
namespace: networking
|
||||
stringData:
|
||||
api-token: "{{ bootstrap_cloudflare_token }}"
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-external-dns
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/networking/external-dns/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: ingress-nginx
|
||||
version: 4.7.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: ingress-nginx
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
dependsOn:
|
||||
- name: cloudflared
|
||||
namespace: networking
|
||||
values:
|
||||
controller:
|
||||
extraEnvs:
|
||||
- name: TZ
|
||||
value: "${TIMEZONE}"
|
||||
service:
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: "ingress.${SECRET_DOMAIN}"
|
||||
io.cilium/lb-ipam-ips: "{{ bootstrap_ingress_nginx_addr }}"
|
||||
externalTrafficPolicy: Cluster
|
||||
publishService:
|
||||
enabled: true
|
||||
ingressClassResource:
|
||||
default: true
|
||||
config:
|
||||
client-header-timeout: 120
|
||||
client-body-buffer-size: "100M"
|
||||
client-body-timeout: 120
|
||||
enable-brotli: "true"
|
||||
hsts-max-age: "31449600"
|
||||
keep-alive: 120
|
||||
keep-alive-requests: 10000
|
||||
proxy-body-size: "100M"
|
||||
ssl-protocols: "TLSv1.3 TLSv1.2"
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
namespace: networking
|
||||
namespaceSelector:
|
||||
any: true
|
||||
extraArgs:
|
||||
default-ssl-certificate: "networking/${SECRET_DOMAIN/./-}-staging-tls"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 250Mi
|
||||
limits:
|
||||
memory: 500Mi
|
||||
defaultBackend:
|
||||
enabled: false
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./staging.yaml
|
||||
# - ./production.yaml
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: "${SECRET_DOMAIN/./-}-production"
|
||||
namespace: networking
|
||||
spec:
|
||||
secretName: "${SECRET_DOMAIN/./-}-production-tls"
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: "${SECRET_DOMAIN}"
|
||||
dnsNames:
|
||||
- "${SECRET_DOMAIN}"
|
||||
- "*.${SECRET_DOMAIN}"
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: "${SECRET_DOMAIN/./-}-staging"
|
||||
namespace: networking
|
||||
spec:
|
||||
secretName: "${SECRET_DOMAIN/./-}-staging-tls"
|
||||
issuerRef:
|
||||
name: letsencrypt-staging
|
||||
kind: ClusterIssuer
|
||||
commonName: "${SECRET_DOMAIN}"
|
||||
dnsNames:
|
||||
- "${SECRET_DOMAIN}"
|
||||
- "*.${SECRET_DOMAIN}"
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-ingress-nginx-certificates
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-cert-manager-issuers
|
||||
path: ./kubernetes/apps/networking/ingress-nginx/certificates
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-ingress-nginx
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-ingress-nginx-certificates
|
||||
path: ./kubernetes/apps/networking/ingress-nginx/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: k8s-gateway
|
||||
namespace: networking
|
||||
spec:
|
||||
interval: 30m
|
||||
chart:
|
||||
spec:
|
||||
chart: k8s-gateway
|
||||
version: 2.0.4
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: k8s-gateway
|
||||
namespace: flux-system
|
||||
maxHistory: 2
|
||||
install:
|
||||
createNamespace: true
|
||||
remediation:
|
||||
retries: 3
|
||||
upgrade:
|
||||
cleanupOnFail: true
|
||||
remediation:
|
||||
retries: 3
|
||||
uninstall:
|
||||
keepHistory: false
|
||||
values:
|
||||
fullnameOverride: k8s-gateway
|
||||
domain: "${SECRET_DOMAIN}"
|
||||
ttl: 1
|
||||
service:
|
||||
type: LoadBalancer
|
||||
port: 53
|
||||
annotations:
|
||||
io.cilium/lb-ipam-ips: "{{ bootstrap_k8s_gateway_addr }}"
|
||||
externalTrafficPolicy: Cluster
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: networking
|
||||
resources:
|
||||
- ./helmrelease.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-k8s-gateway
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/networking/k8s-gateway/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
- ./cloudflared/ks.yaml
|
||||
- ./external-dns/ks.yaml
|
||||
- ./ingress-nginx/ks.yaml
|
||||
- ./k8s-gateway/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: networking
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./namespace.yaml
|
||||
# NOTE: Only enable system-upgrade-controller if you also update the version of k3s in the following file
|
||||
# otherwise if you run ansible against an already provisioned cluster you might downgrade it
|
||||
# https://github.com/onedr0p/flux-cluster-template/blob/main/ansible/inventory/group_vars/kubernetes/main.yaml
|
||||
# - ./system-upgrade-controller/ks.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: system-upgrade
|
||||
labels:
|
||||
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# renovate: datasource=docker image=rancher/system-upgrade-controller
|
||||
- https://github.com/rancher/system-upgrade-controller/releases/download/v0.11.0/crd.yaml
|
||||
- https://github.com/rancher/system-upgrade-controller?ref=v0.11.0
|
||||
images:
|
||||
- name: rancher/system-upgrade-controller
|
||||
newTag: v0.11.0
|
||||
commonLabels:
|
||||
app.kubernetes.io/name: system-upgrade-controller
|
||||
app.kubernetes.io/instance: system-upgrade-controller
|
||||
patchesStrategicMerge:
|
||||
- |
|
||||
$patch: delete
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: system-upgrade
|
||||
+34
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-system-upgrade-controller
|
||||
namespace: flux-system
|
||||
spec:
|
||||
path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/app
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: true
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cluster-apps-system-upgrade-controller-plans
|
||||
namespace: flux-system
|
||||
spec:
|
||||
dependsOn:
|
||||
- name: cluster-apps-system-upgrade-controller
|
||||
path: ./kubernetes/apps/system-upgrade/system-upgrade-controller/plans
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: home-kubernetes
|
||||
wait: false # no flux ks dependents
|
||||
interval: 30m
|
||||
retryInterval: 1m
|
||||
timeout: 5m
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
---
|
||||
apiVersion: upgrade.cattle.io/v1
|
||||
kind: Plan
|
||||
metadata:
|
||||
name: agent
|
||||
namespace: system-upgrade
|
||||
spec:
|
||||
# renovate: datasource=github-releases depName=k3s-io/k3s
|
||||
version: "v1.27.3+k3s1"
|
||||
serviceAccountName: system-upgrade
|
||||
concurrency: 1
|
||||
nodeSelector:
|
||||
matchExpressions:
|
||||
- {key: node-role.kubernetes.io/control-plane, operator: DoesNotExist}
|
||||
prepare:
|
||||
image: rancher/k3s-upgrade
|
||||
args: ["prepare", "server"]
|
||||
upgrade:
|
||||
image: rancher/k3s-upgrade
|
||||
+6
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ./server.yaml
|
||||
- ./agent.yaml
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
---
|
||||
apiVersion: upgrade.cattle.io/v1
|
||||
kind: Plan
|
||||
metadata:
|
||||
name: server
|
||||
namespace: system-upgrade
|
||||
spec:
|
||||
# renovate: datasource=github-releases depName=k3s-io/k3s
|
||||
version: "v1.27.3+k3s1"
|
||||
serviceAccountName: system-upgrade
|
||||
concurrency: 1
|
||||
cordon: true
|
||||
nodeSelector:
|
||||
matchExpressions:
|
||||
- { key: node-role.kubernetes.io/control-plane, operator: Exists }
|
||||
tolerations:
|
||||
- { effect: NoSchedule, operator: Exists }
|
||||
- { effect: NoExecute, operator: Exists }
|
||||
- { key: node-role.kubernetes.io/control-plane, effect: NoSchedule, operator: Exists }
|
||||
- { key: node-role.kubernetes.io/master, effect: NoSchedule, operator: Exists }
|
||||
- { key: node-role.kubernetes.io/etcd, effect: NoExecute, operator: Exists }
|
||||
- { key: CriticalAddonsOnly, operator: Exists }
|
||||
upgrade:
|
||||
image: rancher/k3s-upgrade
|
||||
Reference in new issue
Block a user