kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml

@@ -18,6 +18,4 @@ spec:
               key: api-token
         selector:
           dnsZones:
-            - "${SECRET_NEW_DOMAIN}"
+            - "${SECRET_NEW_DOMAIN}"
-            - "internal.${SECRET_NEW_DOMAIN}"
-            - "*.internal.${SECRET_NEW_DOMAIN}"

kubernetes/common/apps/intel-gpu/ks.yaml

@@ -18,7 +18,4 @@ spec:
       name: sops-gpg
   dependsOn:
   - name: nfd
-    namespace: flux-system
-  # requires certificates for communications between plugins
-  - name: cert-manager
     namespace: flux-system

kubernetes/thin/apps/cilium/bgp.yaml

@@ -1,56 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumBGPClusterConfig
-metadata:
-  name: cilium-bgp
-  namespace: kube-system
-spec:
-  nodeSelector:
-    matchExpressions:
-    - key: node-role.kubernetes.io/control-plane
-      operator: DoesNotExist
-  bgpInstances:
-  - name: "bgp-public"
-    localASN: 65552
-    peers:
-    - name: "router"
-      peerASN: 65551
-      peerAddress: 192.168.1.1
-      peerConfigRef:
-        name: "cilium-peer-router"
----
-apiVersion: cilium.io/v2alpha1
-kind: CiliumBGPPeerConfig
-metadata:
-  name: cilium-peer-router
-  namespace: kube-system
-spec:
-  timers:
-    holdTimeSeconds: 9
-    keepAliveTimeSeconds: 3
-  gracefulRestart:
-    enabled: true
-    restartTimeSeconds: 15
-  families:
-    - afi: ipv4
-      safi: unicast
-      advertisements:
-        matchLabels:
-          advertise: "bgp-public"
----
-apiVersion: cilium.io/v2alpha1
-kind: CiliumBGPAdvertisement
-metadata:
-  name: bgp-public-ad
-  namespace: kube-system
-  labels:
-    advertise: "bgp-public"
-spec:
-  advertisements:
-  - advertisementType: "Service"
-    service:
-      addresses:
-      - ExternalIP
-      - LoadBalancerIP
-    selector:
-      matchLabels:
-        service-type: public

kubernetes/thin/apps/cilium/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./main-ip-pool.yaml
-- ./bgp.yaml

kubernetes/thin/apps/cilium/main-ip-pool.yaml

@@ -1,8 +0,0 @@
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: "main-pool"
-spec:
-  blocks:
-  - start: "192.168.1.50"
-    stop: "192.168.1.59"

kubernetes/thin/apps/default/home-assistant/files/helm-release.yaml

@@ -1,48 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: whoami
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.1.0
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    controllers:
-      main:
-        containers:
-          main:
-            image:
-              repository: containous/whoami
-              tag: latest
-
-    service:
-      app:
-        controller: main
-
-        ports:
-          http:
-            port: 80
-
-    ingress:
-      main:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          #traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-
-        hosts:
-        - host: "whoami.${SECRET_NEW_DOMAIN}"
-          paths:
-          - path: /
-            service:
-              identifier: app
-              port: http

kubernetes/thin/apps/default/home-assistant/files/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./helm-release.yaml

kubernetes/thin/apps/default/home-assistant/ks.yaml

@@ -1,25 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: whoami
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./kubernetes/thin/apps/default/whoami/files
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substitute: {}
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

kubernetes/thin/apps/default/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./whoami/ks.yaml

kubernetes/thin/apps/default/whoami/files/helm-release.yaml

@@ -1,48 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: whoami
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 3.1.0
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    controllers:
-      main:
-        containers:
-          main:
-            image:
-              repository: containous/whoami
-              tag: latest
-
-    service:
-      app:
-        controller: main
-
-        ports:
-          http:
-            port: 80
-
-    ingress:
-      main:
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          #traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-
-        hosts:
-        - host: "whoami.${SECRET_NEW_DOMAIN}"
-          paths:
-          - path: /
-            service:
-              identifier: app
-              port: http

kubernetes/thin/apps/default/whoami/files/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./helm-release.yaml

kubernetes/thin/apps/default/whoami/ks.yaml

@@ -1,25 +0,0 @@
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: whoami
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./kubernetes/thin/apps/default/whoami/files
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: home-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substitute: {}
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

kubernetes/thin/apps/kustomization.yaml

@@ -2,14 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./helm-repositories.yaml
-# networking
+#- ./main-ip-pool.yaml
-- ./cilium
-- ./traefik
 - ../../common/apps/cert-manager
+- ../../common/apps/metallb
+- ../../common/apps/traefik
 # storage
 #- ../../common/apps/openebs
-# hardware
-- ../../common/apps/nfd/ks.yaml
-- ../../common/apps/intel-gpu/ks.yaml
 
-- ./default
+- ../../common/apps/nfd/ks.yaml
+- ../../common/apps/intel-gpu/ks.yaml

kubernetes/thin/apps/traefik/app/files/helm-release.yaml

@@ -1,7 +1,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: traefik-external
+  name: traefik
   namespace: traefik
 spec:
   interval: 5m
@@ -15,13 +15,13 @@ spec:
         namespace: flux-system
       interval: 1m
   values:
-    service:
-      annotations:
-        io.cilium/lb-ipam-ips: 192.168.1.50
-
     additionalArguments:
     - --api.insecure
 
+    logs:
+      general:
+        level: DEBUG
+
     providers:
       kubernetesCRD:
         enabled: true
@@ -48,7 +48,7 @@ spec:
 
       web:
         port: 8000
-        nodePort: 30080
+        #nodePort: 30080
         expose:
           default: true
         redirectTo:
@@ -57,7 +57,7 @@ spec:
 
       websecure:
         port: 8443
-        nodePort: 30443
+        #nodePort: 30443
         expose:
           default: true
         protocol: TCP
@@ -79,14 +79,9 @@ spec:
     ingressClass:
       enabled: true
       isDefaultClass: true
-      name: traefik-external
 
     metrics:
       prometheus:
         entryPoint: metrics
 
-    # Set default certificate
+    namespaceOverride: traefik
-    tlsStore:
-      default:
-        defaultCertificate:
-          secretName: wildcard-main-tls

kubernetes/thin/apps/traefik/app/files/internal-hr.yaml

@@ -1,81 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: traefik-internal
-  namespace: traefik
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: traefik
-      version: '30.1.0'
-      sourceRef:
-        kind: HelmRepository
-        name: traefik-charts
-        namespace: flux-system
-      interval: 1m
-  values:
-    service:
-      annotations:
-        io.cilium/lb-ipam-ips: 192.168.1.51
-
-    providers:
-      kubernetesCRD:
-        enabled: true
-        allowCrossNamespace: false
-        allowExternalNameServices: false
-        allowEmptyServices: false
-        namespaces: []
-
-      kubernetesIngress:
-        enabled: true
-        allowExternalNameServices: false
-        allowEmptyServices: false
-        namespaces: []
-        publishedService:
-          enabled: false
-
-    ports:
-      web:
-        port: 8000
-        nodePort: 30080
-        expose:
-          default: true
-        redirectTo:
-          port: websecure
-        protocol: TCP
-
-      websecure:
-        port: 8443
-        nodePort: 30443
-        expose:
-          default: true
-        protocol: TCP
-        tls:
-          enabled: true
-
-      metrics:
-        port: 9100
-        expose:
-          default: false
-        protocol: TCP
-
-    # Disable Dashboard
-    ingressRoute:
-      dashboard:
-        enabled: false
-
-    ingressClass:
-      enabled: true
-      isDefaultClass: false
-      name: traefik-internal
-
-    metrics:
-      prometheus:
-        entryPoint: metrics
-    
-    # Set default certificate
-    tlsStore:
-      default:
-        defaultCertificate:
-          secretName: wildcard-main-tls

kubernetes/thin/apps/traefik/app/files/kustomization.yaml

@@ -4,5 +4,4 @@ resources:
 - ./namespace.yaml
 - ./helm-repository.yaml
 - ./helm-release.yaml
-- ./internal-hr.yaml
 - ./dashboard-ingress.yaml

kubernetes/thin/apps/traefik/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./app/ks.yaml
-#- ./extra/ks.yaml
+- ./extra/ks.yaml