From 76b5d3925e75fc039841fc6518e163f7be32b2fd Mon Sep 17 00:00:00 2001 From: Kjeld Schouten Date: Tue, 5 Nov 2024 21:50:13 +0100 Subject: [PATCH] feat(clustertool): add traefik, clusterissuer and blocky bare-bones --- .../embed/generic/base/clusterenv.yaml | 13 +++- .../core/blocky/app/helm-release.yaml | 73 +++++++++++++++++++ .../kubernetes/core/blocky/app/namespace.yaml | 6 ++ .../core/clusterissuer/app/helm-release.yaml | 67 +++++++++++++++++ .../core/clusterissuer/app/namespace.yaml | 6 ++ .../core/traefik/app/helm-release.yaml | 40 ++++++++++ .../core/traefik/app/namespace.yaml | 6 ++ clustertool/pkg/initfiles/clusterenv.go | 3 + 8 files changed, 213 insertions(+), 1 deletion(-) create mode 100644 clustertool/embed/generic/kubernetes/core/blocky/app/helm-release.yaml create mode 100644 clustertool/embed/generic/kubernetes/core/blocky/app/namespace.yaml create mode 100644 clustertool/embed/generic/kubernetes/core/clusterissuer/app/helm-release.yaml create mode 100644 clustertool/embed/generic/kubernetes/core/clusterissuer/app/namespace.yaml create mode 100644 clustertool/embed/generic/kubernetes/core/traefik/app/helm-release.yaml create mode 100644 clustertool/embed/generic/kubernetes/core/traefik/app/namespace.yaml diff --git a/clustertool/embed/generic/base/clusterenv.yaml b/clustertool/embed/generic/base/clusterenv.yaml index 0ae57c7db55..0e28d6888a9 100644 --- a/clustertool/embed/generic/base/clusterenv.yaml +++ b/clustertool/embed/generic/base/clusterenv.yaml @@ -8,8 +8,19 @@ MASTER1IP: 192.168.20.210 GATEWAY: 192.168.20.1 # Defines the ip range metallb is allowed to use METALLB_RANGE: 192.168.20.211-192.168.20.219 +# IP Traefik will use for externally exposing ingress-resources (NOT its dashboard) +TRAEFIK_IP: 192.168.20.211 +# IP Blocky DNS will be exposed on +BLOCKY_IP: 192.168.20.212 # Sets the Kubernetes Dashboard IP. Has to be within METALLB_RANGE and not in use -DASHBOARD_IP: 192.168.20.211 +DASHBOARD_IP: 192.168.20.213 +## Configures Traefik, ClusterIssuer and Blocky for said domain, using these credentials +# domain is the base/highest level of your domain, so without subdomain, example: truecharts.org, not somesite.truecharts.org +# To disable, please see the comments in their respective helm-values.yaml files! +# When disabled, please use placeholder values instead. +DOMAIN_0: "" +DOMAIN_0_EMAIL: "" +DOMAIN_0_CLOUDFLARE_TOKEN: "" # Used to automatically generate a sshkey-pair for FluxCD # Has to start with ssh:// # Please make sure to NOT contain any special characters in the URL except "-" diff --git a/clustertool/embed/generic/kubernetes/core/blocky/app/helm-release.yaml b/clustertool/embed/generic/kubernetes/core/blocky/app/helm-release.yaml new file mode 100644 index 00000000000..28310207b38 --- /dev/null +++ b/clustertool/embed/generic/kubernetes/core/blocky/app/helm-release.yaml @@ -0,0 +1,73 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: blocky + namespace: blocky +spec: + interval: 15m + chart: + spec: + chart: blocky + version: 16.6.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + ## set stopAll to "true" if you do not want to use blocky + # and/or disable its service + global: + stopAll: false + service: + dns: + externalTrafficPolicy: Local + loadBalancerIP: ${BLOCKY_IP} + type: LoadBalancer + k8sgateway: + # -- list of processed domains + domains: + - domain: "${DOMAIN_0}" + # -- Optional configuration option for DNS01 challenge that will redirect all acme + # challenge requests to external cloud domain (e.g. managed by cert-manager) + # See: https://cert-manager.io/docs/configuration/acme/dns01/ + dnsChallenge: + enabled: false + domain: dns01.clouddns.com + + forward: + enabled: false + primary: tls://1.1.1.1 + secondary: tls://1.0.0.1 + options: + - name: tls_servername + value: cloudflare-dns.com + + # CANNOT be defined in above yaml section + queryLog: + # optional one of: mysql, postgresql, csv, csv-client. If empty, log to console only + type: "" + + configmap: + dashboard: + enabled: false + datasource: + enabled: false + + cnpg: + main: + enabled: false diff --git a/clustertool/embed/generic/kubernetes/core/blocky/app/namespace.yaml b/clustertool/embed/generic/kubernetes/core/blocky/app/namespace.yaml new file mode 100644 index 00000000000..81e0716e245 --- /dev/null +++ b/clustertool/embed/generic/kubernetes/core/blocky/app/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: blocky + labels: + topolvm.io/webhook: ignore diff --git a/clustertool/embed/generic/kubernetes/core/clusterissuer/app/helm-release.yaml b/clustertool/embed/generic/kubernetes/core/clusterissuer/app/helm-release.yaml new file mode 100644 index 00000000000..abab89a64ea --- /dev/null +++ b/clustertool/embed/generic/kubernetes/core/clusterissuer/app/helm-release.yaml @@ -0,0 +1,67 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: clusterissuer + namespace: clusterissuer +spec: + interval: 15m + chart: + spec: + chart: clusterissuer + version: 9.2.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + + clusterIssuer: + selfSigned: + enabled: true + name: "selfsigned" + ## Remove these if you do NOT want to use clusterissuer + ACME: + - name: domain-0-le-staging + # Used for both logging in to the DNS provider AND ACME registration + email: "${DOMAIN_0_EMAIL}" + server: 'https://acme-staging-v02.api.letsencrypt.org/directory' + # Options: HTTP01, cloudflare, route53, akamai, digitalocean, rfc2136, acmedns + type: "cloudflare" + # for cloudflare + cfapitoken: "${DOMAIN_0_CLOUDFLARE_TOKEN}" + - name: domain-0-le-prod + # Used for both logging in to the DNS provider AND ACME registration + email: "${DOMAIN_0_EMAIL}" + server: 'https://acme-v02.api.letsencrypt.org/directory' + # Options: HTTP01, cloudflare, route53, akamai, digitalocean, rfc2136, acmedns + type: "cloudflare" + # for cloudflare + cfapitoken: "${DOMAIN_0_CLOUDFLARE_TOKEN}" + + ## Remove these if you do NOT want to use clusterissuer + clusterCertificates: + # Namespaces in which the certificates must be available + # Accepts comma-separated regex expressions + replicationNamespaces: '.*' + certificates: + - name: domain-0-wildcard + enabled: true + certificateIssuer: tc-le-prod + hosts: + - ${DOMAIN_0} + - '*.${DOMAIN_0}' diff --git a/clustertool/embed/generic/kubernetes/core/clusterissuer/app/namespace.yaml b/clustertool/embed/generic/kubernetes/core/clusterissuer/app/namespace.yaml new file mode 100644 index 00000000000..718dcb59904 --- /dev/null +++ b/clustertool/embed/generic/kubernetes/core/clusterissuer/app/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: clusterissuer + labels: + topolvm.io/webhook: ignore diff --git a/clustertool/embed/generic/kubernetes/core/traefik/app/helm-release.yaml b/clustertool/embed/generic/kubernetes/core/traefik/app/helm-release.yaml new file mode 100644 index 00000000000..1db480ba8f1 --- /dev/null +++ b/clustertool/embed/generic/kubernetes/core/traefik/app/helm-release.yaml @@ -0,0 +1,40 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: traefik + namespace: traefik +spec: + interval: 15m + chart: + spec: + chart: traefik + version: 29.4.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + ## set stopAll to "true" if you do not want to use traefik + # and/or disable its service + global: + stopAll: false + defaultCertificate: "domain-0-wildcard" + service: + tcp: + loadBalancerIP: ${TRAEFIK_IP} diff --git a/clustertool/embed/generic/kubernetes/core/traefik/app/namespace.yaml b/clustertool/embed/generic/kubernetes/core/traefik/app/namespace.yaml new file mode 100644 index 00000000000..7a9332a24a3 --- /dev/null +++ b/clustertool/embed/generic/kubernetes/core/traefik/app/namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: traefik + labels: + topolvm.io/webhook: ignore diff --git a/clustertool/pkg/initfiles/clusterenv.go b/clustertool/pkg/initfiles/clusterenv.go index c25207193c5..f1c790c9fea 100644 --- a/clustertool/pkg/initfiles/clusterenv.go +++ b/clustertool/pkg/initfiles/clusterenv.go @@ -233,6 +233,9 @@ func CheckEnvVariables() { "METALLB_RANGE", "PODNET", "SVCNET", + "DOMAIN_0", + "DOMAIN_0_EMAIL", + "DOMAIN_0_CLOUDFLARE_TOKEN", } for _, key := range requiredKeys { if helper.TalEnv[key] == "" {