feat(cilium): add cilium config that enables everything needed for l2 loadbalancing

kubernetes/thin/apps/helm-repositories.yaml

@@ -33,3 +33,30 @@ metadata:
 spec:
   interval: 1m
   url: https://victoriametrics.github.io/helm-charts
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://grafana.github.io/helm-charts
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://prometheus-community.github.io/helm-charts
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cilium
+  namespace: flux-system
+spec:
+  interval: 2h
+  url: https://helm.cilium.io/

kubernetes/thin/apps/kube-system/cilium/app/helm-release.yaml

@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cilium
+      version: 1.16.2
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+        namespace: flux-system
+  values:
+    l2announcements:
+      enabled: true
+    k8sClientRateLimit:
+      qps: 43
+      burst: 86
+    kubeProxyReplacement: true
+    k8sServiceHost: 127.0.0.1 #192.168.1.20
+    k8sServicePort: 6443
+    devices: enp+ #0s31f6
+    enableRuntimeDeviceDetection: true
+    externalIPs:
+      enabled: true
+    rollOutCiliumPods: true

kubernetes/thin/apps/kube-system/cilium/app/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./helm-release.yaml

kubernetes/thin/apps/kube-system/cilium/config/kustomization.yaml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./l2.yaml

kubernetes/thin/apps/kube-system/cilium/config/l2.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cilium.io/ciliuml2announcementpolicy_v2alpha1.json
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: policy
+spec:
+  nodeSelector:
+    matchExpressions:
+      - key: node-role.kubernetes.io/control-plane
+        operator: DoesNotExist
+  interfaces: ["^enp.*"]
+  loadBalancerIPs: true
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cilium.io/ciliumloadbalancerippool_v2alpha1.json
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: main-pool
+spec:
+  allowFirstLastIPs: "Yes"
+  blocks:
+    - # same subnet as nodes
+      start: 192.168.1.50
+      stop: 192.168.1.69

kubernetes/thin/apps/kube-system/cilium/ks.yaml

@@ -0,0 +1,57 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  path: ./kubernetes/thin/apps/kube-system/cilium/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium-config
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  path: ./kubernetes/thin/apps/kube-system/cilium/config
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
+  dependsOn:
+  - name: cilium

kubernetes/thin/apps/kube-system/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./cilium/ks.yaml

kubernetes/thin/apps/kustomization.yaml

@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./helm-repositories.yaml
+- ./kube-system
 # networking
-- ./cilium
 - ./nginx/ks.yaml
 - ../../common/apps/cert-manager
 # storage