feat(cilium): add cilium config that enables everything needed for l2 loadbalancing

This commit is contained in:
SeanOMik 2024-09-27 15:49:17 -04:00
parent 3578438b19
commit a64e2fed75
Signed by: SeanOMik
GPG Key ID: FEC9E2FC15235964
8 changed files with 153 additions and 2 deletions

View File

@ -32,4 +32,31 @@ metadata:
namespace: flux-system
spec:
interval: 1m
url: https://victoriametrics.github.io/helm-charts
url: https://victoriametrics.github.io/helm-charts
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: grafana
namespace: flux-system
spec:
interval: 1m
url: https://grafana.github.io/helm-charts
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: prometheus-community
namespace: flux-system
spec:
interval: 1m
url: https://prometheus-community.github.io/helm-charts
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: cilium
namespace: flux-system
spec:
interval: 2h
url: https://helm.cilium.io/

View File

@ -0,0 +1,30 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
spec:
interval: 30m
chart:
spec:
chart: cilium
version: 1.16.2
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
values:
l2announcements:
enabled: true
k8sClientRateLimit:
qps: 43
burst: 86
kubeProxyReplacement: true
k8sServiceHost: 127.0.0.1 #192.168.1.20
k8sServicePort: 6443
devices: enp+ #0s31f6
enableRuntimeDeviceDetection: true
externalIPs:
enabled: true
rollOutCiliumPods: true

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-release.yaml

View File

@ -0,0 +1,5 @@
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./l2.yaml

View File

@ -0,0 +1,24 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cilium.io/ciliuml2announcementpolicy_v2alpha1.json
apiVersion: "cilium.io/v2alpha1"
kind: CiliumL2AnnouncementPolicy
metadata:
name: policy
spec:
nodeSelector:
matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: DoesNotExist
interfaces: ["^enp.*"]
loadBalancerIPs: true
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cilium.io/ciliumloadbalancerippool_v2alpha1.json
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
name: main-pool
spec:
allowFirstLastIPs: "Yes"
blocks:
- # same subnet as nodes
start: 192.168.1.50
stop: 192.168.1.69

View File

@ -0,0 +1,57 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium
namespace: flux-system
spec:
targetNamespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 5m
path: ./kubernetes/thin/apps/kube-system/cilium/app
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium-config
namespace: flux-system
spec:
targetNamespace: kube-system
interval: 30m
retryInterval: 1m
timeout: 5m
path: ./kubernetes/thin/apps/kube-system/cilium/config
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets
dependsOn:
- name: cilium

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./cilium/ks.yaml

View File

@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-repositories.yaml
- ./kube-system
# networking
- ./cilium
- ./nginx/ks.yaml
- ../../common/apps/cert-manager
# storage