K3S-Cluster/home-cluster-ops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

move cert-manager and progresql from apps to infrastructure

Browse Source
This commit is contained in:
Edward Cheng
2024-06-26 13:00:08 +10:00
parent a8f17a910b
commit e72a6e482e
15 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
kubernetes/infrastructure/cert-manager/app/release.yaml Normal file
View File

@@ -0,0 +1,44 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 1h
driftDetection:
mode: enabled
chart:
spec:
chart: cert-manager
version: v1.15.0
sourceRef:
kind: HelmRepository
namespace: cert-manager
name: cert-manager
interval: 1h
install:
crds: Create
upgrade:
crds: CreateReplace
values:
installCRDs: true
podLabels:
rpi5.cluster.policy/egress-kubeapi: "true"
rpi5.cluster.policy/egress-namespace: "true"
rpi5.cluster.policy/egress-world: "true"
rpi5.cluster.policy/ingress-namespace: "true"
webhook:
podLabels:
rpi5.cluster.policy/egress-kubeapi: "true"
cainjector:
podLabels:
rpi5.cluster.policy/egress-kubeapi: "true"
global:
priorityClassName: system-cluster-critical
podDnsConfig:
nameservers:
- 1.1.1.1
- 1.0.0.1

8
kubernetes/infrastructure/cert-manager/app/repository.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 1h
url: https://charts.jetstack.io

125
kubernetes/infrastructure/cert-manager/cert-manager.yaml Normal file
View File

@@ -0,0 +1,125 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
targetNamespace: cert-manager
path: ./kubernetes/infrastructure/cert-manager/app
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: flux-system
dependsOn:
- name: namespaces
namespace: flux-system
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: clusterissuer-secrets
namespace: flux-system
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
targetNamespace: cert-manager
path: ./clusterissuer
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops-secrets
dependsOn:
- name: namespaces
namespace: flux-system
- name: repositories
namespace: flux-system
decryption:
provider: sops
secretRef:
name: sops-age
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: clusterissuer
namespace: cert-manager
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
targetNamespace: cert-manager
path: ./kubernetes/infrastructure/cert-manager/clusterissuer
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: flux-system
dependsOn:
- name: clusterissuer-secrets
namespace: flux-system
- name: cert-manager
namespace: cert-manager
postBuild:
substituteFrom:
- kind: Secret
name: clusterissuer-secrets
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: certificate-secrets
namespace: flux-system
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
targetNamespace: cert-manager
path: ./certificates
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops-secrets
dependsOn:
- name: namespaces
namespace: flux-system
- name: repositories
namespace: flux-system
decryption:
provider: sops
secretRef:
name: sops-age
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: certificates
namespace: cert-manager
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
targetNamespace: cert-manager
path: ./kubernetes/infrastructure/cert-manager/certificates
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: flux-system
dependsOn:
- name: certificate-secrets
namespace: flux-system
- name: cert-manager
namespace: cert-manager
- name: clusterissuer
namespace: cert-manager
postBuild:
substituteFrom:
- kind: Secret
name: certificate-secrets

64
kubernetes/infrastructure/cert-manager/certificates/adguard-home.yaml Normal file
View File

@@ -0,0 +1,64 @@
#apiVersion: cert-manager.io/v1
#kind: Certificate
#metadata:
# name: adguard-home-cert
# namespace: cert-manager
#spec:
# # Secret names are always required.
# secretName: adguard-home.cluster.edward.sydney-tls
#
# privateKey:
# algorithm: RSA
# encoding: PKCS1
# size: 2048
#
# # keystores allows adding additional output formats. This is an example for reference only.
# keystores:
# pkcs12:
# create: true
# passwordSecretRef:
# name: adguard-home-tls-keystore
# key: ${adguard_home_certificate_tls_keystore_password}
# profile: Modern2023
#
# duration: 2160h # 90d
# renewBefore: 360h # 15d
#
# isCA: false
# usages:
# - server auth
# - client auth
#
# subject:
# organizations:
# - edward.sydney
#
# # The literalSubject field is exclusive with subject and commonName. It allows
# # specifying the subject directly as a string. This is useful for when the order
# # of the subject fields is important or when the subject contains special types
# # which can be specified by their OID.
# #
# # literalSubject: "O=jetstack, CN=example.com, 2.5.4.42=John, 2.5.4.4=Doe"
#
# # At least one of commonName (possibly through literalSubject), dnsNames, uris, emailAddresses, ipAddresses or otherNames is required.
# dnsNames:
# - "${adguard_home_certificate_dns_name}"
# - "*.${adguard_home_certificate_dns_name}"
# emailAddresses:
# - ${adguard_home_certificate_email}
#
# # Issuer references are always required.
# issuerRef:
# name: clusterissuer
# # We can reference ClusterIssuers by changing the kind here.
# # The default value is Issuer (i.e. a locally namespaced Issuer)
# kind: ClusterIssuer
# # This is optional since cert-manager will default to this value however
# # if you are using an external issuer, change this to that issuer group.
# group: cert-manager.io
#The certificate request has failed to complete and will be retried:
# Failed to wait for order resource "adguard-home-cert-1-1931876784" to become
# ready: order is in "errored" state: Failed to create Order: 429 urn:ietf:params:acme:error:rateLimited:
# Error creating new order :: too many certificates already issued for "edward.sydney".
# Retry after 2024-06-25T21:00:00Z: see https://letsencrypt.org/docs/rate-limits/

22
kubernetes/infrastructure/cert-manager/clusterissuer/clusterissuer-cloudflare.yaml Normal file
View File

@@ -0,0 +1,22 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: clusterissuer
namespace: cert-manager
spec:
acme:
email: ${email}
server: https://acme-v02.api.letsencrypt.org/directory
privateKeySecretRef:
name: cluster-issuer-account-key
solvers:
- dns01:
cloudflare:
email: ${email}
apiTokenSecretRef:
name: clusterissuer-secrets
key: cloudflare_api_token
selector:
dnsNames:
- "${cluster_cert_domain}"
- "*.${cluster_cert_domain}"

2
kubernetes/infrastructure/kustomization.yaml
View File

@@ -1,9 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./cert-manager/cert-manager.yaml
# - ./cilium/cilium.yaml
- ./minio/minio.yaml
- ./ingress-nginx/ingress-nginx.yaml
- ./ingress-nginx/ingress-nginx-config.yaml
- ./namespaces/namespaces.yaml
- ./postgresql/postgresql.yaml
- ./repositories/repositories.yaml

31
kubernetes/infrastructure/postgresql/app/ingress.yaml Normal file
View File

@@ -0,0 +1,31 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: postgresql-ingress
namespace: postgresql
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/use-regex: "true"
spec:
ingressClassName: nginx
rules:
- host: "postgres.cluster.local"
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: postgresql-primary
port:
number: 5432
- host: "replica.postgres.cluster.local"
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: postgresql-replica
port:
number: 5432

93
kubernetes/infrastructure/postgresql/app/pvc.yaml Normal file
View File

@@ -0,0 +1,93 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: postgresql-primary-pv
namespace: postgresql
labels:
type: local
spec:
storageClassName: local-path
volumeMode: Filesystem
capacity:
storage: 8Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
local:
path: "/mnt/nfs/AppData/postgresql/primary"
claimRef:
apiVersion: v1
kind: PersistentVolumeClaim
name: postgresql-primary-pvc
namespace: postgresql
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- rpi5-cluster-node-3
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgresql-primary-pvc
namespace: postgresql
labels:
name: postgresql-primary-pvc
spec:
storageClassName: local-path
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: postgresql-replica-pv
namespace: flux-system
labels:
type: local
spec:
storageClassName: local-path
volumeMode: Filesystem
capacity:
storage: 8Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
local:
path: "/mnt/nfs/AppData/postgresql/replica"
claimRef:
apiVersion: v1
kind: PersistentVolumeClaim
name: postgresql-replica-pvc
namespace: postgresql
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- rpi5-cluster-node-3
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgresql-replica-pvc
namespace: postgresql
labels:
name: postgresql-replica-pvc
spec:
storageClassName: local-path
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 8Gi

57
kubernetes/infrastructure/postgresql/app/release.yaml Normal file
View File

@@ -0,0 +1,57 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: postgresql
namespace: postgresql
spec:
releaseName: postgresql
chart:
spec:
chart: postgresql
sourceRef:
kind: HelmRepository
name: bitnami
namespace: flux-system
interval: 1h
install:
remediation:
retries: 3
values:
auth:
postgresPassword: ${postgres_password}
username: ${username}
password: ${password}
database: ${database}
replicationPassword: ${replication_password}
architecture: "replication"
replication:
synchronousCommit: "on"
numSynchronousReplicas: 1
applicationName: "postgres_repl"
primary:
podSecurityContext:
fsGroup: 1000
containerSecurityContext:
runAsUser: 1000
runAsGroup: 1000
podLabels:
name: "postgresql-primary"
persistence:
existingClaim: postgresql-primary-pvc
selector:
matchLabels:
name: postgresql-primary-pvc
readReplicas:
name: "replica"
podSecurityContext:
fsGroup: 1000
containerSecurityContext:
runAsUser: 1000
runAsGroup: 1000
podLabels:
name: "postgresql-replica"
persistence:
existingClaim: postgresql-replica-pvc
selector:
matchLabels:
name: postgresql-replica-pvc

49
kubernetes/infrastructure/postgresql/postgresql.yaml Normal file
View File

@@ -0,0 +1,49 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: postgresql-secrets
namespace: flux-system
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
targetNamespace: postgresql
path: ./postgresql
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: home-cluster-ops-secrets
dependsOn:
- name: namespaces
namespace: flux-system
- name: repositories
namespace: flux-system
decryption:
provider: sops
secretRef:
name: sops-age
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: postgresql
namespace: postgresql
spec:
interval: 10m
timeout: 1m30s
retryInterval: 30s
path: ./kubernetes/infrastructure/postgresql/app
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: flux-system
dependsOn:
- name: postgresql-secrets
namespace: flux-system
postBuild:
substituteFrom:
- kind: Secret
name: postgresql-secrets

10
kubernetes/infrastructure/postgresql/scripts/ingress-nginx-svc-controller-patch.yaml Normal file
View File

@@ -0,0 +1,10 @@
spec:
ports:
- name: postgresql-tcp
port: 5432
targetPort: 5432
protocol: TCP
- name: postgresql-repl--tcp
port: 5433
targetPort: 5433
protocol: TCP

4
kubernetes/infrastructure/postgresql/scripts/patch-ingress-nginx.sh Normal file
View File

@@ -0,0 +1,4 @@
#!/bin/bash
set -e
kubectl patch service ingress-nginx-controller -n ingress-nginx --patch "$(cat ingress-nginx-svc-controller-patch.yaml)"

47
kubernetes/infrastructure/prometheus-operator/app/release.yaml Normal file
View File

@@ -0,0 +1,47 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: prometheus-operator
namespace: prometheus-operator
spec:
releaseName: prometheus-operator
chart:
spec:
chart: prometheus-operator
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
remediation:
retries: 3
values:
service:
main:
enabled: true
ports:
main:
enabled: true
workload:
main:
enabled: true
portal:
open:
enabled: true
operator:
register: true
kps:
## Install Prometheus Operator CRDs
##
crds:
enabled: true
## Manages Prometheus and Alertmanager components
##
prometheusOperator:
enabled: true

15
kubernetes/infrastructure/prometheus-operator/prometheus-operator.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: prometheus-operator
namespace: prometheus-operator
spec:
suspend: true
interval: 1h
targetNamespace: flux-system
path: ./kubernetes/apps/prometheus-operator/app
prune: true
sourceRef:
kind: GitRepository
namespace: flux-system
name: flux-system