Compare commits

...

28 Commits

Author SHA1 Message Date
SeanOMik 4fe6efbfc9 Merge pull request 'Add a cluster of thin clients' (#399) from feat/thin-cluster into main
Reviewed-on: #399
2024-09-19 19:11:35 -04:00
SeanOMik dd70c87b36 fix: use correct kustomize file paths 2024-09-19 19:07:11 -04:00
SeanOMik 9e58733a47 feat: add kubevirt to thin cluster 2024-09-19 19:07:11 -04:00
SeanOMik 2b432acd32 feat: add home-assistant to thin cluster 2024-09-19 19:07:11 -04:00
SeanOMik 473ffdffc0 fix: use correct file path 2024-09-19 19:07:11 -04:00
SeanOMik 5a9e883b75 feat: switch from traefik to nginx-ingress 2024-09-19 19:07:11 -04:00
SeanOMik 3da1b8e693 fix(postgres): use correct file paths 2024-09-19 19:07:11 -04:00
SeanOMik 4fd71c59d0 feat: add postgres 2024-09-19 19:07:11 -04:00
SeanOMik d7c8537074 fix(whoami): specifiy internal ingress class 2024-09-19 19:07:11 -04:00
SeanOMik f02811f4f2 fix: use correct name and path of kustomization 2024-09-19 19:07:11 -04:00
SeanOMik 3209590082 feat: add snapshot-system and openebs mayastor 2024-09-19 19:07:11 -04:00
SeanOMik daa10b10e1 fix: change load balancer subnet, make certs valid for '*.internal' domains 2024-09-19 19:07:11 -04:00
SeanOMik bed6a15588 fix: specify bgp label on traefik services 2024-09-19 19:07:11 -04:00
SeanOMik d2be6e6cc9 fix: use correct path of thin cluster traefik 2024-09-19 19:07:11 -04:00
SeanOMik 6bb2b612a8 feat: add internal ingress, generate internal certs, setup cilium bgp, create whoami deployment 2024-09-19 19:07:11 -04:00
SeanOMik 41a06897c3 chore: remove metallb from thin cluster 2024-09-19 19:07:11 -04:00
SeanOMik 219b416fb4 fix: use correct file path 2024-09-19 19:07:11 -04:00
SeanOMik 63ad2c9c31 feat: move metallb to common, install it in thin cluster 2024-09-19 19:07:11 -04:00
SeanOMik 3a8639f80d feat: reorganize cert-manager to avoid crds race condition 2024-09-19 19:07:11 -04:00
SeanOMik 9134f887a7 feat: move cert-manager to common, add it to thin cluster 2024-09-19 19:07:11 -04:00
SeanOMik 2ec21aa757 fix(nfd, intel-gpu): use correct kustomization path 2024-09-19 19:07:11 -04:00
SeanOMik 8c224b4464 fix(traefik): add substituteFrom config map and secrets 2024-09-19 19:07:11 -04:00
SeanOMik 18c99ba347 fix: traefik crds race condition 2024-09-19 19:07:11 -04:00
SeanOMik ea0ba61a26 fix: remove metallb, use cilium load balancer ip pool instead 2024-09-19 19:07:11 -04:00
SeanOMik d54748b324 chore: remove unused traefik entrypoint 2024-09-19 19:07:11 -04:00
SeanOMik 9c3743714c fix: enable metallb crds 2024-09-19 19:07:11 -04:00
SeanOMik 9dcb7c6d90 fix: remove dependsOn: core for thin cluster 2024-09-19 19:07:11 -04:00
SeanOMik 14216829c9 feat: add new cluster, create common directory 2024-09-19 19:07:06 -04:00
127 changed files with 2060 additions and 197 deletions

View File

@ -3,20 +3,20 @@
version: "3" version: "3"
vars: vars:
CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/sops-key.sops.yaml" CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/forgejo-deploy-key.sops.yaml" GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"
tasks: tasks:
bootstrap: bootstrap:
desc: Bootstrap Flux into a Kubernetes cluster desc: Bootstrap Flux into a Kubernetes cluster
cmds: cmds:
- kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/bootstrap/flux - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
- sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename - - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
- sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename - - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
- kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/flux/config - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
preconditions: preconditions:
- { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" } - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }
reconcile: reconcile:
desc: Force update Flux to pull in changes from your Git repository desc: Force update Flux to pull in changes from the Git repository
cmd: flux reconcile --namespace flux-system kustomization cluster --with-source cmd: flux reconcile --namespace flux-system kustomization cluster --with-source

View File

@ -3,7 +3,7 @@
version: "3" version: "3"
vars: vars:
CLUSTER_DIR: "{{.ROOT_DIR}}/cluster" CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"
includes: includes:
flux: .taskfiles/Flux/Taskfile.yaml flux: .taskfiles/Flux/Taskfile.yaml

View File

@ -14,7 +14,7 @@ spec:
name: jetstack-charts name: jetstack-charts
namespace: flux-system namespace: flux-system
values: values:
installCRDs: false installCRDs: true
webhook: webhook:
enabled: true enabled: true
extraArgs: extraArgs:
@ -26,8 +26,8 @@ spec:
nameservers: nameservers:
- "1.1.1.1" - "1.1.1.1"
- "9.9.9.9" - "9.9.9.9"
prometheus: # prometheus:
servicemonitor: # servicemonitor:
enabled: true # enabled: false
labels: # labels:
release: kube-prometheus-stack # release: kube-prometheus-stack

View File

@ -1,6 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./longhorn - ./helm-repository.yaml
- ./openebs - ./helm-release.yaml
#- ./local-path-provisioner

View File

@ -0,0 +1,25 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cert-manager
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/cert-manager/app/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -1,10 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./namespace.yaml
- ./cloudflare-cred.sops.yaml - ./cloudflare-cred.sops.yaml
- ./helm-repository.yaml
- ./helm-release.yaml
- ./letsencrypt-prod.yaml - ./letsencrypt-prod.yaml
- ./letsencrypt-stage.yaml - ./letsencrypt-stage.yaml
- ./wildcard-cert.yaml - ./wildcard-cert.yaml

View File

@ -10,9 +10,6 @@ spec:
privateKeySecretRef: privateKeySecretRef:
name: letsencrypt-production name: letsencrypt-production
solvers: solvers:
# - http01:
# ingress:
# class: traefik
- dns01: - dns01:
cloudflare: cloudflare:
email: "${SECRET_MY_EMAIL}" email: "${SECRET_MY_EMAIL}"
@ -21,4 +18,6 @@ spec:
key: api-token key: api-token
selector: selector:
dnsZones: dnsZones:
- "${SECRET_NEW_DOMAIN}" - "${SECRET_NEW_DOMAIN}"
- "internal.${SECRET_NEW_DOMAIN}"
- "*.internal.${SECRET_NEW_DOMAIN}"

View File

@ -10,9 +10,6 @@ spec:
privateKeySecretRef: privateKeySecretRef:
name: letsencrypt-staging name: letsencrypt-staging
solvers: solvers:
# - http01:
# ingress:
# class: traefik
- dns01: - dns01:
cloudflare: cloudflare:
email: "${SECRET_MY_EMAIL}" email: "${SECRET_MY_EMAIL}"

View File

@ -2,14 +2,10 @@ apiVersion: cert-manager.io/v1
kind: Certificate kind: Certificate
metadata: metadata:
name: wildcard-main-cert name: wildcard-main-cert
namespace: traefik #cert-manager namespace: nginx
spec: spec:
secretName: wildcard-main-tls secretName: wildcard-main-tls
# secretTemplate:
# annotations:
# replicator.v1.mittwald.de/replicate-to: "traefik"
duration: 2160h # 90d duration: 2160h # 90d
renewBefore: 360h # 15d renewBefore: 360h # 15d
@ -20,6 +16,4 @@ spec:
dnsNames: dnsNames:
- "${SECRET_NEW_DOMAIN}" - "${SECRET_NEW_DOMAIN}"
- "*.${SECRET_NEW_DOMAIN}" - "*.${SECRET_NEW_DOMAIN}"
# - "*.k3s.${SECRET_NEW_DOMAIN}" - "*.internal.${SECRET_NEW_DOMAIN}"
# - "*.database.${SECRET_NEW_DOMAIN}"
# - "*.s3.${SECRET_NEW_DOMAIN}"

View File

@ -0,0 +1,28 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cert-manager-certificates
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/cert-manager/certs/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: cert-manager
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./app/ks.yaml
- ./certs/ks.yaml

View File

@ -0,0 +1,28 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: postgresql
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/database/dbs/postgresql
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: openebs-sc
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,42 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: postgresql
namespace: database
spec:
interval: 5m
chart:
spec:
chart: postgresql
version: 14.3.x
sourceRef:
kind: HelmRepository
name: bitnami-charts
namespace: flux-system
values:
auth:
existingSecret: "pgsql-secrets"
secretKeys:
adminPasswordKey: "adminPassword"
replicationPasswordKey: "replicationPassword"
serviceMonitor:
enabled: true
labels:
release: kube-prometheus-stack
volumePermissions:
enabled: true
primary:
persistence:
existingClaim: "postgresql-pvc"
containerSecurityContext:
enabled: true
runAsUser: 655
readReplicas:
containerSecurityContext:
enabled: true
runAsUser: 655

View File

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./pgsql-pv.yaml
- ./pgsql.sops.yaml
- ./helm-release.yaml
#- ./pgadmin4

View File

@ -0,0 +1,47 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: pgadmin4
namespace: database
spec:
interval: 5m
chart:
spec:
chart: pgadmin4
version: "1.28.0"
sourceRef:
kind: HelmRepository
name: runix-charts
namespace: flux-system
values:
ingress:
enabled: true
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
traefik.ingress.kubernetes.io/router.entrypoints: websecure
hosts:
- host: &host pgadm.${SECRET_NEW_DOMAIN}
paths:
- path: "/"
pathType: Prefix
tls:
- hosts:
- *host
# securityContext:
# runAsUser: 10000
# runAsGroup: 10000
# fsGroup: 10000
#
# containerSecurityContext:
# enabled: true
# allowPrivilegeEscalation: false
# envVarsFromConfigMaps:
# - pgadmin4-secret
persistentVolume:
enabled: false
volumePermissions:
enabled: true

View File

@ -0,0 +1,8 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: runix-charts
namespace: flux-system
spec:
interval: 1m
url: https://helm.runix.net

View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./pgadmin4.sops.yaml
- ./helm-repository.yaml
- ./helm-release.yaml

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgresql-pvc
namespace: database
spec:
storageClassName: openebs-dual
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi

View File

@ -0,0 +1,62 @@
apiVersion: v1
kind: Secret
metadata:
name: pgsql-secrets
namespace: database
stringData:
adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: []
lastmodified: "2023-10-22T16:25:15Z"
mac: ENC[AES256_GCM,data:uWVPfKwPpR212js7f2RnCzEsMnxk2JpGPcf2L5i4gJCddJCrRJkdhjWGyVVpp/ociP3JLRTI95+WSEUH0KkPZpY1ptQevCVsUemRytOCtBlR0yR4qsBwEisSu8m4B5dbAYsqlXAndrBNL2WGB7uBv+ILgNxkhlN58unseSWJBDM=,iv:e7QyZSlhpyQ+A8OmV4p1848itIUxyam6CJOI9/N7DDY=,tag:N28mfrAjUTTYkly1hu0OhA==,type:str]
pgp:
- created_at: "2023-06-19T18:35:15Z"
enc: |
-----BEGIN PGP MESSAGE-----
hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
c5WTfk81xmbT
=UE14
-----END PGP MESSAGE-----
fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
- created_at: "2023-06-19T18:35:15Z"
enc: |
-----BEGIN PGP MESSAGE-----
hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
GFDjOxp0lMGV
=LHSB
-----END PGP MESSAGE-----
fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
encrypted_regex: ^(data|stringData)$
version: 3.8.0

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./dbs/ks.yaml

View File

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: database

View File

@ -0,0 +1,24 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: intel-gpu
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/intel-gpu/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: nfd
namespace: flux-system
# requires certificates for communications between plugins
- name: cert-manager
namespace: flux-system

View File

@ -24,4 +24,4 @@ spec:
namespace: flux-system namespace: flux-system
values: values:
crds: crds:
enabled: false enabled: true

View File

@ -1,5 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./traefik - ./helm-release.yaml
- ./metallb

View File

@ -0,0 +1,25 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: metallb
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/metallb/app/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./namespace.yaml
- ./app/ks.yaml
- ./pool/ks.yaml

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./metallb-static-ips.yaml

View File

@ -0,0 +1,28 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: metallb-pool
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/metallb/pool/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: metallb
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -7,7 +7,7 @@ metadata:
spec: spec:
timeout: 5m timeout: 5m
interval: 10m interval: 10m
path: ./kubernetes/main/core/nfd/files path: ./kubernetes/common/apps/nfd/files
prune: true prune: true
sourceRef: sourceRef:
kind: GitRepository kind: GitRepository

View File

@ -4,5 +4,4 @@ resources:
- ./namespace.yaml - ./namespace.yaml
- ./helm-repository.yaml - ./helm-repository.yaml
- ./helm-release.yaml - ./helm-release.yaml
- ./mainpool-sc.yaml
- ./monitoring-helm-release.yaml - ./monitoring-helm-release.yaml

View File

@ -17,7 +17,6 @@ spec:
values: values:
additionalArguments: additionalArguments:
- --api.insecure - --api.insecure
- --entryPoints.factorio.address=:34197/udp
logs: logs:
general: general:

View File

@ -4,5 +4,4 @@ resources:
- ./namespace.yaml - ./namespace.yaml
- ./helm-repository.yaml - ./helm-repository.yaml
- ./helm-release.yaml - ./helm-release.yaml
- ./default-tls-store.yaml
- ./dashboard-ingress.yaml - ./dashboard-ingress.yaml

View File

@ -0,0 +1,25 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: traefik
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/traefik/app/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./default-tls-store.yaml

View File

@ -0,0 +1,30 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: traefik-default-tls
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/common/apps/traefik/extra/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: traefik
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./app/ks.yaml
- ./extra/ks.yaml

View File

@ -3,9 +3,14 @@ kind: Kustomization
resources: resources:
- ./kube-system - ./kube-system
- ./helm-repositories.yaml - ./helm-repositories.yaml
- ./cert-manager - ../../common/apps/cert-manager
- ./networking - ../../common/apps/metallb
- ./storage - ../../common/apps/traefik
# storage
- ./longhorn
- ./openebs
- ./kube-replicator - ./kube-replicator
- ./nfd/ks.yaml
- ./intel-gpu/ks.yaml - ../../common/apps/nfd/ks.yaml
- ../../common/apps/intel-gpu/ks.yaml

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../common/apps/openebs
- ./mainpool-sc.yaml

View File

@ -1,82 +0,0 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: local-path-provisioner
namespace: flux-system
spec:
interval: 1m
url: https://github.com/rancher/local-path-provisioner.git
ref:
tag: v0.0.29
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: local-path-provisioner
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: ./deploy/chart/local-path-provisioner
sourceRef:
kind: GitRepository
name: local-path-provisioner
namespace: flux-system
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
helperImage:
repository: public.ecr.aws/docker/library/busybox
tag: latest
storageClass:
defaultClass: false
nodePathMap:
- node: DEFAULT_PATH_FOR_NON_LISTED_NODES
paths: ["/var/lib/rancher/k3s/storage"]
# Note: Do not enable Flux variable substitution on this HelmRelease
configmap:
setup: |-
#!/bin/sh
while getopts "m:s:p:" opt
do
case $opt in
p)
absolutePath=$OPTARG
;;
s)
sizeInBytes=$OPTARG
;;
m)
volMode=$OPTARG
;;
esac
done
mkdir -m 0777 -p ${absolutePath}
chmod 701 ${absolutePath}/..
teardown: |-
#!/bin/sh
while getopts "m:s:p:" opt
do
case $opt in
p)
absolutePath=$OPTARG
;;
s)
sizeInBytes=$OPTARG
;;
m)
volMode=$OPTARG
;;
esac
done
rm -rf ${absolutePath}

View File

@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./cluster-secrets.sops.yaml - ./cluster-secrets.sops.yaml
- ./orca-registry-puller.sops.yaml
- ./cluster-settings.yaml - ./cluster-settings.yaml

View File

@ -1,62 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: orca-puller
namespace: default
annotations:
replicator.v1.mittwald.de/replication-allowed: "true"
replicator.v1.mittwald.de/replication-allowed-namespaces: '*'
data:
.dockerconfigjson: ENC[AES256_GCM,data:g58h5rYAEZu2W3CYnYHgajsp7wvnFdhyRCt1qWPHbVDC+nwD1TVqTGDga1b2/RTR5tdobqZ9FdP41/1dzZeNBe2lfXOsWhQYd87EhpchFYRgsb9u7ZL32sxERhAxSg+0/AaoIYSHbuBLgRwxqnHOojS7Hcg956L+6Kgh/uiaOGsUrKRjlMAI0aN4agx+n/nU,iv:ichMs+o/3ld90VVq/UatXpAtpD6qjrEIdt0ZRwyh0Gg=,tag:lxvZy9U6sGsndz3sAy3DTQ==,type:str]
type: kubernetes.io/dockerconfigjson
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: []
lastmodified: "2023-07-22T02:12:00Z"
mac: ENC[AES256_GCM,data:yFHVGwFdi2n4Ju6SqqxXDxqxZaHKROIsQZtF+AtJY52f0XJif9jP2fi05dnxULnQ+wWOq4FPwVXc/9GiCiYMItecEApS0+6C7sWxKCWzYYAiFyxSajECzNtr4/XN5yoZBJCgsgFAf42jy9Nr5xLHOAVomnNfmDheS/Pe+Uq9v9E=,iv:oFKca0hHR7ERNgJqDp3pOxzQDBlTCF9Fx1yIl3HCj2o=,tag:107vU6pOFE6Na4BO5C5tiA==,type:str]
pgp:
- created_at: "2023-07-22T02:12:00Z"
enc: |
-----BEGIN PGP MESSAGE-----
hQIMAzKleRwoSoixAQ//QEVgmHtcIVC1afYtQMgD3Kwb+n0nZid3d/enKN64D+fJ
bw0xXX9tjO4sy3To49k0EDETLW5paxcNApFYL+zajxNfa+EAZfdYxQqKWraQcxvL
/p8bNDyzYDrecWcIdcq4RqrVEA4Ga0K6MmPM0t5l+J/PgguDJWmAxEzlmTb/CdqI
MpUmO0RoLHb6m0vfAkEI0LT5E/37pTdqjAq4eMT9n7zxeHr3NmJBIetahENxTKDk
Ymw7DhBCLZBPvHyxw/kU7hS/yhJMxmLw9mjHuzWkYVYmZQDB/TwqWsL4cVLFNAVu
LqZBHtl2HmaeGefhDij4SfxCj3qTi1e3z1T5wch97XmFanabNizb2oezHYou4h5k
AVqWuxUd13am9YhmRMQ32TPPxyAWpV4W87C/XnIrMrfePH2xy54S2ISyL5lQ1I3K
5/a4ZMU8hBdCw7FxX6OSAXUd5cCfelJEaRopvwgXF5ZfQjARjQ7iGCedqBQbOsZM
vsf5WQvYxp8uivj7gKxhn+KkqJoM225OQKlSwCQ2bj20WsZ3SrjBuK41iO88urej
SJLAqG42e+nUjHXn/ql794kCHHG59uRES1wWLvgQ6Siu8TxJK6B+fjOrHBMOeSiD
oMKyqWIvziXN5KczkIpOWFCJzHb+AGTUn/a/jCLAqAxAqkWHwwbLdMiUv1053vHS
XgHkdbFnWqSekHCdLXu6q1lJhY+VAyzI55Ex2HvdxzBxWQKZAD4c1fFN/88j/Fb4
6/IVZvSU45coCyUR3O+py0s6XvBjrJL6W4haNXMl6nVcTxHgby1JTX5vickv400=
=cqEc
-----END PGP MESSAGE-----
fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
- created_at: "2023-07-22T02:12:00Z"
enc: |
-----BEGIN PGP MESSAGE-----
hQIMAy5t8IMoPu4VAQ//RAyoi7oTNza3klhojjvUXum9iH3pOl1eqNu3qdJc9L4A
rGeo7Q9NTgywAaHQA4N0WPjJfFNkKSFLBxbtRpzlVCNrfontoGoFr5fGFWDh2Kfe
LydY3Zz9yUfcQYuGm8onVM6B6ImYUtM9ZPix808jxfiuz7rvqNmxqTdCa9o5oMHK
TqQ5u26MBR9cFf+W7bxKdDsqm4vEhxxWpEf5wgX+iZboA4O/J8LCVwrp6pb2pJ1q
nMA5ElKk/WZbsB6C20DYNXJRsdHjC1Huye6NDt1Em2XY9qcfWkQskVtohlYCdDCp
TciHgOF32rmN7h1i4j5Ae58AaSQmNRpKZFc192z8+dHdiSlzQEno6XXV11pezz/i
0ALvy2Q+r7xFA8xXyrOf7xOU/j9T8XCEAeidtQoZzEcINtg93tKItakzqacxRa2C
4Yj3Wic3LGSX13dZ5cpQNT6P3F6UMVAlVEEu1lHdsAjShbmuFWSFNXVo473O3Nwu
1imHmfb1xnqbiWS0tKdUX9jMQg+xYPrsAXQESq/9PmPJxl4tsGPzzCu+rMKf9pmF
XqGBASdcf9WaB4Hojm6+4UKb7pPDKAC2vLnOV9ilGv/0z+DwxU0x9swPkAYBm9M9
KkcaEh8petqyU2J8f91ESU3OafMo2h5OsJvzB2Zte2XIZIZV0h0y8mo6LKOJ1hzS
XgFiMVicO02DFcMkSJXA7ZVnV+1qfJl5vPW6Sa0vDikz/k8jYoRSv2skwZcpFIYf
Kr6LbZskq2QVBDS50HdpbOfyF+N8/mYuSfjKkuVH8oOq0KrZ38eJROiygPgpUYk=
=i9P2
-----END PGP MESSAGE-----
fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
encrypted_regex: ^(data|stringData)$
version: 3.7.3

View File

@ -0,0 +1,54 @@
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPClusterConfig
metadata:
name: cilium-bgp
spec:
nodeSelector:
matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: DoesNotExist
bgpInstances:
- name: "bgp-public"
localASN: 65552
peers:
- name: "router"
peerASN: 65551
peerAddress: 192.168.1.1
peerConfigRef:
name: "cilium-peer-router"
---
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPPeerConfig
metadata:
name: cilium-peer-router
spec:
timers:
holdTimeSeconds: 9
keepAliveTimeSeconds: 3
gracefulRestart:
enabled: true
restartTimeSeconds: 15
families:
- afi: ipv4
safi: unicast
advertisements:
matchLabels:
advertise: "bgp-public"
---
apiVersion: cilium.io/v2alpha1
kind: CiliumBGPAdvertisement
metadata:
name: bgp-public-ad
labels:
advertise: "bgp-public"
spec:
advertisements:
- advertisementType: "Service"
service:
addresses:
#- ClusterIP
- ExternalIP
- LoadBalancerIP
selector:
matchLabels:
bgp/service-type: public

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./main-ip-pool.yaml
- ./bgp.yaml

View File

@ -0,0 +1,8 @@
apiVersion: "cilium.io/v2alpha1"
kind: CiliumLoadBalancerIPPool
metadata:
name: "main-pool"
spec:
blocks:
- start: "192.168.2.50"
stop: "192.168.2.59"

View File

@ -0,0 +1,128 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: home-assistant
namespace: default
spec:
interval: 5m
chart:
spec:
chart: app-template
version: 3.4.0
sourceRef:
kind: HelmRepository
name: bjws-charts
namespace: flux-system
dependsOn:
- name: openebs
namespace: openebs
values:
controllers:
main:
containers:
app:
image:
repository: ghcr.io/onedr0p/home-assistant
tag: 2024.9.1
env:
TZ: America/New_York #${SERVER_TIMEZONE}
HASS_HTTP_TRUSTED_PROXY_1: 192.168.0.0/16
HASS_HTTP_TRUSTED_PROXY_2: 10.0.0.0/8
HASS_SECRET_URL: &hassHost "hass.thin.seanomik.net" #${SECRET_NEW_DOMAIN}
HOME_ASSISTANT__HACS_INSTALL: "true"
envFrom:
- secretRef:
name: home-assistant
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities: { drop: ["ALL"] }
resources:
requests:
cpu: 10m
limits:
memory: 2Gi
code-server:
image:
repository: ghcr.io/coder/code-server
tag: 4.92.2
args: [
"--auth", "none",
"--user-data-dir", "/config/.vscode",
"--extensions-dir", "/config/.vscode",
"--port", "12321",
"/config"
]
resources:
requests:
cpu: 10m
limits:
memory: 512Mi
defaultPodOptions:
securityContext:
runAsNonRoot: true
runAsUser: 568
runAsGroup: 568
fsGroup: 568
fsGroupChangePolicy: OnRootMismatch
seccompProfile: { type: RuntimeDefault }
service:
app:
controller: main
ports:
http:
port: 8123
code-server:
port: 12321
ingress:
app:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
traefik.ingress.kubernetes.io/router.entrypoints: websecure
#traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
className: external
hosts:
- host: *hassHost
paths:
- path: /
service:
identifier: app
port: http
code-server:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
traefik.ingress.kubernetes.io/router.entrypoints: websecure
#traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
className: internal
hosts:
- host: "hass-code.internal.thin.seanomik.net"
paths:
- path: /
service:
identifier: app
port: code-server
persistence:
config:
existingClaim: home-assistant-config
globalMounts:
- path: /config
logs:
type: emptyDir
globalMounts:
- path: /config/logs
tts:
type: emptyDir
globalMounts:
- path: /config/tts
tmp:
type: emptyDir
globalMounts:
- path: /tmp

View File

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./pvc.yaml
- ./secret.sops.yaml
- ./helm-release.yaml

View File

@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: home-assistant-config
namespace: default
spec:
accessModes:
- ReadWriteOnce
storageClassName: openebs-dual
resources:
requests:
storage: 6Gi

View File

@ -0,0 +1,75 @@
apiVersion: v1
kind: Secret
metadata:
name: home-assistant
namespace: default
type: Opaque
stringData:
HASS_SECRET_ELEVATION: ENC[AES256_GCM,data:+dg6fw==,iv:8YPS3cD/qnZcQCwjdSVYJ5x/z0rSR8jplZfxr1EPqJk=,tag:2S0JTIYBvxN5tAnLMLMwtQ==,type:str]
HASS_SECRET_LATITUDE: ENC[AES256_GCM,data:Kgq3N7fRG8Dn2g==,iv:7m7RQM1WcIKTLfMr1cjcFxqnYJ+7llKNY6Mdl9MdVmI=,tag:wtgsJsCov1BxN0LW3bn2cg==,type:str]
HASS_SECRET_LONGITUDE: ENC[AES256_GCM,data:fBTv0J7rNN6Tt5I=,iv:lU0J2Qd1rRzrIKhYUDeqcQfRidGvsBzby7a/9UiCKYU=,tag:Lyh1QS3WIpP0tl0g9NEQMg==,type:str]
HASS_SECRET_DB_URL: ENC[AES256_GCM,data:YXk+YKDlqnrn7hxGe4Q5cTaafK2ijRWf2NtAltdeJmQ3sAL3Z8N7yV3VwSUkL9Re181JRXeiIebEoIMx2DDlTaYMcnGPQyqjSWBMSt4/+WgmZ0Q=,iv:5N/dbYht2ts26GAh14BxNA3zq7US+s8WbmNWFJtO+jk=,tag:6sqa0kufUdkyMVdJ9rVCdA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: []
lastmodified: "2024-09-16T00:34:28Z"
mac: ENC[AES256_GCM,data:zoW6fr1LbCpxj+47BS7YSJtT8CF3QLdkYR+JsNmVNv+NZ5229TC+RGWbSwjyHtqb7Xxzhwzuna8kVR9Jg8dnJOZhEJM2uY7rTx0z0tpakdvUggxDiBH3W8nIc//DzxgbGZwtP9/LNpzE0ucvTKrqJsUW6/Idu815bLknNbeaPxo=,iv:KbbWZ17JQNsCuSI26nGKwKjoP4aULua3GBCJbQgNpyI=,tag:PvEhlwCpYMtJB8lx5vmVfQ==,type:str]
pgp:
- created_at: "2024-09-16T00:34:28Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMAyqlIeyoxYovAQ//WFv9Y/YWKUUEV7ymMAqVpCdiVp1DiRBbsNVlBCi+x2lF
NO/AHTeTvJL+9uyavQsSQVuuIhCMG9R7uwTAQaLgZat8Q3ToC4ntEjoxQQfKsUTl
1qfsFTTGW8PJbekkvZmufTMTzmJ+8j0TGnQeCcI9D/XmE/fDP+P551YLCXJm/MtC
xGo1Wz27n0YYseWRjO6hAOU0/z3tQxgEYU40uWt/Wego3XaXVIAOC7E+uxbVIGfW
DsQQQi3E5mKGdWB6VvzozstneZuDNU+GiNCCHsYYCCSMwT4z1FFPTl3T4Qr+yRbQ
Ylh5y7LQsVmHnwzC2eDatxL2v7chSoYWczZMKTmNCcppZ1Lvas14Cd9MdC/yt2yD
jDrXtyw1jPho+A688EvB7E/nCEXnchL0xqCcCqa7IE3+hhZzxLWysfz4QM0Mg2rv
j7QLP2/ssuB9K2dOrudkE0MUzQyf5tu9Av7YD+KR0SEcuQ/Y2yvnScLf4SS/NEgG
erB8e44M/NG/CN38YOxPGtK9FcxjJKyDfk5S//TPteZBgtKwf18H5SDonu3E6WUU
Z61U/Vw31xtIuFVRPAQc5qzfCVQ9N0zJx28F3QJXcgMzmEVHQKyJ+/u9ytfTQpg5
CPfexvgNg9CR++p6MY0tie07iLkmoT23hq1A36Q+pnyqR1bZVu0vVIVtOIANG3qF
AgwDXjg0p2IN1X8BD/4oBsOiwYJYAPdsxtQyMoj92r6NUl+STRdvalSyweJqf9xK
RfQzlNtdN6ADTD7p6PKZxg/Bb9HGJe7eUto78Eqn9Uqu67pGPCUiaVk7JUUayGHd
Fay3OJYuLEgukEo1okq+yBDjj+dGwTJ17Cl8hYgNSyeGCAiXqUkktkRXkjvhI55X
lgOc3wiaRqcuLFG5h00qo3Wy4ESzuQSKFEimpSec8CSxuY/vTg8CFjekkmUerNmd
eKKW6q0IB2WUrxbvG4moF+4pK6F8zOgF1B94cFuFHoDQ1sOFkUI95v0/mEi6qIX4
gTD6DAbgmZCyFWrfH1ogU7vpa2aDrFDHYLFyjESX6zhMVnQwetQsgdQ3C2Q5HpD5
uWuzbVSOVpUzwOsgwP1bUn6Layxnk3cVtgLj5ODdUYSBJZ6/ReQ/aQjhUpNVQIUA
inqCuL6dSFDTKKwDpzdVTX105knBNP5pHaDVdFN+iUu9pbFGSqWAZQ/XtfznBSbl
QntMp70zVe5TlMtB7DCpkRcgI/oOLjciM+ITVW3mh7nX0tbBUZ/2T/KKPwFHNI/4
wU/TH13RW0l92eJRXYarYsOqsDsYzlkOoPupNQFK8UVu44cVe/jPJNNi9yU8EN5r
2VoKr2F7sYprbSunhFrOXFGngCs0pgk6lKcWKE6mP8b2AmmX0FHBjojTDRu3D9Rm
AQkCEHK/1D/N2aQA8WZBnz87r51MTQ+dqxTu9tAOjCGX2jP1NvQqnS2vL+iqsvlo
CxojBsFhFZXLpd/op2N+4nFMA0HAPl4pKj5hi6tUEzkXr9ltfvnIMdv0ZoZoM61r
B1xdW8jX
=HAf4
-----END PGP MESSAGE-----
fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
- created_at: "2024-09-16T00:34:28Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMAy5t8IMoPu4VAQ//S4pP46cksxK/sNjHKP8A8uY3KNewuTd9URB605mXlaAA
iTMnujsimRREiYoxkcgCIuxoYgpXoi30XrlrSbdKwSt1flGRjVBtW62uvgFRn/Ya
qmZimGRyhSr0NWMZdsCoOGECCd21lGOwGeTmZzcsvYtzT0fgpYoRtQv0L44eBuFy
uzNIvDw7SvvjM2nGWI6VAlAg6CnAz3Fo9JbccZINqgfRTNhtkHU5R6M0M6EjmN6M
xkcr280dOdV3dWKfAtZld2aPb9QLj2vxYxcSqaqQ3jLpmy5JrCT+E4fxt6THyg4R
x9EGds30zUOUwB5hOJGF+dPPdb3M1imZZymDYZ65WDt6nttRVz9p1Vxu8BiMzMef
CPcrArf5ic+TDp4QydwAb3UjkT+b8/iHGLrFLn7E7s9xaWN8Y8wHxhABjEMKia/8
hhZozgapC7EIK10Qq4S+mce+pQrLdPrz++/jEL5enuh3vo8s6PSCAbM7sxjoNUV0
Sjbl3lOlbvRLMRJoxMgeHCYKR8HBKYX3lbPSOl0+D2rwibdrbuk1N4NMq0z9YU3O
PCEDpGxzj469yss1XbpoANG7EpS9uMdTN+ONE1Xx7AvsADMrNvdJeLvku93bknZw
6rD1aSBau98H/WGM1XGu0nOzQgxtfCoaFRnXf03lMldWlkQnwYuhZPs+3mwg8vfU
ZgEJAhD4mf23O6K9MUJFjoHABoZAQqX2UEc7TRjIc+YHGg8PekuK4yTWIKkHIvUL
WdiWaO8gB+QmoyHt6bg4+di1iqTujnKTPqPF6ehpoDlqWHXWs2mxl2UiC6DGUHlm
oIfC9MKtDA==
=uXt0
-----END PGP MESSAGE-----
fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
encrypted_regex: ^(data|stringData)$
version: 3.9.0

View File

@ -0,0 +1,30 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: home-assistant
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/default/home-assistant/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: openebs-sc
namespace: flux-system
- name: postgresql
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./whoami/ks.yaml
- ./home-assistant/ks.yaml

View File

@ -0,0 +1,49 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: whoami
namespace: default
spec:
interval: 5m
chart:
spec:
chart: app-template
version: 3.1.0
sourceRef:
kind: HelmRepository
name: bjws-charts
namespace: flux-system
values:
controllers:
main:
containers:
main:
image:
repository: containous/whoami
tag: latest
service:
app:
controller: main
ports:
http:
port: 80
ingress:
main:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
traefik.ingress.kubernetes.io/router.entrypoints: websecure
#traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
className: internal
hosts:
- host: "whoami.${SECRET_NEW_DOMAIN}"
paths:
- path: /
service:
identifier: app
port: http

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-release.yaml

View File

@ -0,0 +1,25 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: whoami
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/default/whoami/files
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,26 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: bitnami-charts
namespace: flux-system
spec:
interval: 1m
url: https://charts.bitnami.com/bitnami
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: bjws-charts
namespace: flux-system
spec:
interval: 1m
url: https://bjw-s.github.io/helm-charts
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: ingress-nginx
namespace: flux-system
spec:
interval: 1m
url: https://kubernetes.github.io/ingress-nginx

View File

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/kubevirt/containerized-data-importer/releases/download/v1.60.3/cdi-cr.yaml
# change namespace to kubevirt-cdi
transformers:
- ../namespace-transformer.yaml

View File

@ -0,0 +1,62 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubevirt-cdi-operator
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/kubevirt-cdi/operator
prune: true
targetNamespace: kubevirt-cdi
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: kubevirt-operator
namespace: flux-system
- name: kubevirt-operator-cr
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubevirt-cdi-cr
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/kubevirt-cdi/cr
prune: true
targetNamespace: kubevirt-cdi
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: kubevirt-cdi-operator
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,11 @@
apiVersion: builtin
kind: NamespaceTransformer
metadata:
name: change-cdi-namespace
namespace: kubevirt-cdi
setRoleBindingSubjects: none
unsetOnly: false
fieldSpecs:
- path: metadata/name
kind: Namespace
create: true

View File

@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/kubevirt/containerized-data-importer/releases/download/v1.60.3/cdi-operator.yaml
# change namespace to kubevirt-cdi
transformers:
- ../namespace-transformer.yaml

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/kubevirt/kubevirt/releases/download/v1.3.1/kubevirt-cr.yaml

View File

@ -0,0 +1,60 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubevirt-operator
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/kubevirt/operator
prune: true
targetNamespace: kubevirt
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: openebs
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubevirt-operator-cr
namespace: flux-system
spec:
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/kubevirt/cr
prune: true
targetNamespace: kubevirt
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
dependsOn:
- name: kubevirt-operator
namespace: flux-system
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/kubevirt/kubevirt/releases/download/v1.3.1/kubevirt-operator.yaml

View File

@ -0,0 +1,20 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-repositories.yaml
# networking
- ./cilium
- ./nginx/ks.yaml
- ../../common/apps/cert-manager
# storage
- ./snapshot-system/ks.yaml
- ./openebs/ks.yaml
# hardware
- ../../common/apps/nfd/ks.yaml
- ../../common/apps/intel-gpu/ks.yaml
# VMs
- ./kubevirt/ks.yaml
- ./kubevirt-cdi/ks.yaml
- ../../common/apps/database
- ./default

View File

@ -0,0 +1,102 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: nginx-external
spec:
interval: 30m
chart:
spec:
chart: ingress-nginx
version: 4.11.2
sourceRef:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
fullnameOverride: nginx-external
controller:
replicaCount: 2
service:
annotations:
io.cilium/lb-ipam-ips: 192.168.2.50
labels:
bgp/service-type: public
ingressClassResource:
name: external
default: false
controllerValue: k8s.io/external
admissionWebhooks:
objectSelector:
matchExpressions:
- key: ingress-class
operator: In
values: ["external"]
allowSnippetAnnotations: true
config:
# taken from https://github.com/superseriousbusiness/gotosocial/blob/main/internal/web/robots.go
block-user-agents: "GPTBot,~*GPTBot*,ChatGPT-User,~*ChatGPT-User*,Google-Extended,~*Google-Extended*,CCBot,~*CCBot*,Omgilibot,~*Omgilibot*,FacebookBot,~*FacebookBot*"
client-body-buffer-size: 100M
client-body-timeout: 120
client-header-timeout: 120
enable-brotli: "true"
enable-ocsp: "true"
enable-real-ip: "true"
force-ssl-redirect: "true"
hide-headers: Server,X-Powered-By
hsts-max-age: 31449600
keep-alive-requests: 10000
keep-alive: 120
log-format-escape-json: "true"
log-format-upstream: >
{"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr", "x_forwarded_for": "$proxy_add_x_forwarded_for",
"request_id": "$req_id", "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time,
"status": $status, "vhost": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args",
"request_length": $request_length, "duration": $request_time, "method": "$request_method", "http_referrer": "$http_referer",
"http_user_agent": "$http_user_agent"}
proxy-body-size: 0
proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2
use-forwarded-headers: "true"
metrics:
enabled: false # TODO
serviceMonitor:
enabled: true
namespaceSelector:
any: true
extraArgs:
default-ssl-certificate: nginx/wildcard-main-tls
terminationGracePeriodSeconds: 120
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/instance: nginx-external
app.kubernetes.io/component: controller
resources:
requests:
cpu: 100m
limits:
memory: 500Mi
defaultBackend:
enabled: false

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-release.yaml

View File

@ -0,0 +1,102 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: nginx-internal
spec:
interval: 30m
chart:
spec:
chart: ingress-nginx
version: 4.11.2
sourceRef:
kind: HelmRepository
name: ingress-nginx
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
fullnameOverride: nginx-internal
controller:
replicaCount: 2
service:
annotations:
io.cilium/lb-ipam-ips: 192.168.2.51
labels:
bgp/service-type: public
ingressClassResource:
name: internal
default: true
controllerValue: k8s.io/internal
admissionWebhooks:
objectSelector:
matchExpressions:
- key: ingress-class
operator: In
values: ["internal"]
allowSnippetAnnotations: true
config:
# taken from https://github.com/superseriousbusiness/gotosocial/blob/main/internal/web/robots.go
block-user-agents: "GPTBot,~*GPTBot*,ChatGPT-User,~*ChatGPT-User*,Google-Extended,~*Google-Extended*,CCBot,~*CCBot*,Omgilibot,~*Omgilibot*,FacebookBot,~*FacebookBot*"
client-body-buffer-size: 100M
client-body-timeout: 120
client-header-timeout: 120
enable-brotli: "true"
enable-ocsp: "true"
enable-real-ip: "true"
force-ssl-redirect: "true"
hide-headers: Server,X-Powered-By
hsts-max-age: 31449600
keep-alive-requests: 10000
keep-alive: 120
log-format-escape-json: "true"
log-format-upstream: >
{"time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr", "x_forwarded_for": "$proxy_add_x_forwarded_for",
"request_id": "$req_id", "remote_user": "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time,
"status": $status, "vhost": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args",
"request_length": $request_length, "duration": $request_time, "method": "$request_method", "http_referrer": "$http_referer",
"http_user_agent": "$http_user_agent"}
proxy-body-size: 0
proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2
use-forwarded-headers: "true"
metrics:
enabled: false # TODO
serviceMonitor:
enabled: true
namespaceSelector:
any: true
extraArgs:
default-ssl-certificate: nginx/wildcard-main-tls
terminationGracePeriodSeconds: 120
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/instance: nginx-internal
app.kubernetes.io/component: controller
resources:
requests:
cpu: 100m
limits:
memory: 500Mi
defaultBackend:
enabled: false

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helm-release.yaml

View File

@ -0,0 +1,53 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: nginx-external
namespace: flux-system
spec:
targetNamespace: nginx
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/nginx/external
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: nginx-internal
namespace: flux-system
spec:
targetNamespace: nginx
timeout: 5m
interval: 10m
path: ./kubernetes/thin/apps/nginx/internal
prune: true
sourceRef:
kind: GitRepository
name: home-cluster
decryption:
provider: sops
secretRef:
name: sops-gpg
postBuild:
substitute: {}
substituteFrom:
- kind: ConfigMap
name: cluster-settings
- kind: Secret
name: cluster-secrets

View File

@ -0,0 +1,69 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: openebs
namespace: openebs
spec:
interval: 5m
chart:
spec:
chart: openebs
version: 4.1.0
sourceRef:
kind: HelmRepository
name: openebs
namespace: flux-system
values:
openebs-crds:
csi:
volumeSnapshots:
enabled: false
keep: false
# Refer to https://github.com/openebs/dynamic-localpv-provisioner/blob/HEAD/deploy/helm/charts/values.yaml for complete set of values.
localpv-provisioner:
rbac:
create: true
localpv:
enabled: true
hostpathClass:
enabled: true
# Refer to https://github.com/openebs/mayastor-extensions/blob/v2.7.0/chart/values.yaml for complete set of values.
mayastor:
enabled: true
nodeSelector:
kubernetes.io/arch: amd64
openebs.io/engine: mayastor
csi:
node:
initContainers:
enabled: true
etcd:
# -- Kubernetes Cluster Domain
clusterDomain: cluster.local
crds:
enabled: false
monitoring:
enabled: false
loki-stack:
enabled: false
storageClass:
nameSuffix: single
tolerations:
# tolerate control plane
- key: "node-role.kubernetes.io/control-plane"
operator: "Exists"
effect: "NoSchedule"
engines:
local:
lvm:
enabled: true
zfs:
enabled: true
replicated:
mayastor:
enabled: true

View File

@ -0,0 +1,17 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: openebs
namespace: flux-system
spec:
interval: 1m
url: https://openebs.github.io/openebs
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: openebs-monitoring-charts
namespace: flux-system
spec:
interval: 1m
url: https://openebs.github.io/monitoring

Some files were not shown because too many files have changed in this diff Show More