Compare commits

...

29 commits

Author SHA1 Message Date
6772b45a8e Update Helm release thanos to v15 2024-04-04 09:04:14 +00:00
843d6de4e9
Add repo for bitnami replacement. 2024-04-03 23:39:32 -05:00
2ae8701eee
Remove option 2024-04-03 23:39:09 -05:00
aabd4425c9
Switch to the new le ca chain 2024-04-03 23:38:59 -05:00
37d5df0168
Upgrade back to v1.14.4 2024-04-03 23:38:34 -05:00
299a68f779 Merge pull request 'Update Rook Ceph group to v1.13.8 (patch)' (#178) from renovate/patch-rook-ceph into main
Reviewed-on: jahanson/homelab#178
2024-04-03 22:01:29 +00:00
cb1141650b
Add missing service. 2024-04-03 16:48:06 -05:00
572c7d4f95
Update service. 2024-04-03 16:41:31 -05:00
045e0d829e
Update service 2024-04-03 16:40:59 -05:00
ebcafac524
Changing to zerossl. 2024-04-03 16:18:51 -05:00
b053ac8b31
Fix api-token. 2024-04-03 16:14:29 -05:00
ac455705dc
Include ZeroSSL. 2024-04-03 16:12:14 -05:00
7498c9558c
Trying ZeroSSL 2024-04-03 16:11:13 -05:00
8fd54389d0 Update Rook Ceph group to v1.13.8 2024-04-03 21:02:46 +00:00
697a901288
Revert to 1.14.2 2024-04-03 15:40:55 -05:00
07add3bf95
Revert sa back to 'cert-manager' 2024-04-03 14:06:50 -05:00
b955622a22
Update cert and issuer. 2024-04-03 13:53:41 -05:00
2c87c6553a
Add dnsimple issuer. 2024-04-03 13:51:36 -05:00
eeceaa6718
Namespaces. 2024-04-03 13:31:42 -05:00
19bf0be280
And attach sa to hr. 2024-04-03 13:01:07 -05:00
ac69955b93
Duplicate. 2024-04-03 12:54:07 -05:00
5233986f6a
Fair. 2024-04-03 12:51:26 -05:00
ebb42b2820
And more rbac. 2024-04-03 12:47:50 -05:00
c5c196f3ee
Include extra RBAC. 2024-04-03 12:38:35 -05:00
8b39dc81fc
Adding DNSimple cert-manager dns01 webhook. 2024-04-03 12:29:01 -05:00
dde047a6e2 Merge pull request 'Update Helm release reloader to v1.0.74' (#176) from renovate/reloader-1.x into main
Reviewed-on: jahanson/homelab#176
2024-04-03 13:08:41 +00:00
a45a4dd6d1 Merge pull request 'Update docker.dragonflydb.io/dragonflydb/operator Docker tag to v1.1.2' (#177) from renovate/docker.dragonflydb.io-dragonflydb-operator-1.x into main
Reviewed-on: jahanson/homelab#177
2024-04-03 13:00:35 +00:00
ed3f544140 Update Helm release reloader to v1.0.74 2024-04-03 12:02:06 +00:00
ee892c9979 Update docker.dragonflydb.io/dragonflydb/operator Docker tag to v1.1.2 2024-04-03 10:02:56 +00:00
20 changed files with 376 additions and 30 deletions

View file

@ -1,22 +0,0 @@
---
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/clusterissuer_v1.json
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: le-cf-prod-jahanson-tech
spec:
acme:
email: "joe@veri.dev"
preferredChain: ""
privateKeySecretRef:
name: letsencrypt-cloudflare-production
server: https://acme-v02.api.letsencrypt.org/directory
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cloudflare-api-token
key: jahanson-tech-api-token
selector:
dnsZones:
- jahanson.tech

View file

@ -7,10 +7,10 @@ metadata:
spec:
acme:
email: "joe@veri.dev"
preferredChain: ""
privateKeySecretRef:
name: letsencrypt-cloudflare-production
server: https://acme-v02.api.letsencrypt.org/directory
preferredChain: "ISRG Root X1"
solvers:
- dns01:
cloudflare:

View file

@ -0,0 +1,32 @@
---
# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: zerossl-secret
namespace: cert-manager
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: zerossl-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
api-token: "{{ .dnsimple_cert_manager_api_token }}"
eab-hmac-key: "{{ .zerossl_eab_hmac_key }}"
dataFrom:
- extract:
key: DNSimple
rewrite:
- regexp:
source: "(.*)"
target: "dnsimple_$1"
- extract:
key: ZeroSSL
rewrite:
- regexp:
source: "(.*)"
target: "zerossl_$1"

View file

@ -0,0 +1,30 @@
---
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/clusterissuer_v1.json
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: issuer-zerossl-prod
spec:
acme:
server: https://acme.zerossl.com/v2/DV90
email: "joe@veri.dev"
privateKeySecretRef:
name: zerossl-production
externalAccountBinding:
keyID: feJODDijN9gypthMXaHtVA
keySecretRef:
name: zerossl-secret
key: eab-hmac-key
keyAlgorithm: HS256
solvers:
- dns01:
webhook:
groupName: acme.hsn.dev
solverName: dnsimple
config:
apiKeySecretRef:
name: zerossl-secret
key: api-token
selector:
dnsZones:
- jahanson.tech

View file

@ -6,5 +6,6 @@ namespace: cert-manager
resources:
- ./cloudflare/externalsecret.yaml
- ./cloudflare/issuer-letsencrypt-prod.yaml
- ./cloudflare/issuer-letsencrypt-prod-jahanson-tech.yaml
- ./cloudflare/issuer-letsencrypt-staging.yaml
- ./dnsimple/externalsecret.yaml
- ./dnsimple/issuer-zerossl-prod.yaml

View file

@ -7,3 +7,4 @@ resources:
- ./namespace.yaml
# Flux-Kustomizations
- ./cert-manager/ks.yaml
- ./webhook-dnsimple/ks.yaml

View file

@ -0,0 +1,16 @@
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
name: v1alpha1.acme.hsn.dev
labels:
app: cert-manager-webhook-dnsimple
annotations:
cert-manager.io/inject-ca-from: "cert-manager/webhook-dnsimple-webhook-tls"
spec:
group: acme.hsn.dev
groupPriorityMinimum: 1000
versionPriority: 15
service:
name: webhook-dnsimple
namespace: cert-manager
version: v1alpha1

View file

@ -0,0 +1,70 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2beta2
kind: HelmRelease
metadata:
name: webhook-dnsimple
spec:
chart:
spec:
chart: app-template
version: 3.0.4
interval: 30m
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
interval: 30m
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
strategy: rollback
values:
controllers:
webhook-dnsimple:
strategy: RollingUpdate
annotations:
reloader.stakater.com/auto: "true"
containers:
app:
image:
repository: git.hsn.dev/jahanson/cert-manager-webhook-dnsimple
tag: v0.0.1
args:
- --secure-port=8443
- --tls-cert-file=/tls/tls.crt
- --tls-private-key-file=/tls/tls.key
env:
- name: GROUP_NAME
value: "acme.hsn.dev"
resources:
requests:
cpu: 23m
memory: 249M
probes:
liveness:
enabled: true
readiness:
enabled: true
service:
app:
controller: webhook-dnsimple
ports:
https:
port: 443
targetPort: 8443
protocol: TCP
persistence:
certs:
type: secret
name: webhook-dnsimple-webhook-tls
globalMounts:
- path: /tls
readOnly: true
serviceAccount:
create: true
name: webhook-dnsimple

View file

@ -0,0 +1,9 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./apiservice.yaml
- ./helmrelease.yaml
- ./pki.yaml
- ./rbac.yaml

View file

@ -0,0 +1,62 @@
---
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
# Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: webhook-dnsimple-selfsign
namespace: "cert-manager"
labels:
app: cert-manager-webhook-dnsimple
spec:
selfSigned: {}
---
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: webhook-dnsimple-ca
namespace: "cert-manager"
labels:
app: cert-manager-webhook-dnsimple
spec:
ca:
secretName: webhook-dnsimple-ca
---
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: webhook-dnsimple-ca
namespace: "cert-manager"
labels:
app: cert-manager-webhook-dnsimple
spec:
secretName: webhook-dnsimple-ca
duration: 43800h # 5y
issuerRef:
name: webhook-dnsimple-selfsign
commonName: "ca.dnsimple-webhook.cert-manager"
isCA: true
---
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
# Finally, generate a serving certificate for the webhook to use
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: webhook-dnsimple-webhook-tls
namespace: "cert-manager"
labels:
app: cert-manager-webhook-dnsimple
spec:
secretName: webhook-dnsimple-webhook-tls
duration: 8760h # 1y
issuerRef:
name: webhook-dnsimple-ca
dnsNames:
- webhook-dnsimple
- webhook-dnsimple.cert-manager
- webhook-dnsimple.cert-manager.svc

View file

@ -0,0 +1,119 @@
---
# Grant cert-manager permission to validate using our apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: webhook-dnsimple:domain-solver
labels:
app: cert-manager-webhook-dnsimple
rules:
- apiGroups:
- acme.hsn.dev
resources:
- '*'
verbs:
- 'create'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: flow-schema-reader
labels:
app: cert-manager-webhook-dnsimple
rules:
- apiGroups: ["flowcontrol.apiserver.k8s.io"]
resources: ["flowschemas", "prioritylevelconfigurations"]
verbs: ["list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: grant-flow-schema-permission
labels:
app: cert-manager-webhook-dnsimple
subjects:
- kind: ServiceAccount
name: webhook-dnsimple
namespace: cert-manager
roleRef:
kind: ClusterRole
name: flow-schema-reader
apiGroup: rbac.authorization.k8s.io
---
# apiserver gets the auth-delegator role to delegate auth decisions to the core apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: webhook-dnsimple:auth-delegator
labels:
app: cert-manager-webhook-dnsimple
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- apiGroup: ""
kind: ServiceAccount
name: webhook-dnsimple
namespace: cert-manager
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: webhook-dnsimple:domain-solver
labels:
app: cert-manager-webhook-dnsimple
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: webhook-dnsimple:domain-solver
subjects:
- apiGroup: ""
kind: ServiceAccount
name: cert-manager
namespace: cert-manager
---
# Grant the webhook permission to read the api-token Secret in the specified namespace.
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: "cert-manager"
name: webhook-dnsimple:access-secret
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "watch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: webhook-dnsimple:access-secret
namespace: "cert-manager"
subjects:
- kind: ServiceAccount
name: webhook-dnsimple
namespace: "cert-manager"
roleRef:
kind: Role
name: webhook-dnsimple:access-secret
apiGroup: rbac.authorization.k8s.io
---
# Grant the webhook permission to read the ConfigMap containing the Kubernetes
# apiserver's requestheader-ca-certificate.
# This ConfigMap is automatically created by the Kubernetes apiserver.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: webhook-dnsimple:webhook-authentication-reader
namespace: kube-system
labels:
app: cert-manager-webhook-dnsimple
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: extension-apiserver-authentication-reader
subjects:
- apiGroup: ""
kind: ServiceAccount
name: webhook-dnsimple
namespace: cert-manager

View file

@ -0,0 +1,16 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cert-manager-webhook-dnsimple
namespace: flux-system
spec:
targetNamespace: cert-manager
interval: 10m
path: "./kubernetes/apps/cert-manager/webhook-dnsimple/app"
prune: true
sourceRef:
kind: GitRepository
name: homelab
wait: true

View file

@ -52,7 +52,7 @@ spec:
app:
image:
repository: docker.dragonflydb.io/dragonflydb/operator
tag: v1.1.1
tag: v1.1.2
args:
- "--health-probe-bind-address=:8081"
- "--metrics-bind-address=127.0.0.1:8080"

View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: reloader
version: 1.0.72
version: 1.0.74
sourceRef:
kind: HelmRepository
name: stakater

View file

@ -8,7 +8,7 @@ metadata:
spec:
secretName: "jahanson-tech-tls"
issuerRef:
name: le-cf-prod-jahanson-tech
name: issuer-zerossl-prod
kind: ClusterIssuer
commonName: "jahanson.tech"
dnsNames:

View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: thanos
version: 14.0.2
version: 15.0.0
sourceRef:
kind: HelmRepository
name: bitnami

View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: rook-ceph
version: v1.13.7
version: v1.13.8
sourceRef:
kind: HelmRepository
name: rook-ceph

View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: rook-ceph-cluster
version: v1.13.7
version: v1.13.8
sourceRef:
kind: HelmRepository
name: rook-ceph

View file

@ -33,4 +33,5 @@ resources:
- prometheus-community.yaml
- rook-ceph.yaml
- stakater.yaml
- stevehipwell.yaml
- xenitab.yaml

View file

@ -0,0 +1,11 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1beta2.json
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: stevehipwell
namespace: flux-system
spec:
type: oci
interval: 5m
url: oci://ghcr.io/stevehipwell/helm-charts