jahanson/valinor
Archived
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'main' into renovate/ansible-lint-6.x

Browse source
This commit is contained in:
Joseph Hanson 2023-10-02 19:57:05 +00:00
commit e4cb6a78e4
19 changed files with 233 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml
View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: cert-manager
version: v1.12.3
version: v1.13.1
sourceRef:
kind: HelmRepository
name: jetstack

3
kubernetes/apps/cert-manager/cert-manager/issuers/helmrelease.yaml
View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: cert-manager-webhook-dnsimple
version: 0.0.7
version: 0.0.8
interval: 30m
sourceRef:
kind: HelmRepository
@ -33,3 +33,4 @@ spec:
secretKeyRef:
name: dnsimple-api-token
key: letsencrypt-email
containerPort: 8443

60
kubernetes/apps/kube-system/cilium/app/helmrelease.yaml Normal file
View file

@ -0,0 +1,60 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: cilium
version: 1.14.2
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
maxHistory: 2
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
cluster:
name: valinor
id: 1
ipam:
mode: kubernetes
kubeProxyReplacement: true
securityContext:
capabilities:
ciliumAgent:
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
cleanCiliumState:
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
cgroup:
autoMount:
enabled: false
hostRoot: /sys/fs/cgroup
# Talos Kubeprism
k8sServiceHost: localhost
k8sServicePort: 7445
rollOutCiliumPods: true

17
kubernetes/apps/kube-system/cilium/ks.yaml Normal file
View file

@ -0,0 +1,17 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-cilium
namespace: flux-system
spec:
interval: 30m
retryInterval: 1m
timeout: 5m
path: "./kubernetes/apps/kube-system/cilium/app"
prune: true
sourceRef:
kind: GitRepository
name: valinor
wait: false

22
kubernetes/apps/kube-system/hccm/app/externalsecret.yaml Normal file
View file

@ -0,0 +1,22 @@
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: hcloud
namespace: kube-system
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: hcloud
creationPolicy: Owner
data:
- secretKey: token
remoteRef:
key: hetzner
property: cloud-api-token
- secretKey: network
remoteRef:
key: hetzner
property: cloud-network-name

24
kubernetes/apps/kube-system/hccm/app/helmrelease.yaml Normal file
View file

@ -0,0 +1,24 @@
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: hccm
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: hcloud-cloud-controller-manager
version: v1.18.0
sourceRef:
kind: HelmRepository
name: hetzner
namespace: flux-system
interval: 30m
values:
metrics:
enabled: true
networking:
enabled: true
clusterCIDR: 10.244.0.0/16

8
kubernetes/apps/kube-system/hccm/app/kustomization.yaml Normal file
View file

@ -0,0 +1,8 @@
# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kube-system
resources:
- ./externalsecret.yaml
- ./helmrelease.yaml

16
kubernetes/apps/kube-system/hccm/ks.yaml Normal file
View file

@ -0,0 +1,16 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cluster-apps-hetzner-hccm
namespace: flux-system
labels:
substitution.flux.home.arpa/enabled: "true"
spec:
interval: 10m
path: "./kubernetes/apps/kube-system/hccm/app"
prune: true
sourceRef:
kind: GitRepository
name: valinor
wait: true

2
kubernetes/apps/kube-system/kustomization.yaml
View file

@ -1,3 +1,4 @@
# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
@ -6,3 +7,4 @@ resources:
- ./namespace.yaml
# Flux-Kustomizations
- ./metrics-server/ks.yaml
- ./hccm/ks.yaml

5
kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
View file

@ -18,3 +18,8 @@ spec:
values:
metrics:
enabled: true
args:
- --kubelet-insecure-tls
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s

1
kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml
View file

@ -1,3 +1,4 @@
# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

2
kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml
View file

@ -201,7 +201,7 @@ spec:
enableAdminAPI: true
walCompression: true
thanos:
image: quay.io/thanos/thanos:v0.32.3
image: quay.io/thanos/thanos:v0.32.4
objectStorageConfig:
name: thanos-s3-secret
key: objstore.yml

2
kubernetes/apps/monitoring/node-exporter/app/helmrelease.yaml
View file

@ -10,7 +10,7 @@ spec:
chart:
spec:
chart: prometheus-node-exporter
version: 4.23.1
version: 4.23.2
sourceRef:
kind: HelmRepository
name: prometheus-community

4
kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
View file

@ -11,7 +11,7 @@ spec:
chart:
spec:
chart: thanos
version: 12.13.5
version: 12.13.6
sourceRef:
kind: HelmRepository
name: bitnami
@ -34,7 +34,7 @@ spec:
image:
registry: quay.io
repository: thanos/thanos
tag: v0.32.3
tag: v0.32.4
existingObjstoreSecret: thanos-s3-secret
queryFrontend:
enabled: true

18
kubernetes/apps/network/ingress-nginx/app/helmrelease.yaml
View file

@ -18,11 +18,11 @@ spec:
controller:
replicaCount: 3
hostPort:
enabled: true
ports:
http: 81
https: 444
# hostPort:
# enabled: true
# ports:
# http: 81
# https: 444
updateStrategy:
type: Recreate
@ -31,8 +31,12 @@ spec:
enabled: true
type: LoadBalancer
annotations:
external-dns.alpha.kubernetes.io/hostname: "ingress.valinor.social"
io.cilium/lb-ipam-ips: "10.2.42.1"
load-balancer.hetzner.cloud/location: fsn1
load-balancer.hetzner.cloud/protocol: tcp
load-balancer.hetzner.cloud/name: valinor-nginx
load-balancer.hetzner.cloud/use-private-ip: true
load-balancer.hetzner.cloud/uses-proxyprotocol: true
externalTrafficPolicy: Local
publishService:

10
kubernetes/flux/repositories/helm/hetzner.yaml Normal file
View file

@ -0,0 +1,10 @@
---
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
name: hetzner
namespace: flux-system
spec:
interval: 30m
url: https://charts.hetzner.cloud
timeout: 3m

2
kubernetes/flux/repositories/helm/kustomization.yaml
View file

@ -1,3 +1,4 @@
# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
@ -12,6 +13,7 @@ resources:
- external-secrets.yaml
- fairwinds.yaml
- grafana.yaml
- hetzner.yaml
- ingress-nginx.yaml
- jahanson.yaml
- jetstack.yaml

3
talos/clusterconfig/.gitignore vendored
View file

@ -2,3 +2,6 @@ valinor-aule.hsn.dev.yaml
valinor-eonwe.hsn.dev.yaml
valinor-arlen.hsn.dev.yaml
talosconfig
valinor-vaire.hsn.dev.yaml
valinor-nienna.hsn.dev.yaml
valinor-orome.hsn.dev.yaml

45
talos/talconfig.yaml
View file

@ -63,6 +63,51 @@ nodes:
- network: 10.2.0.0/16
gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
metric: 2048
- hostname: vaire.hsn.dev
disableSearchDomain: true
ipAddress: 10.2.0.8
controlPlane: false
installDiskSelector:
busPath: /dev/sda
networkInterfaces:
- interface: eth0
dhcp: true
- interface: eth1
dhcp: true
routes:
- network: 10.2.0.0/16
gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
metric: 2048
- hostname: nienna.hsn.dev
disableSearchDomain: true
ipAddress: 10.2.0.9
controlPlane: false
installDiskSelector:
busPath: /dev/sda
networkInterfaces:
- interface: eth0
dhcp: true
- interface: eth1
dhcp: true
routes:
- network: 10.2.0.0/16
gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
metric: 2048
- hostname: orome.hsn.dev
disableSearchDomain: true
ipAddress: 10.2.0.10
controlPlane: false
installDiskSelector:
busPath: /dev/sda
networkInterfaces:
- interface: eth0
dhcp: true
- interface: eth1
dhcp: true
routes:
- network: 10.2.0.0/16
gateway: 10.2.1.1 # The route's gateway (if empty, creates link scope route).
metric: 2048
controlPlane:
patches: