chore: initial commit 🚀
E2E / reject-invalid (bad-vlan-tag) (push) Skipped
E2E / reject-invalid (missing-schematic) (push) Skipped
E2E / reject-invalid (nested-cidr-overlap) (push) Skipped
E2E / reject-invalid (node-uses-gateway-addr) (push) Skipped
E2E / reject-invalid (overlapping-cidrs) (push) Skipped
E2E / reject-invalid (partial-bgp) (push) Skipped
E2E / reject-invalid (reserved-node-name) (push) Skipped
E2E / reject-invalid (bad-bgp-asn) (push) Skipped
E2E / reject-invalid (bad-mac-address) (push) Skipped
E2E / reject-invalid (bad-repo-url) (push) Skipped
E2E / reject-invalid (duplicate-gateway-addrs) (push) Skipped
E2E / reject-invalid (duplicate-node-names) (push) Skipped
E2E / reject-invalid (gateway-node-collision) (push) Skipped
E2E / reject-invalid (missing-dns-token) (push) Skipped
E2E / reject-invalid (missing-external-gateway) (push) Skipped
E2E / reject-invalid (missing-known-hosts) (push) Skipped
E2E / reject-invalid (node-addr-outside-cidr) (push) Skipped
E2E / reject-invalid (non-canonical-cidr) (push) Skipped
E2E / reject-invalid (tiny-svc-cidr) (push) Skipped
E2E / reject-invalid (tunnel-without-dns) (push) Skipped
E2E / accept-valid (internal) (push) Skipped
E2E / accept-valid (multi-controller) (push) Skipped
E2E / validator-tests (push) Skipped
E2E / accept-valid (no-webhook) (push) Skipped
E2E / accept-valid (private) (push) Skipped
E2E / accept-valid (public) (push) Skipped
E2E / accept-valid (single-node) (push) Skipped
E2E / accept-valid (direct) (push) Skipped
E2E / accept-valid (selfhosted) (push) Skipped
E2E / reject-invalid (bad-vlan-tag) (push) Skipped
E2E / reject-invalid (missing-schematic) (push) Skipped
E2E / reject-invalid (nested-cidr-overlap) (push) Skipped
E2E / reject-invalid (node-uses-gateway-addr) (push) Skipped
E2E / reject-invalid (overlapping-cidrs) (push) Skipped
E2E / reject-invalid (partial-bgp) (push) Skipped
E2E / reject-invalid (reserved-node-name) (push) Skipped
E2E / reject-invalid (bad-bgp-asn) (push) Skipped
E2E / reject-invalid (bad-mac-address) (push) Skipped
E2E / reject-invalid (bad-repo-url) (push) Skipped
E2E / reject-invalid (duplicate-gateway-addrs) (push) Skipped
E2E / reject-invalid (duplicate-node-names) (push) Skipped
E2E / reject-invalid (gateway-node-collision) (push) Skipped
E2E / reject-invalid (missing-dns-token) (push) Skipped
E2E / reject-invalid (missing-external-gateway) (push) Skipped
E2E / reject-invalid (missing-known-hosts) (push) Skipped
E2E / reject-invalid (node-addr-outside-cidr) (push) Skipped
E2E / reject-invalid (non-canonical-cidr) (push) Skipped
E2E / reject-invalid (tiny-svc-cidr) (push) Skipped
E2E / reject-invalid (tunnel-without-dns) (push) Skipped
E2E / accept-valid (internal) (push) Skipped
E2E / accept-valid (multi-controller) (push) Skipped
E2E / validator-tests (push) Skipped
E2E / accept-valid (no-webhook) (push) Skipped
E2E / accept-valid (private) (push) Skipped
E2E / accept-valid (public) (push) Skipped
E2E / accept-valid (single-node) (push) Skipped
E2E / accept-valid (direct) (push) Skipped
E2E / accept-valid (selfhosted) (push) Skipped
This commit is contained in:
@@ -481,6 +481,7 @@ url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-aar
|
|||||||
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597"
|
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322597"
|
||||||
|
|
||||||
[tools.taplo."platforms.linux-x64"]
|
[tools.taplo."platforms.linux-x64"]
|
||||||
|
checksum = "blake3:4871fab0e60275a1eb46e7190726e144f56c9a9527f59b0d1da5a042baead8e2"
|
||||||
url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
|
url = "https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gz"
|
||||||
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"
|
url_api = "https://api.github.com/repos/tamasfe/taplo/releases/assets/257322600"
|
||||||
|
|
||||||
|
|||||||
+12
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
creation_rules:
|
||||||
|
- path_regex: talos/.*\.sops\.ya?ml
|
||||||
|
mac_only_encrypted: true
|
||||||
|
age: "age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6"
|
||||||
|
- path_regex: (bootstrap|kubernetes)/.*\.sops\.ya?ml
|
||||||
|
encrypted_regex: "^(data|stringData)$"
|
||||||
|
mac_only_encrypted: true
|
||||||
|
age: "age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6"
|
||||||
|
stores:
|
||||||
|
yaml:
|
||||||
|
indent: 2
|
||||||
@@ -0,0 +1,55 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: deploy-key
|
||||||
|
namespace: flux-system
|
||||||
|
stringData:
|
||||||
|
identity: ENC[AES256_GCM,data:8w3RUSbeP0Pnu0YrQXcAkoe49MsEk2kWyHAJ03j9n5MCFAP7BvHeFmAzrqit5dWO3GTdl8lTpkVfANhq4yXn/zVa8XMUf1k/8fBJSyN41ZvyQ/Kop0pnJpb9VJsUMHuA8fDhqDRp/cNtc10iLEoTa3I13mMsAnImibTWGX8OCskHCvSLvhkEmakt1A28DT9NpEYSrf0OfKqbRio29azjsxdfDKRyRUwhRUoYNgic4FGIKYDGKyoMmRGIfLTCV3kntD9Sy/Jc7DV+hpYFVvvsfYuMkcCDFSOfltAnCi93VjBYniY5NqRN00aAgYZmAHeORdIH251Ck6S+krfxQ3lQVnd38Esy/7nzKtLYXY6z5xB/pVTWzQNOz2rYwpkfZLxQzRhIo8SOUpBNCleA6VnA1q30IVogKZU1czDT2tbSL16c35409XjsqfUGPn5h7vGdYCJSqClftqp5RTzd2tdjfoYybLDhQo6PvOPY8ADHBTpfa3kGMOXxiSRcgdQiQIXQtPoRBvxKnJskeEqdfmKd,iv:+BRQJbSoHOt6Wysjv2nW2Me38uAdG66nu0Ov+xTSSTg=,tag:EN4U8gAdqXg0GzrEPUITYA==,type:str]
|
||||||
|
known_hosts: ENC[AES256_GCM,data:PA8ph6GG2A5NwwUwckxfKYyv58mme0CsYmv1i7jgGzIVDqBxmrN8SdDTm4I2xasBmmGzpjir63W9NpLVpmQ6qjzmor/KwP9CpYQO/cDKvHyzkIX4dSeb5orWmDvUuYLmzwV/R2v/HA5BB4IVSVwguwKt8Z36G8y669LK6mfkbxoVwCH0Z6iTUjPC2TDslfRyQNOAucRfPeagZS7sHAuqT+AP4WYW1EHeHvrvx0xAxabX4kAoRx+h5mcx43Rzpcf+TE3vFaBS1Ttr/zUFmVX5xq1wl9v4u4qYge2zpDTohnvtvAg8dQ/aVI+2AglQqUtGmMFG2T/4cZIFdneAFg83R6MG/6qvUA1zBihqVRytYBjdAIhwe4Z+3Ob7KTJ+k8FfFOHdjCvgp4Lv8tgWBBX0VN4r5HfgBCnhX/vfX2ojbfq//5vpHquBe95M9fbA1ab7C7Ixs8hC8kKNYwGkhaO7cVLrMKvlQOltxmocsEUA5+MTTDAJ+GO4lTwPiGyEPJXDcupyAbNSOduICdeDGNpdlGv+lToFOCizHeY25scVOH1lhxD8NgMagQWmIQ9QeqWPwvdXLDL5hpf9QBI/wiwIr0hFdqnbHc/oFTEzg9vZE30TE6zH1WoHWbTe225LrPqOrrPbSLAp6rrmmckzmMn7kp/RIyPpupZZWEzmkiyK2oxuMs1NZ0UU4fh1kIj/P9Da4oFaclcKpEkYidjFd7sdBk6Y/F3x6mlt1nwNt44vRbvbS3EHdCw1B1qrIqwwSir0wsn+UvWjMDqUzRHVTR8DIKcg6MxANuRmtpqny51UPpTSkHVJfkKoVptHJHnpqcsJQoqTrXzFvtTGJT0gwMnvJRx9lYFO0snkbVCoEn2FygsmcgEBj7yNJIcdDZfFOYrn7Zhkutk9SU9N2ic79ndVRfefk65sjk+oRPv0JZnuldg2xFF8WXN0kQhgnINdgfCSNvBXei+kekqRvKBiqXpe53ckTrbmotX4boqQawDaoXGgJUDMx6mzg2U0r8RSFSaDHT9q+XcWlNVrS6G2Fl//GtNsbLDrjF3Dj60DoyDa1MZsa9XcqiSqsngJ/WMkQRajN4BMr03vW15P4CCU58EAxS9PuQs4jKEvhDt2z2aZ2t6i1aREm+rBIr4KebQNZMc8929E7xh5kH4uKGlacHeL2P3GNqSDRzHpHTzRDkrXqvgnQi2yiM0Bnb3EEfyjaYSKPsLJq3fnv4LWoq1yVBaAEEGhm/X8diHq+maV6X0HGtJ2J8X9Jx7z/78ktA9qZKexhRmaea1WVL1g7xpAigZSogK696suMDJFR/FmrdfFthQYPj4X1jA9njQrb8ZHey/h0Xy1W1IEccWsKm1u7LUtPkkkfe0F1tAQDcTnHjPH9GVeygZXXGR6LJyLl5IPV3ft6ymZqjN2uZyLi6EGsiWFs+AJrU0WNwhDfvQnVTaP+wU068QHZq94I0NvY17TjgI5A1Q7PZcYevqc8gWqXT5NE5GKxeToS8uv1WuPN+vYCUU4H6emy9M7/MtVlJxBAkQ/9ZMAwzmgyddgDq88Cyn2laU1jVvYweHIvavjmimJ5belykgXqF5YS5E3FJy5gZHJECYk8IcTp/8Ununjjkj3wBcyga3clSoKrYvkNnbok8d6rII0Uel3StBBxp721CrjUFgi/XTpffk55MBQTTW8kn8cxOWODx5nRkBexrvFL8LWI8M4NBBudfEF6Ban1XbPPOIQem3gN8+/i1PyCrzAl/ai5UJsGYRC8ij3JdJc2gRh7MzLKiwdCpRAY6XbAscKu2tErBTH0VHImx75zsjLwqQ23dlfPcd7DF1qLUdqGdoevopBLLfipau9CNrI4+uMWhYuood+0CHWhGlWTetnAalRDSgL93f5Q0hqptqIBCUdnxj+A1GHVG1kJPrtxr4YFmDzGdq7UOmDG6ZsLBvg+Ip6aUS+7HAam2SFsWYCE7RthZtuNJTvdYOYlueZX32UuK5uHSKhAiaeUgwomRwUHDfuqh+yEmL4dvGWmcr04eOlG0QaRzOh2TMZwwGZe+PIUEde5BSpN/uGuYXwlU9bgpTwnvgtX4A8JuD98eFznU/d71u9Kf5qLMf4YkH76ViqzDqj+joVGUbeci28/yf+MNqkTWUuUu2cGw81vieHbtwU90S+9JHz2Dki9/jD+wBwdHF7prR40YkDe41HB0L0b01G3XZ3xnOH8c8Kg+2HvInaAgwAPxumzYyZqI6eoxIYr3bhYwP2DgW1IDE0u07C9LGFNy/un7lWDXBlV5EgpfdosP7rLWBSi4KbVNJgvC47aZUyz+NdiUpzHM6AISipKMnm2sv9XScExMcQVRXd8+upcHLEfbTABvWyPa6KsFCFJrv6bb3epQpp6BU+7c4/QQLcaMTNrXytHlwMJ5A8LqowXhsj+v7IlfrCjk8lI12LWu7mPzrSOkwpmwXo6Eu/pmheVyhe5SQpAW1Y4Im+l+Eg5LEQxKxUaDjhKnhPLdNCHRuA3M3fY65Mrlj76VfO2RU+SGusiLFGWeQvB8D5VB1JTeZxmIi9QVa1W0x8VqMHfCMgf7H1uxJaBDgW+vOpsOHViFe6DE54zyhEOQqU5FA2waJvKsJomltaBqZjsLUnKEpclDEwBHvXU1CWQdAIQhA3Vg75g55V0XNyOQfaV5YdWhH38bZR5P5gZpOa9HYaxex2r1lDpE3aFDeeqPdl4F059uwdV6F2xGO1rYz3Z4drcPJEjBjUBYhz0wUQSDWPnUhqkJK/8IWCns1xXBGfENBdcUah6ZSXWwhNrBfV/lai2tTL8ra6RBmwhMDNRvYFsFp6bl2lJQmqQlXrMm968husrVLZ7QrockoXAPK0Jeralw==,iv:EaIrKf6XalfWt6LLhGWetmVuV0zDQaLvFdia0Wm4AG4=,tag:0riZDzFfQZBQoWPQhfIHJQ==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IGwrN1ZFQVow
|
||||||
|
YXZMcnlaRUY5azk3RG1rRFpmTHhicjlKWG9RMGRRd216aHU5d0NLSy9MUnNLdDZk
|
||||||
|
M0dkUHJnc3lYb0xHbTZIL1RKRE1zYkI4Y0JxVnBGdUlmdkJnR0gxWlVXWTV3Uitj
|
||||||
|
dkREbW95bi9mNEpyY0RRRjN0N0o0bGgxVnNKaU9Ca3VYV1lVUytjZTRLc0c4RWg1
|
||||||
|
T1hNdmtZa0xaN3JqaE1KRHZYRkNEYWdIdHdYYWp4Z3JGeFZNMVRzQUtHZXE2NTYv
|
||||||
|
WjhaQzdpY0FndGpVQmlUN2haQ3dJOGlnRjZWc1gxQThKUGNkMjk0UmMrTElZbTY0
|
||||||
|
akZ6V0FETm1WdWFmSW9EYmNyZG5qZTZqRnhxMjh4ZjY0YjZzeHRPZGhPQ2RneGlZ
|
||||||
|
SDRVblR2R2tjemM2UGl0SW4xWmt1bm9nOURiSHFRZXRxMjdDK0JqT29pNm5vMzNi
|
||||||
|
VFZKMGJ3WStIWHVuazR3aG4vaU14dFZWZzB1cG1oQXRYZysrS1dQWTRid1pRdjRJ
|
||||||
|
SWpBaVFLL3VkZ0dzcVo0TFJJMkpvM3VUaUZZU3RFcXVteDk4eGF4UysxUmZHU3dr
|
||||||
|
TEhlRUxYNi9WWmtDdnI5QytIcDZiZk4vTVY0djA3T2lhUXpJSnFtY0FQMFQ4cjZV
|
||||||
|
ajZjM1dsT1FISjBhSjlaSW5SN09GQU9IUUpWTVJKbmtsUXdwNUwvM3luNmRDcW9m
|
||||||
|
dUdvSS9jcmoyWE13dGlYVXhiTmhpSm82Y1hJVFVaL0lRVTcyYzNKMWR3ZGZscWls
|
||||||
|
OWJxNitkN2Iza1dXVUdaSVZXaWxFRDY3a1ZsV0VCUFJieVRvODN2V29WeGwxUWpK
|
||||||
|
cERWNDhLODdBYU5pTFNidGQwSmpEcTNyczdzWEJhdngvZUlFdFRBeWFUVzNKMzEr
|
||||||
|
QlpxVDNjcmUwaUFMbFlhTEpUQ05HVnBJc1ExNXNCbmxvNW1zdHJ6dGNXSWdoaDlI
|
||||||
|
TDhabUZlMndPZ3RlWUpXSENLbG5tMmFKekhtUkNKeUtUTnVkeFR2SjRsSzRDMlhi
|
||||||
|
Q1IyNzRZTU9zNXdBQjQwcEcrTE5hbGVuZHF2elFrRWo5ZGpicXF5eDc3RHN1Vjdt
|
||||||
|
Y3I0UHFOSnRDNXZ5ZVpSZXJqeTlaWHdVbjVBaXAzaXVBckN4OUp1MldsSWViNEk1
|
||||||
|
Z3dIOVRhRW1zb1BTNGo1czYxdThXYjlYTkdqOE43cmdXSWFGeTMxbi9hOWpTOEo4
|
||||||
|
N0FIb3hCd3laV2t5RVpGQ3FqRUF0Mk0wUlZIcEVQcGN1YSsvUGdLdkQvQXVTV09h
|
||||||
|
TEhyZHNzRjJkU3RqZTJGR1h6RkM5dmVuL2pPOGxGRzhDc2h3bXhLd2wrS0NEZXNm
|
||||||
|
NU1NeTZuQmYrUFpJQ3ZIZmxVMG52NHY2bHJhNnQvTklHQXFRaGt6S1g3TGpiajU0
|
||||||
|
ZUxiTGhMc1Q2dUlmVkFYZTNzU0xRV3JnQ2grOFhLeDFiaXZ6UUlubzRsNk8zNXl6
|
||||||
|
RjQwa295aUxLR0JyRDRTR3BiY3BNdDZ3eHZYRTNscnFRaXpkSW4zajRXSmlUaXBL
|
||||||
|
SW5FdnFKc3J1K0hDYmxTMnJGN3V6UVl3NGhGMmNidldDSUMxZThsL2QwNmFpd1VK
|
||||||
|
Q3pFRlpOKytrYlZFRThZRHBrZHVBT3Q0bkZuYmQ4S1lXU3JENUZTeDZiZ2l5UmlE
|
||||||
|
VlpMTW14OVlDT1VWWU1rbHoxSGw5ZTZaR0xFM2dkS3JubnRPMys1N3hiem9menpp
|
||||||
|
eU1CaUxhWTVjYU0xVXZRdXBFN3NrTklQSFJzcXZwRmV4Qm5ORWNPTldoZ1FhUFZr
|
||||||
|
MXZJVG8xeWVhRzBtdXRRREU2WktUM1lsNmJKT2tEblZKZVBLb2prVXJiZHBhamtN
|
||||||
|
VTZ1ck9hS1c3Zkx1ajQyYTVsOGt4dGIzekk0bkhabTBjcy94dWQ3ZERpTTkyTWZ6
|
||||||
|
SlZuUUlLVEh0c2NtNWpYZEZzMGZSaUVZdDlJSHkwYllmaHFkQ2NjOXJTV1RCUQpI
|
||||||
|
SmVxc3pZYjFheTBOdnhsZHFHNTlsenZjTnowZUFFQklVQ2FUN1p3WStJCi0tLSBE
|
||||||
|
N0cvem1zY051dG05WldSeXNpTExWQnFVMXpUd0s0ZGRFRjNYSGJacVlVCqVCVxE2
|
||||||
|
Id8s8etDCJ0J+jVJfjjCaBNyqXq6dzej+cak3+0x6wbQomqbF9+J2X9RiF/RlBw/
|
||||||
|
WTLJ3rqEHh07Tf8=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
|
||||||
|
encrypted_regex: ^(data|stringData)$
|
||||||
|
lastmodified: "2026-09-16T19:18:39Z"
|
||||||
|
mac: ENC[AES256_GCM,data:1vITCxz9DIk/0wV+cfjqJa2SQjBsxIGXEBGiR7dP/9oXQaklSqJHAX876HvVJh+YxAUDRAIMZCP7p8e3y03IYIOuarNOqlwtS5YytB6MImC4gGomF4yfBHIDw3fT9fbMk1zvI8gyFn9tbO72K4mHLpTgsU8En21okdjuiaBAQ/Q=,iv:uQdxqkLtiwQfvfsSFFXK3scz9D1lVeTT4/qw3wpvP44=,tag:wOM+lUJI+epdIypMneVgNw==,type:str]
|
||||||
|
mac_only_encrypted: true
|
||||||
|
version: 3.13.3
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
|
||||||
|
|
||||||
|
# Bootstraps core applications that provide a minimal runtime base for the
|
||||||
|
# cluster. These releases are installed first so the cluster has the resources
|
||||||
|
# Flux needs before its own reconciliation begins.
|
||||||
|
#
|
||||||
|
# After this bootstrap phase, Flux is ready to take over management of the
|
||||||
|
# application stack and continue reconciling downstream state.
|
||||||
|
|
||||||
|
helmDefaults:
|
||||||
|
cleanupOnFail: true
|
||||||
|
forceConflicts: true
|
||||||
|
wait: true
|
||||||
|
waitForJobs: true
|
||||||
|
|
||||||
|
bases:
|
||||||
|
- default.yaml
|
||||||
|
|
||||||
|
releases:
|
||||||
|
- name: cilium
|
||||||
|
namespace: kube-system
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
|
||||||
|
- name: coredns
|
||||||
|
namespace: kube-system
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
needs: ["kube-system/cilium"]
|
||||||
|
|
||||||
|
- name: spegel
|
||||||
|
namespace: kube-system
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
needs: ["kube-system/coredns"]
|
||||||
|
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: cert-manager
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
needs: ["kube-system/spegel"]
|
||||||
|
|
||||||
|
- name: flux-operator
|
||||||
|
namespace: flux-system
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
needs: ["cert-manager/cert-manager"]
|
||||||
|
|
||||||
|
- name: flux-instance
|
||||||
|
namespace: flux-system
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
needs: ["flux-system/flux-operator"]
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
|
||||||
|
|
||||||
|
# Bootstraps cluster-wide Custom Resource Definitions (CRDs) by extracting them
|
||||||
|
# from upstream Helm charts and applying them directly with kubectl. The releases
|
||||||
|
# below are never reconciled with helmfile apply or helmfile sync — only their
|
||||||
|
# CRDs are rendered (via --include-crds) and piped to the cluster.
|
||||||
|
#
|
||||||
|
# Installing CRDs out-of-band ensures they exist before Flux begins reconciling
|
||||||
|
# workloads that reference them, avoiding the need for dependsOn chains on nearly
|
||||||
|
# every Kustomization that consumes a CRD-backed resource.
|
||||||
|
|
||||||
|
helmDefaults:
|
||||||
|
args:
|
||||||
|
- --include-crds
|
||||||
|
- --no-hooks
|
||||||
|
|
||||||
|
bases:
|
||||||
|
- default.yaml
|
||||||
|
|
||||||
|
releases:
|
||||||
|
- name: envoy-gateway
|
||||||
|
namespace: network
|
||||||
|
inherit:
|
||||||
|
- template: default
|
||||||
|
|
||||||
|
- name: prometheus-operator-crds
|
||||||
|
namespace: observability
|
||||||
|
chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
|
||||||
|
version: 29.0.0
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
|
||||||
|
templates:
|
||||||
|
default:
|
||||||
|
chart: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).chart }}'
|
||||||
|
version: '{{ (fromYaml (tpl (readFile "./templates/release.yaml.gotmpl") .)).version }}'
|
||||||
|
values:
|
||||||
|
- ./templates/values.yaml.gotmpl
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
{{- $oci := fromYaml (readFile (printf "../../kubernetes/apps/%s/%s/app/ocirepository.yaml" .Release.Namespace .Release.Name)) -}}
|
||||||
|
chart: {{ $oci.spec.url }}
|
||||||
|
version: {{ $oci.spec.ref.tag }}
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
{{ (fromYaml (readFile (printf "../../../kubernetes/apps/%s/%s/app/helmrelease.yaml" .Release.Namespace .Release.Name))).spec.values | toYaml }}
|
||||||
@@ -0,0 +1,105 @@
|
|||||||
|
set no-exit-message
|
||||||
|
set quiet
|
||||||
|
set shell := ['bash', '-euo', 'pipefail', '-c']
|
||||||
|
set script-interpreter := ['bash', '-euo', 'pipefail']
|
||||||
|
set default-list
|
||||||
|
set default-script
|
||||||
|
|
||||||
|
kubernetes_dir := justfile_dir() + '/kubernetes'
|
||||||
|
|
||||||
|
[doc('Bootstrap the Talos cluster')]
|
||||||
|
[group('bootstrap')]
|
||||||
|
talos: talos-secret talos-apply talos-talosconfig talos-kubeconfig
|
||||||
|
|
||||||
|
[doc('Bootstrap apps into the Talos cluster')]
|
||||||
|
[group('bootstrap')]
|
||||||
|
apps: apps-ready apps-namespaces apps-secrets apps-crds apps-helm
|
||||||
|
just log info "Cluster is bootstrapped — Flux will start syncing the Git repository"
|
||||||
|
|
||||||
|
# No sops call or existence guard is needed: the bundle is stored already
|
||||||
|
# encrypted with the repo's age recipient, and existing bundles are left
|
||||||
|
# untouched.
|
||||||
|
[private]
|
||||||
|
[working-directory('../talos')]
|
||||||
|
talos-secret:
|
||||||
|
just log info "Generating secrets" stage "{{ recipe_name() }}"
|
||||||
|
topf secrets --confirm=false > /dev/null
|
||||||
|
|
||||||
|
[private]
|
||||||
|
[working-directory('../talos')]
|
||||||
|
talos-apply:
|
||||||
|
just log info "Applying talos config and bootstrapping" stage "{{ recipe_name() }}"
|
||||||
|
topf apply --auto-bootstrap --confirm=false
|
||||||
|
|
||||||
|
[private]
|
||||||
|
[working-directory('../talos')]
|
||||||
|
talos-talosconfig:
|
||||||
|
just log info "Generating talosconfig" stage "{{ recipe_name() }}"
|
||||||
|
topf talosconfig > talosconfig
|
||||||
|
|
||||||
|
# topf issues short-lived admin certs by default; 8760h keeps the
|
||||||
|
# kubeconfig usable long-term.
|
||||||
|
[private]
|
||||||
|
[working-directory('../talos')]
|
||||||
|
talos-kubeconfig:
|
||||||
|
just log info "Fetching kubeconfig" stage "{{ recipe_name() }}"
|
||||||
|
topf kubeconfig --validity 8760h > "{{ justfile_dir() }}/kubeconfig"
|
||||||
|
|
||||||
|
[private]
|
||||||
|
apps-crds:
|
||||||
|
just log info "Applying CRDs" stage "{{ recipe_name() }}"
|
||||||
|
if ! helmfile --file "{{ source_directory() }}/helmfile/crds.yaml" template --quiet | yq eval-all --exit-status 'select(.kind == "CustomResourceDefinition")' | kubectl apply --server-side --force-conflicts --filename -; then
|
||||||
|
just log fatal "Failed to apply crds"
|
||||||
|
fi
|
||||||
|
|
||||||
|
[private]
|
||||||
|
apps-helm:
|
||||||
|
just log info "Syncing helmfile" stage "{{ recipe_name() }}"
|
||||||
|
if ! helmfile --file "{{ source_directory() }}/helmfile/apps.yaml" sync --hide-notes; then
|
||||||
|
just log fatal "Failed to sync helmfile"
|
||||||
|
fi
|
||||||
|
|
||||||
|
[private]
|
||||||
|
apps-namespaces:
|
||||||
|
just log info "Applying namespaces for apps" stage "{{ recipe_name() }}"
|
||||||
|
for app in "{{ kubernetes_dir }}/apps"/*/; do
|
||||||
|
ns="$(basename "$app")"
|
||||||
|
if kubectl create namespace "$ns" --dry-run=client -o yaml \
|
||||||
|
| kubectl apply --server-side --filename - &>/dev/null; then
|
||||||
|
just log info "Namespace applied" namespace "$ns"
|
||||||
|
else
|
||||||
|
just log fatal "Failed to apply namespace" namespace "$ns"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
[private]
|
||||||
|
apps-secrets:
|
||||||
|
just log info "Applying secrets for apps" stage "{{ recipe_name() }}"
|
||||||
|
for secret in \
|
||||||
|
"{{ source_directory() }}/deploy-key.sops.yaml" \
|
||||||
|
"{{ source_directory() }}/sops-age.sops.yaml" \
|
||||||
|
"{{ kubernetes_dir }}/components/sops/cluster-secrets.sops.yaml"
|
||||||
|
do
|
||||||
|
name="$(basename "$secret" .sops.yaml)"
|
||||||
|
if sops decrypt "$secret" \
|
||||||
|
| kubectl --namespace flux-system apply --server-side --filename - &>/dev/null; then
|
||||||
|
just log info "Secret applied" resource "$name"
|
||||||
|
else
|
||||||
|
just log fatal "Failed to apply secret" resource "$name"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# Wait until nodes register as Ready=False. They only become Ready=True once the CNI is healthy.
|
||||||
|
[private]
|
||||||
|
apps-ready:
|
||||||
|
just log info "Waiting for nodes to register as Ready=False" stage "{{ recipe_name() }}"
|
||||||
|
if ! kubectl wait nodes --for=condition=Ready=True --all --timeout=10s &>/dev/null; then
|
||||||
|
deadline=$((SECONDS + 600))
|
||||||
|
until kubectl wait nodes --for=condition=Ready=False --all --timeout=10s &>/dev/null; do
|
||||||
|
if (( SECONDS >= deadline )); then
|
||||||
|
just log fatal "Timed out waiting for nodes to register"
|
||||||
|
fi
|
||||||
|
just log info "Nodes not available, waiting for nodes to be available. Retrying in 5 seconds..."
|
||||||
|
sleep 5
|
||||||
|
done
|
||||||
|
fi
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: sops-age
|
||||||
|
namespace: flux-system
|
||||||
|
stringData:
|
||||||
|
age.agekey: ENC[AES256_GCM,data:YRjc3lHz4Y1vwUVqVeqjwIygXc0ifZdj73cv/paYsFndC4/dEToRY3oZk92ZquUACIa5k85iOPCBTeR9V632QCcjhwDsbXxE36IKFKs=,iv:h7Y2WIyG2zkvIIwC1WOPbGfCWN324qExyszqdePwS4A=,tag:U50t2W5lTt/ebt2GIgJWNw==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IFVwZlZaeFc1
|
||||||
|
M0plcDcvMmVPd3VSbkZVMWgya1ZwUXlZck9qMDBybWorYWVwVFBTVjhiaHVOWkho
|
||||||
|
SVpuN1UwUVRqeXZyY0JXMEFjRG13bmRPYXF3ZGM2d1BOQ2xvcTBma1dDTk9udjkv
|
||||||
|
MVNIZ2VHWnVzamo0UnE0MXdkRXRBOHppb3JhMHhWNXR0d3lvaTRlUzNxaHBhSWw1
|
||||||
|
N2tCVUNPRkFSODRlaWd2TEdDbCt4em1QMm5iSTFwUUNldllZcGJ5K0tRNXUvdHFt
|
||||||
|
Wld5MnVGeUx2eFBRZ3Q0R25CZEpEQVB3dFpZNWZKL3FNZW5kMFV6VzU5SldyaWVv
|
||||||
|
elIvRklMVEFtNFF4elZxclc5ZHd0cVZFQVp2Q3cvYWptSjIrOHNNRDFMUHNmQmtz
|
||||||
|
Tzk5Q1FKelo1MEpqcUE2Sy9ucjZFeWNwQnIzcDNvWC9hcW9RSXVvT3ljWWJGVFVG
|
||||||
|
SXk0Sncva1hjYVFQOVVtRlpOK2EzU1Y1OGJJdmQ3NWEzbjF5UmNJYm41cUxvb0xm
|
||||||
|
dXRFU0Jqd3FxM25HcDQxM0ZKWUUreS9SVmsyVHpJS3JLeDhXdWU0K3NYTytUcjJa
|
||||||
|
eWNaYXRURVFpb3BleGMxMWl1NGJJZ3U0OTV0dklENFA0YUVGYWRSQ0NWTmVGT0xh
|
||||||
|
ak13SmxNTEk2ZCtwajh1WjFDeG52RklRWkJ4S1Vza2hMQ0JpRG5aYm9ra3pZZExR
|
||||||
|
dXEyUDBHL1kwOVVPbkw3Nk0wV2xiU2IwVU8rdmR5dTZSUmYwenc4ZEFYTEFEK0ZZ
|
||||||
|
bnhaNGl6REpFZmhuejluMVNFTDlPbkJSUUM1WWpJUXUvSFRNOUFiUzlMVG9ZUUhU
|
||||||
|
Vi9CVVdxbktRYjA0M2pPZllNVHZuMFo0TVlzU2dHcHZObnFYZXJyODBDUm5KZXFi
|
||||||
|
Y21KN2x0RmJFTEEzeVBDbDFkZHhFSm1YaWNQcjlOQ0N1OFZOQ2ZvOWRZdnFEbDIz
|
||||||
|
dmlQOVc3cnhiM2RBSDV4emh0dk43R0s0MUlUVDUvYTRsQ3VuVXJLYUF2ZGUzUjBP
|
||||||
|
YnlzSVB6dHBnQm1SSVpYdnNRWlJQMzErMG9mcFdBMWdEcnZXM0RmV2t0SEoxcS9Q
|
||||||
|
bnpoMUtpczU2V2g0SUxueWlVYmtONWdsdlNyMTNvNDNhd0YvSzllYW5MV3J4WVhW
|
||||||
|
bktPT2xrQTJKTWFFWEZGQUowSkU5SzNMd2FaZ3RjQjU1STlOaUdWTTB0Z2xJQkVx
|
||||||
|
a3BTT2R5bm95amd1Sjd5RkZwSVJmeVBsemtVdStRck81K2pRSzFkaFUxN1gwSGlX
|
||||||
|
Ky9ydjI5QWs4akRFUkY1SG5QNUtYT0pOVFBWNHE1ZUpFdThqT1pzdFFZMVBmOWJB
|
||||||
|
ZnBaQU1UNHU5MWs1V2J2VmlCZlo3bTErMXNQbUwyczU1YTZtWDA0dU9oemU1alcv
|
||||||
|
a3JyYjZwWUEwM1Y4Y1RyelVjd2RDemZmRXFibzltSlhuNFdqYjNya3dxSFMvajJt
|
||||||
|
bkdjZDIwdGpmTTIrbG0ySFBob2hoZnUyRmVUbG1CUTNxR2V0a1h6VHF3Unk1Umc1
|
||||||
|
algyVEczT3J0WGhQeTBzYk1QT0hwbHg4MDR4WkRsY0ZubUxjWFpCcHdxWEtxb2tp
|
||||||
|
Si9IYzBSQU1EUkl5YXJzU0VCKzVaRks0dzBMWVNtZW1mYWVTdmVMb1QzSFB1bGor
|
||||||
|
aitIU2dRYXQybG5DaDZwdHJhNnJtNkNtM3NSV2hqaUU5WE52ald6b0dmZFU4WFJp
|
||||||
|
aThqeGx5OWMvQ0N3SHhYR3EzRnlTWHdTT1FtQTZDUnVyNEg3VVl6Wml0dlpVYVl5
|
||||||
|
Vk5kNm1zZU5CR2s1dDRpSTYrdDVBV2pHcTEvamNwQjFXeHl1NGMvYVBmT3lDRTRt
|
||||||
|
NVE3M3hWa1VTRGNSczNxWnBUcCtPNGVPYi92UGZxc0dyMzFFYUVaVWVBOExlTDcv
|
||||||
|
eDZ4YUt1Mk5pN2c0Wm9RZk9TK1RkUWh0VVg3MmpJYW1MODhBUUk1Tm1KNDJDUQpS
|
||||||
|
alJlRWw2Z0Rrcy9tRVhKRVF5eWNJMlBwKytsNnRwNG4yL2RBSjlhTkw0Ci0tLSAx
|
||||||
|
KzhwMXF5bWowbS9TTEh1bzZCOFFZMFNQQ0lJV2RTT0l6azFEcW1waitrCtC57Bhf
|
||||||
|
GZ0O6k6RkMeIX7smJFeAPpFUSlVEnOOIXdth3ylzbYlaAUP/br3oTWILxc+NOY+x
|
||||||
|
bKhVMF4VxCBsdN4=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
|
||||||
|
encrypted_regex: ^(data|stringData)$
|
||||||
|
lastmodified: "2026-09-16T19:18:39Z"
|
||||||
|
mac: ENC[AES256_GCM,data:ghV8V2IExENuntQlcnirocvhdaJabhPxDzk4x4EmVSbAIYw6PdSckGzy/KF0vhNxOpBMJhF3lqAwkqZQEVLXP0P9Reh4gWi7tp9Vsk8OUbAChoGykbHhthKKcOeysiSl8jZwL/wBVkbLG/9n6ItIIPb5qOiwgVXOObS477vUufY=,iv:Lb/qCGxrdbLs00HKjQUIiRGPRsVMzThYuZ6zX6dvdNs=,tag:jDMo8sd/F6d0zrss6hBAxA==,type:str]
|
||||||
|
mac_only_encrypted: true
|
||||||
|
version: 3.13.3
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: ClusterIssuer
|
||||||
|
metadata:
|
||||||
|
name: selfsigned
|
||||||
|
spec:
|
||||||
|
selfSigned: {}
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: internal-ca
|
||||||
|
spec:
|
||||||
|
isCA: true
|
||||||
|
commonName: internal-ca
|
||||||
|
secretName: internal-ca
|
||||||
|
privateKey:
|
||||||
|
algorithm: ECDSA
|
||||||
|
size: 256
|
||||||
|
issuerRef:
|
||||||
|
name: selfsigned
|
||||||
|
kind: ClusterIssuer
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: ClusterIssuer
|
||||||
|
metadata:
|
||||||
|
name: internal-ca
|
||||||
|
spec:
|
||||||
|
ca:
|
||||||
|
secretName: internal-ca
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: cert-manager
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
crds:
|
||||||
|
enabled: true
|
||||||
|
replicaCount: 2
|
||||||
|
dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query
|
||||||
|
dns01RecursiveNameserversOnly: true
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
servicemonitor:
|
||||||
|
enabled: true
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./clusterissuer.yaml
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: v1.21.2
|
||||||
|
url: oci://quay.io/jetstack/charts/cert-manager
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
spec:
|
||||||
|
healthChecks:
|
||||||
|
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
name: cert-manager
|
||||||
|
namespace: cert-manager
|
||||||
|
- apiVersion: cert-manager.io/v1
|
||||||
|
kind: ClusterIssuer
|
||||||
|
name: internal-ca
|
||||||
|
healthCheckExprs:
|
||||||
|
- apiVersion: cert-manager.io/v1
|
||||||
|
kind: ClusterIssuer
|
||||||
|
current: status.conditions.exists(e, e.type == 'Ready' && e.status == 'True')
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/cert-manager/cert-manager/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: cert-manager
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: cert-manager
|
||||||
|
|
||||||
|
components:
|
||||||
|
- ../../components/sops
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- ./namespace.yaml
|
||||||
|
- ./cert-manager/ks.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
annotations:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: echo
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: echo
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
replicaCount: 2
|
||||||
|
config:
|
||||||
|
kubernetes: true
|
||||||
|
trustedProxies:
|
||||||
|
- "10.42.0.0/16"
|
||||||
|
httpRoute:
|
||||||
|
enabled: true
|
||||||
|
hostnames:
|
||||||
|
- "{{ .Release.Name }}.${SECRET_DOMAIN}"
|
||||||
|
parentRefs:
|
||||||
|
- name: envoy-internal
|
||||||
|
namespace: network
|
||||||
|
monitoring:
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
limits:
|
||||||
|
memory: 64Mi
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: echo
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 0.2.5
|
||||||
|
url: oci://ghcr.io/home-operations/charts/echo
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: echo
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/default/echo/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: default
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: default
|
||||||
|
|
||||||
|
components:
|
||||||
|
- ../../components/sops
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- ./namespace.yaml
|
||||||
|
- ./echo/ks.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
|
annotations:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
@@ -0,0 +1,133 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: flux-instance
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: flux-instance
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
commonAnnotations:
|
||||||
|
fluxcd.controlplane.io/reconcileArtifactEvery: 1h
|
||||||
|
instance:
|
||||||
|
cluster:
|
||||||
|
networkPolicy: false
|
||||||
|
components:
|
||||||
|
- source-controller
|
||||||
|
- kustomize-controller
|
||||||
|
- helm-controller
|
||||||
|
- notification-controller
|
||||||
|
sync:
|
||||||
|
kind: GitRepository
|
||||||
|
url: "https://git.grachevko.ru/grachevko/home-ops.git"
|
||||||
|
ref: "refs/heads/main"
|
||||||
|
path: kubernetes/flux/cluster
|
||||||
|
commonMetadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: flux
|
||||||
|
kustomize:
|
||||||
|
patches:
|
||||||
|
- # Increase the number of workers
|
||||||
|
patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --concurrent=10
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --requeue-dependency=5s
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: (kustomize-controller|helm-controller|source-controller)
|
||||||
|
- # Increase the memory limits
|
||||||
|
patch: |
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: all
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: manager
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 1Gi
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: (kustomize-controller|helm-controller|source-controller)
|
||||||
|
- # Enable in-memory kustomize builds
|
||||||
|
patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --concurrent=20
|
||||||
|
- op: replace
|
||||||
|
path: /spec/template/spec/volumes/0
|
||||||
|
value:
|
||||||
|
name: temp
|
||||||
|
emptyDir:
|
||||||
|
medium: Memory
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: kustomize-controller
|
||||||
|
- # Enable Helm repositories caching
|
||||||
|
patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --helm-cache-max-size=10
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --helm-cache-ttl=60m
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --helm-cache-purge-interval=5m
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: source-controller
|
||||||
|
- # Flux near OOM detection for Helm
|
||||||
|
patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --feature-gates=OOMWatch=true
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --oom-watch-memory-threshold=95
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --oom-watch-interval=500ms
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: helm-controller
|
||||||
|
- # Disable chart digest tracking
|
||||||
|
patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --feature-gates=DisableChartDigestTracking=true
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: helm-controller
|
||||||
|
- # Controller-level SOPS decryption
|
||||||
|
patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --sops-age-secret=sops-age
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: kustomize-controller
|
||||||
|
- # Watch configmaps and secrets attached to HelmReleases and Kustomizations
|
||||||
|
patch: |-
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --watch-configs-label-selector=owner!=helm
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: (helm-controller|kustomize-controller)
|
||||||
|
- # Cancel health checks on new Kustomizations revisions
|
||||||
|
patch: |-
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --feature-gates=CancelHealthCheckOnNewRevision=true
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: kustomize-controller
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: flux-instance
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 0.60.0
|
||||||
|
url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: flux-instance
|
||||||
|
spec:
|
||||||
|
dependsOn:
|
||||||
|
- name: flux-operator
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/flux-system/flux-instance/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: flux-system
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: flux-operator
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: flux-operator
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
serviceMonitor:
|
||||||
|
create: true
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: flux-operator
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 0.60.0
|
||||||
|
url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: flux-operator
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/flux-system/flux-operator/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: flux-system
|
||||||
|
wait: true
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: flux-system
|
||||||
|
|
||||||
|
components:
|
||||||
|
- ../../components/sops
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- ./namespace.yaml
|
||||||
|
- ./flux-instance/ks.yaml
|
||||||
|
- ./flux-operator/ks.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: flux-system
|
||||||
|
annotations:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
@@ -0,0 +1,87 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: cilium
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: cilium
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
autoDirectNodeRoutes: true
|
||||||
|
bpf:
|
||||||
|
masquerade: true
|
||||||
|
# Ref: https://github.com/siderolabs/talos/issues/10002
|
||||||
|
hostLegacyRouting: true
|
||||||
|
cni:
|
||||||
|
# Required for pairing with Multus CNI
|
||||||
|
exclusive: false
|
||||||
|
cgroup:
|
||||||
|
automount:
|
||||||
|
enabled: false
|
||||||
|
hostRoot: /sys/fs/cgroup
|
||||||
|
# The stable bond name is defined in talos/all/20-network-links.yaml.tpl
|
||||||
|
devices: bond0+
|
||||||
|
dashboards:
|
||||||
|
enabled: true
|
||||||
|
endpointRoutes:
|
||||||
|
enabled: true
|
||||||
|
envoy:
|
||||||
|
enabled: false
|
||||||
|
gatewayAPI:
|
||||||
|
enabled: false
|
||||||
|
hubble:
|
||||||
|
enabled: false
|
||||||
|
ipam:
|
||||||
|
mode: kubernetes
|
||||||
|
ipv4NativeRoutingCIDR: "10.42.0.0/16"
|
||||||
|
k8sServiceHost: 127.0.0.1
|
||||||
|
k8sServicePort: 7445
|
||||||
|
kubeProxyReplacement: true
|
||||||
|
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||||
|
l2announcements:
|
||||||
|
enabled: true
|
||||||
|
loadBalancer:
|
||||||
|
algorithm: maglev
|
||||||
|
mode: "snat"
|
||||||
|
localRedirectPolicies:
|
||||||
|
enabled: true
|
||||||
|
operator:
|
||||||
|
dashboards:
|
||||||
|
enabled: true
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
replicas: 2
|
||||||
|
rollOutPods: true
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
trustCRDsExist: true
|
||||||
|
rollOutCiliumPods: true
|
||||||
|
routingMode: native
|
||||||
|
securityContext:
|
||||||
|
capabilities:
|
||||||
|
ciliumAgent:
|
||||||
|
- CHOWN
|
||||||
|
- KILL
|
||||||
|
- NET_ADMIN
|
||||||
|
- NET_RAW
|
||||||
|
- IPC_LOCK
|
||||||
|
- SYS_ADMIN
|
||||||
|
- SYS_RESOURCE
|
||||||
|
- PERFMON
|
||||||
|
- BPF
|
||||||
|
- DAC_OVERRIDE
|
||||||
|
- FOWNER
|
||||||
|
- SETGID
|
||||||
|
- SETUID
|
||||||
|
cleanCiliumState:
|
||||||
|
- NET_ADMIN
|
||||||
|
- SYS_ADMIN
|
||||||
|
- SYS_RESOURCE
|
||||||
|
socketLB:
|
||||||
|
enabled: true
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
|
- ./networks.yaml
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cilium.io/v2alpha1
|
||||||
|
kind: CiliumLoadBalancerIPPool
|
||||||
|
metadata:
|
||||||
|
name: pool
|
||||||
|
spec:
|
||||||
|
allowFirstLastIPs: "No"
|
||||||
|
blocks:
|
||||||
|
- cidr: "192.168.40.0/24"
|
||||||
|
---
|
||||||
|
apiVersion: cilium.io/v2alpha1
|
||||||
|
kind: CiliumL2AnnouncementPolicy
|
||||||
|
metadata:
|
||||||
|
name: l2-policy
|
||||||
|
spec:
|
||||||
|
loadBalancerIPs: true
|
||||||
|
# NOTE: interfaces might need to be set if you have more than one active NIC on your hosts
|
||||||
|
# interfaces:
|
||||||
|
# - ^eno[0-9]+
|
||||||
|
# - ^eth[0-9]+
|
||||||
|
nodeSelector:
|
||||||
|
matchLabels:
|
||||||
|
kubernetes.io/os: linux
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: cilium
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 1.20.1
|
||||||
|
url: oci://quay.io/cilium/charts/cilium
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cilium
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/kube-system/cilium/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: kube-system
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,69 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: coredns
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: coredns
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
fullnameOverride: coredns
|
||||||
|
image:
|
||||||
|
repository: mirror.gcr.io/coredns/coredns
|
||||||
|
k8sAppLabelOverride: kube-dns
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
service:
|
||||||
|
name: kube-dns
|
||||||
|
clusterIP: "10.43.0.10"
|
||||||
|
replicaCount: 2
|
||||||
|
priorityClassName: system-cluster-critical
|
||||||
|
servers:
|
||||||
|
- zones:
|
||||||
|
- zone: .
|
||||||
|
scheme: dns://
|
||||||
|
use_tcp: true
|
||||||
|
port: 53
|
||||||
|
plugins:
|
||||||
|
- name: errors
|
||||||
|
- name: health
|
||||||
|
configBlock: |-
|
||||||
|
lameduck 5s
|
||||||
|
- name: ready
|
||||||
|
- name: kubernetes
|
||||||
|
parameters: cluster.local in-addr.arpa ip6.arpa
|
||||||
|
configBlock: |-
|
||||||
|
pods verified
|
||||||
|
fallthrough in-addr.arpa ip6.arpa
|
||||||
|
- name: autopath
|
||||||
|
parameters: "@kubernetes"
|
||||||
|
- name: forward
|
||||||
|
parameters: . /etc/resolv.conf
|
||||||
|
- name: cache
|
||||||
|
configBlock: |-
|
||||||
|
prefetch 20
|
||||||
|
serve_stale
|
||||||
|
servfail 0
|
||||||
|
- name: loop
|
||||||
|
- name: reload
|
||||||
|
- name: loadbalance
|
||||||
|
- name: prometheus
|
||||||
|
parameters: 0.0.0.0:9153
|
||||||
|
- name: log
|
||||||
|
configBlock: |-
|
||||||
|
class error
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
tolerations:
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: coredns
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
url: oci://ghcr.io/coredns/charts/coredns
|
||||||
|
ref:
|
||||||
|
tag: 1.47.1
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: coredns
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/kube-system/coredns/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: kube-system
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: kube-system
|
||||||
|
|
||||||
|
components:
|
||||||
|
- ../../components/sops
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- ./namespace.yaml
|
||||||
|
- ./cilium/ks.yaml
|
||||||
|
- ./coredns/ks.yaml
|
||||||
|
- ./metrics-server/ks.yaml
|
||||||
|
- ./reloader/ks.yaml
|
||||||
|
- ./spegel/ks.yaml
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: metrics-server
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: metrics-server
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
args:
|
||||||
|
- --kubelet-insecure-tls
|
||||||
|
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
|
||||||
|
- --kubelet-use-node-status-port
|
||||||
|
- --metric-resolution=10s
|
||||||
|
- --kubelet-request-timeout=2s
|
||||||
|
metrics:
|
||||||
|
enabled: true
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: metrics-server
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 3.14.0
|
||||||
|
url: oci://ghcr.io/home-operations/charts-mirror/metrics-server
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: metrics-server
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/kube-system/metrics-server/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: kube-system
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: kube-system
|
||||||
|
annotations:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: reloader
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: reloader
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
fullnameOverride: reloader
|
||||||
|
reloader:
|
||||||
|
readOnlyRootFileSystem: true
|
||||||
|
podMonitor:
|
||||||
|
enabled: true
|
||||||
|
namespace: "{{ .Release.Namespace }}"
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: reloader
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 2.2.17
|
||||||
|
url: oci://ghcr.io/stakater/charts/reloader
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: reloader
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/kube-system/reloader/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: kube-system
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: spegel
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: spegel
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
spegel:
|
||||||
|
containerdSock: /run/containerd/containerd.sock
|
||||||
|
containerdRegistryConfigPath: /etc/cri/conf.d/hosts
|
||||||
|
service:
|
||||||
|
registry:
|
||||||
|
hostPort: 29999
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: spegel
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 0.7.4
|
||||||
|
url: oci://ghcr.io/spegel-org/helm-charts/spegel
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: spegel
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/kube-system/spegel/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: kube-system
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: "${SECRET_DOMAIN/./-}-production"
|
||||||
|
spec:
|
||||||
|
dnsNames:
|
||||||
|
- "${SECRET_DOMAIN}"
|
||||||
|
- "*.${SECRET_DOMAIN}"
|
||||||
|
duration: 160h
|
||||||
|
issuerRef:
|
||||||
|
name: internal-ca
|
||||||
|
kind: ClusterIssuer
|
||||||
|
privateKey:
|
||||||
|
algorithm: ECDSA
|
||||||
|
secretName: "${SECRET_DOMAIN/./-}-production-tls"
|
||||||
|
usages:
|
||||||
|
- digital signature
|
||||||
@@ -0,0 +1,137 @@
|
|||||||
|
---
|
||||||
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
||||||
|
kind: EnvoyProxy
|
||||||
|
metadata:
|
||||||
|
name: envoy
|
||||||
|
spec:
|
||||||
|
logging:
|
||||||
|
level:
|
||||||
|
default: info
|
||||||
|
provider:
|
||||||
|
type: Kubernetes
|
||||||
|
kubernetes:
|
||||||
|
envoyDeployment:
|
||||||
|
replicas: 2
|
||||||
|
container:
|
||||||
|
imageRepository: mirror.gcr.io/envoyproxy/envoy
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
limits:
|
||||||
|
memory: 1Gi
|
||||||
|
envoyService:
|
||||||
|
externalTrafficPolicy: Cluster
|
||||||
|
shutdown:
|
||||||
|
drainTimeout: 180s
|
||||||
|
telemetry:
|
||||||
|
metrics:
|
||||||
|
prometheus:
|
||||||
|
compression:
|
||||||
|
type: Zstd
|
||||||
|
---
|
||||||
|
apiVersion: gateway.networking.k8s.io/v1
|
||||||
|
kind: GatewayClass
|
||||||
|
metadata:
|
||||||
|
name: envoy
|
||||||
|
spec:
|
||||||
|
controllerName: gateway.envoyproxy.io/gatewayclass-controller
|
||||||
|
parametersRef:
|
||||||
|
group: gateway.envoyproxy.io
|
||||||
|
kind: EnvoyProxy
|
||||||
|
name: envoy
|
||||||
|
namespace: network
|
||||||
|
---
|
||||||
|
apiVersion: gateway.networking.k8s.io/v1
|
||||||
|
kind: Gateway
|
||||||
|
metadata:
|
||||||
|
name: envoy-internal
|
||||||
|
annotations:
|
||||||
|
external-dns.kubernetes.io/target: internal.${SECRET_DOMAIN}
|
||||||
|
spec:
|
||||||
|
gatewayClassName: envoy
|
||||||
|
infrastructure:
|
||||||
|
annotations:
|
||||||
|
external-dns.kubernetes.io/hostname: internal.${SECRET_DOMAIN}
|
||||||
|
lbipam.cilium.io/ips: "192.168.40.11"
|
||||||
|
listeners:
|
||||||
|
- name: http
|
||||||
|
protocol: HTTP
|
||||||
|
port: 80
|
||||||
|
allowedRoutes:
|
||||||
|
namespaces:
|
||||||
|
from: Same
|
||||||
|
- name: https
|
||||||
|
protocol: HTTPS
|
||||||
|
port: 443
|
||||||
|
allowedRoutes:
|
||||||
|
namespaces:
|
||||||
|
from: All
|
||||||
|
tls:
|
||||||
|
certificateRefs:
|
||||||
|
- kind: Secret
|
||||||
|
name: ${SECRET_DOMAIN/./-}-production-tls
|
||||||
|
---
|
||||||
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
||||||
|
kind: BackendTrafficPolicy
|
||||||
|
metadata:
|
||||||
|
name: envoy
|
||||||
|
spec:
|
||||||
|
compressor:
|
||||||
|
- type: Zstd
|
||||||
|
zstd: {}
|
||||||
|
- type: Brotli
|
||||||
|
brotli: {}
|
||||||
|
- type: Gzip
|
||||||
|
gzip: {}
|
||||||
|
retry:
|
||||||
|
numRetries: 2
|
||||||
|
retryOn:
|
||||||
|
triggers:
|
||||||
|
- reset
|
||||||
|
targetSelectors:
|
||||||
|
- group: gateway.networking.k8s.io
|
||||||
|
kind: Gateway
|
||||||
|
tcpKeepalive: {}
|
||||||
|
timeout:
|
||||||
|
http:
|
||||||
|
requestTimeout: 0s
|
||||||
|
---
|
||||||
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
||||||
|
kind: ClientTrafficPolicy
|
||||||
|
metadata:
|
||||||
|
name: envoy
|
||||||
|
spec:
|
||||||
|
clientIPDetection:
|
||||||
|
xForwardedFor:
|
||||||
|
trustedCIDRs:
|
||||||
|
- "10.42.0.0/16"
|
||||||
|
http2:
|
||||||
|
onInvalidMessage: TerminateStream
|
||||||
|
http3: {}
|
||||||
|
targetSelectors:
|
||||||
|
- group: gateway.networking.k8s.io
|
||||||
|
kind: Gateway
|
||||||
|
tcpKeepalive: {}
|
||||||
|
tls:
|
||||||
|
minVersion: "1.2"
|
||||||
|
alpnProtocols:
|
||||||
|
- h2
|
||||||
|
- http/1.1
|
||||||
|
---
|
||||||
|
apiVersion: gateway.networking.k8s.io/v1
|
||||||
|
kind: HTTPRoute
|
||||||
|
metadata:
|
||||||
|
name: https-redirect
|
||||||
|
annotations:
|
||||||
|
external-dns.kubernetes.io/controller: none
|
||||||
|
spec:
|
||||||
|
parentRefs:
|
||||||
|
- name: envoy-internal
|
||||||
|
namespace: network
|
||||||
|
sectionName: http
|
||||||
|
rules:
|
||||||
|
- filters:
|
||||||
|
- type: RequestRedirect
|
||||||
|
requestRedirect:
|
||||||
|
scheme: https
|
||||||
|
statusCode: 301
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: envoy-gateway
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: envoy-gateway
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
global:
|
||||||
|
imageRegistry: mirror.gcr.io
|
||||||
|
config:
|
||||||
|
envoyGateway:
|
||||||
|
provider:
|
||||||
|
type: Kubernetes
|
||||||
|
kubernetes:
|
||||||
|
deploy:
|
||||||
|
type: GatewayNamespace
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./certificate.yaml
|
||||||
|
- ./envoy.yaml
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
|
- ./podmonitor.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: envoy-gateway
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 1.9.1
|
||||||
|
url: oci://mirror.gcr.io/envoyproxy/gateway-helm
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
---
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: PodMonitor
|
||||||
|
metadata:
|
||||||
|
name: envoy-proxy
|
||||||
|
spec:
|
||||||
|
jobLabel: envoy-proxy
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- network
|
||||||
|
podMetricsEndpoints:
|
||||||
|
- port: metrics
|
||||||
|
path: /stats/prometheus
|
||||||
|
honorLabels: true
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: proxy
|
||||||
|
app.kubernetes.io/name: envoy
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: envoy-gateway
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/network/envoy-gateway/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: network
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: k8s-gateway
|
||||||
|
spec:
|
||||||
|
chartRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: k8s-gateway
|
||||||
|
interval: 1h
|
||||||
|
values:
|
||||||
|
fullnameOverride: k8s-gateway
|
||||||
|
domain: "${SECRET_DOMAIN}"
|
||||||
|
ttl: 1
|
||||||
|
service:
|
||||||
|
type: LoadBalancer
|
||||||
|
port: 53
|
||||||
|
annotations:
|
||||||
|
lbipam.cilium.io/ips: "192.168.40.12"
|
||||||
|
externalTrafficPolicy: Cluster
|
||||||
|
watchedResources: ["HTTPRoute", "Service"]
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./ocirepository.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
|
kind: OCIRepository
|
||||||
|
metadata:
|
||||||
|
name: k8s-gateway
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
layerSelector:
|
||||||
|
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
|
||||||
|
operation: copy
|
||||||
|
ref:
|
||||||
|
tag: 3.7.3
|
||||||
|
url: oci://codeberg.org/k8s-gateway/charts/k8s-gateway
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: k8s-gateway
|
||||||
|
spec:
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps/network/k8s-gateway/app
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- name: cluster-secrets
|
||||||
|
kind: Secret
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
targetNamespace: network
|
||||||
|
wait: false
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: network
|
||||||
|
|
||||||
|
components:
|
||||||
|
- ../../components/sops
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- ./namespace.yaml
|
||||||
|
- ./envoy-gateway/ks.yaml
|
||||||
|
- ./k8s-gateway/ks.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: network
|
||||||
|
annotations:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
@@ -0,0 +1,53 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: cluster-secrets
|
||||||
|
stringData:
|
||||||
|
SECRET_DOMAIN: ENC[AES256_GCM,data:c8E/5LHk3cCusf72,iv:R+rD3r0fMm9nipi5/GTYpUuEatjskr3sz9VMQS7cfgA=,tag:jrVmNafhpsj6P0wLbhzyKA==,type:str]
|
||||||
|
sops:
|
||||||
|
age:
|
||||||
|
- enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IE5hYko2NW11
|
||||||
|
T2VVRlJlQ2RJdk5ZaWtlRk1NdUR5TGQ0YStlVmNRcHRTL21xL2FNNm5yVkZDT2d0
|
||||||
|
OUZnc29Jd0x6ZnduN1l3NUlIR3oyc1RIM0UzalQraHkySnVLdE9YbVAwVWZNOE5B
|
||||||
|
blE3VXUxL2JqTlo2M2hCK01kdFFaODdiTHQzdnNhUnRrck5obTIwNktZSENieDZk
|
||||||
|
ZERwSzVyY0x4YmpSeXhOdU5WdUx1VTFvQnpjekd1N3R2TURjamNZdXpsUVcyS1gr
|
||||||
|
MVFPcWdkT1Y0ZTNHMDd2d1d6YVR3Y1V2dEx2THhWbVdOZVlqZjBQVlFnZVR6a1lQ
|
||||||
|
ZVhBVkpabW9GZ0tsM2hWMVBkZVpOU29CQit6cnV4Z29KVzBkU3Rsa0huTC9BN2tY
|
||||||
|
NXF2MFlmZTMvZnQxRlZ4aVVtUXlGLytrZDBaR016VlpaTS9tek5DVU1tVWcvU0xV
|
||||||
|
KzJ4cGpZS01OMDdIVjQvSFkyUFNFMURFc0FLZENRWGpuOXVMRkFDekxuTjBMY3pD
|
||||||
|
dkRmMWViVzAxUWRuSUtFWG9vL2J6c2gvbG5PMFZNWjYrZHczYlA1ajBvQ3Vubk5r
|
||||||
|
YldmR1c2NXNsdVkvVUpTMTFlMisyaHd5eTZ6UWxhZXFZZ2hxOExMTmlZRDl2VjJX
|
||||||
|
bE9ORWRLV0hyL1g2Z00rblBYaHlyU2JIZG94THB5R2hEeENMbEo5c2ZRTkJJUEFi
|
||||||
|
WjdiNXFBNjh5Vkc1K3JBaThVK25iSFBJQmNCNURSc0x5bHR5S0V1UEljRUlyUlZt
|
||||||
|
dS9GNlNUWURnclFGZFhSc0JVRStscjMwYUJSVG9VSWdUYzhmTElwR3NhQyszQ2U3
|
||||||
|
KzZkTHRLcHAyazY5QTIrTXFpMkF0Vit0Sm1lMjUwVVJPVC9wV2RXdVdXcTJFY1hU
|
||||||
|
enMrL3JEa3Zsakl6MEkvc2srcEZmeHQrOWpRbTV3ZWlnMk1Qb0VUU0dZV3lxVC9a
|
||||||
|
QkFFbFU1WHNHRXRORFdtaGRqT3RkalBkQ3EzdkVvWE51c2ZCcHMyR0dOc0FBY2pP
|
||||||
|
czkxSkRJck96NzlkbVViRzNkVDhZaldkU2hmZkpjTUFLVGJhbHBHM29xQVpLTnEw
|
||||||
|
aXdsMHVpYjZTR09kbkNQU0pqajhWZ1R4bUkrUVZKdlBJeWFWMUE5MkdScFlWTWhj
|
||||||
|
dThIb2NKMFJMWG05N0FrTTRxMUJURU81eTNsWmU1OGtTMGM4NCs3RFlMTHhlUTdH
|
||||||
|
NzJiN2sxditzZ29pdVp1NlE5OXhnanF1ME1XcTVEMTJtUHhuaFY2enUwcGRURFhq
|
||||||
|
NTdVK0RWRlVvanF4Tk1zbnRHSzB3SVF4KzRQbFUybFJxZGtuenp0R0E2M2NacElT
|
||||||
|
QXNmZFYxOTRQbXdxUkRzKzFZMnNQTjlhQ2xNYlVOcVhxVm1WVUNpV0Uyajh6a2l2
|
||||||
|
QXpuVk1XZWVCTnhNWFlZRHdRaU5ENWp6bHZuZzFLTHNvWmg4K0xKckhUUlQ4UGR3
|
||||||
|
WTM2QWJqcXRXRlc2Y2R6RDQ2dkpVaXpZL09mRU1Rck44SjNMM2p3T1ZNd09pZmhN
|
||||||
|
UnNYdHRMR052bDU4dmNsay9NVWxabm1qMTBJbFYwcXc5WEgwc3pDSnFPVGxaMjhB
|
||||||
|
ejRrWUNzdGJXVnRiNWdYUTBrditVRlErUEMrbk96QjlJZTd0dzlVcEVuakVZQ295
|
||||||
|
WHNHVzhQb1ZiemZqWkJXcjlaMVJVK0pWZFhpdVhjSk5sajBDc3VOV3I0Y0tpOGkv
|
||||||
|
ZU0wUVRtQ1VRM0E5ZEN4UFk0RDE5NzBNQ0pUcUtrbkF4YlpMWlRqUWRTK2dzems4
|
||||||
|
cW5oTzNnUnFGb3YyRUFkY2lDOUdacG9ma2JtSC9MNnFhYUJBcGkyMmEyNUpJSi91
|
||||||
|
aVpyb0tMeTNTNkhsZUdmK2M4dXYvVkNvRjFxNGhhMG9mM2ZmcXRZbGNSeGdEOENN
|
||||||
|
VVdrYjRkTzhHcW1Ic3RNdHkyb0RkdWoveU5CVzdGQzVka2hrYVR0YmNrQlhRQQpj
|
||||||
|
a0FRNDRKbmZ3WTg2NXZDVU80b0p5TDM5Q3RBckk0R09WdER0L1VpNE44Ci0tLSBp
|
||||||
|
TnhPdFVObkVBVmtUSm5UNkQzdlhjaERtNEM3QVQyREw2V21CUklrV2ZnCnldYCm6
|
||||||
|
TPfysxZiJdVeDHctGGegEdbfruYd6XwN6vAg2CdtNQ10Ib8xqiCJd4ZRLe2PIa0B
|
||||||
|
08FxUeFAWX5IELU=
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
recipient: age1pq1kujt4l0f4ef0f2duw2txmcf87js23qxxq376erctqq6l8kc25duvszyk0kphpf4rfw54v9flae2zz86s3agchwux83ae8y5g38kgpehpv468gfdyqvks2hqd3s9r2zt6jd40vrjh5gzlhaex2v4hfya5wx7fykt89ty3ve9lsh2kemwytfuskruytq9kxwvys5w9uwa99a3ts2x68pex52j87qtkgjs4wnsmzeta0qsekz4jtrfqnhthge52nppe57fndaxzqsr3y64z5yyczh89mw97lur68uauk83z0c7c5j0ejj0azxmtt9fmm94rje9zefkf2dep0pgl84rcq64vk50neg5dye0rk3wxfeehvrqv5gnav6wmg5665kdmgxsvwje32kerj8zppvla6v92ul7gn4htw698yl5nqzx8lga4lxtj2kw5sdp9vamvsfmjwuqer5s9tpa2skhj3r4n0jjspy39uat4yk5fre6cr0xg6rqrdp3w0ktgzq4gx89r8252xklxxc4scxf4eaqphqgrcz8kcemjz0zlsq6knud6enq3z3spqjrdr3uagrk93j0rshc2zvy7tqqudzajqmre7l29qae6800pzpt6tf5emqj50lqp2xdey3df5uj06232ntfu2djzk6c8juh6h9tchk4vapn4g4jf8chlv5fqlfx4jnrsy8jv6szvwq6nx0nr0fn48ajae8fspnep8e9q5c9eukku86zejcq907292wypzcj4uurqs7ffranj73qsqsx3jtug75zkzyrf39ztqhkhxlcehddhav0vl4gpuexrs0qytdwfk9asc95kls7dx7g8xk96nwxphxd4za06ne4pmpcq9l88qc5wnjsdtxhtvdv0hmat24khs4dfw8ejpnyftqgkkjk80r23e03c08vs7vcj4d28qcmxg6g59sjz0zgkfj3g42nq7re4ysrz55qqhqxsrgxnmczw5wd8ufw3qcc8gsj87qm6h54h8tzj6e4jfcxwjhwmx2g0yanrczvrgw62yna9hy0wytrxjjcawejhfnj6jdsz588yu6epgs3uuuvnhdscxthpnduy2a8k7egzm7r8yyjp3ev29dve6ksr5rrk0v5xce55s3h9wn8dld0edj6ha9yfyvzgqhghv55fxfvmpn9vxyvs0w96hrzmngzjw9dv9k7wqmtcwh8qyzqrkfmm0xxw942wnlatfqssw9c8qpesgajh8v2aa6jpv2x4se3ck55y2apelskfs26yt5r5kjw5su5qptrnsentvy6exy92q5jzny4dvmx3y5s2uhfehnjcvtwrxhwldfjen7w9x43vdm96p7dv3fzvwhzmjvzr05nvjugrvky04fqehzhhmsfkw09v50uyht8yst5sd8ze6aahrlaymkhmzlaux5hh9p23qk9j44ck7pnurlz5z3ahfvhmkv4x5mgz0aundmhchg9zazdw9v7y0ue2pvhgqfnkj4vxs9s7dem8w69pzzqngt47y2a8qvkkgctq33jxmff8y2ag3pqyc5d2lqak7m2slas50h73vtk42q9j65jt634n9e5f8w7l0qy00xg9l3pg80qtfsctf06lx3p3p20kczwdvy6edf5yp0t2rtffwfgld7zun2my9ys9w0wh9glaxqwf85ay4fm2sjyhjkt4r2ruyl80ke4rrlpyue5f8zm4z4p8xy6447rggmpnfnem5kdar2lpapu9dua40r4rd7dzn0zprpqmc239q4jeg6e5uag59zdzysjzc89r5xt9m8fufjmtsau64fx2ef8gpas58ccn57esrxavcg6x596zdnv963d94a65ft6vkjpdky45tn9ulcf6xdms9c06m4dm4fgzw3rxtzezz2770wva4avw654r24d9hdh7are0rn69c9sdwd5mx45fruaze6l6
|
||||||
|
encrypted_regex: ^(data|stringData)$
|
||||||
|
lastmodified: "2026-09-16T19:18:39Z"
|
||||||
|
mac: ENC[AES256_GCM,data:39l4LWDBWzX4nHhGKbijAl+77eFEu72bplq6AWc9F6dR8aD3huNyZL5ZMsY/ABnGJD95Ef1s7b1m4+UTUb6ae40uXSyjr/qM5UeYW3LIlm9X9W4ln+d2+BZi5r3zmhN7Fg37S6d7Fg5dsBEkJ2e3MDs48nhF1IBGQJu08EijRWA=,iv:Bwdwgw4xjXAzn0zFjkSbYvYJbNCfMPhPlm3DhqGlqIg=,tag:Ye9FepwpYnsp1t4NPZlL+Q==,type:str]
|
||||||
|
mac_only_encrypted: true
|
||||||
|
version: 3.13.3
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1alpha1
|
||||||
|
kind: Component
|
||||||
|
resources:
|
||||||
|
- ./cluster-secrets.sops.yaml
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cluster-apps
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
decryption:
|
||||||
|
provider: sops
|
||||||
|
deletionPolicy: WaitForTermination
|
||||||
|
interval: 1h
|
||||||
|
path: ./kubernetes/apps
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
wait: false
|
||||||
|
patches:
|
||||||
|
- # Add Kustomization defaults for all child Kustomizations
|
||||||
|
patch: |-
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: _
|
||||||
|
spec:
|
||||||
|
decryption:
|
||||||
|
provider: sops
|
||||||
|
deletionPolicy: WaitForTermination
|
||||||
|
patches:
|
||||||
|
- patch: |-
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: _
|
||||||
|
spec:
|
||||||
|
install:
|
||||||
|
crds: CreateReplace
|
||||||
|
strategy:
|
||||||
|
name: RetryOnFailure
|
||||||
|
rollback:
|
||||||
|
cleanupOnFail: true
|
||||||
|
recreate: true
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
crds: CreateReplace
|
||||||
|
strategy:
|
||||||
|
name: RemediateOnFailure
|
||||||
|
remediation:
|
||||||
|
remediateLastFailure: true
|
||||||
|
retries: 2
|
||||||
|
target:
|
||||||
|
group: helm.toolkit.fluxcd.io
|
||||||
|
kind: HelmRelease
|
||||||
|
target:
|
||||||
|
group: kustomize.toolkit.fluxcd.io
|
||||||
|
kind: Kustomization
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
set quiet
|
||||||
|
set shell := ['bash', '-euo', 'pipefail', '-c']
|
||||||
|
set script-interpreter := ['bash', '-euo', 'pipefail']
|
||||||
|
set default-list
|
||||||
|
set default-script
|
||||||
|
|
||||||
|
[doc('Force Flux to pull in changes from your Git repository')]
|
||||||
|
[group('kube')]
|
||||||
|
reconcile:
|
||||||
|
flux --namespace flux-system reconcile kustomization flux-system --with-source
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
# Talos Patching
|
||||||
|
|
||||||
|
Machine configs are assembled by [topf](https://postfinance.github.io/topf/) from
|
||||||
|
`topf.yaml` plus the strategic merge patches in this directory.
|
||||||
|
|
||||||
|
<https://www.talos.dev/latest/talos-guides/configuration/patching/>
|
||||||
|
|
||||||
|
## Patch Directories
|
||||||
|
|
||||||
|
Patches merge in this order, alphabetically within each directory, with later
|
||||||
|
patches taking precedence:
|
||||||
|
|
||||||
|
- `all/`: applied to every node
|
||||||
|
- `control-plane/`: applied to control-plane nodes
|
||||||
|
- `worker/`: applied to worker nodes
|
||||||
|
- `node/${hostname}/`: applied to the node with the specified name
|
||||||
|
|
||||||
|
Files ending in `.yaml.tpl` are Go-templated per node; see the
|
||||||
|
[topf configuration model](https://postfinance.github.io/topf/main/configuration-model/)
|
||||||
|
for the available template variables.
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: UnattendedInstallConfig
|
||||||
|
provisioning:
|
||||||
|
diskSelector:
|
||||||
|
{{- if .Node.Data.installDisk }}
|
||||||
|
match: disk.dev_path == "{{ .Node.Data.installDisk }}" || "{{ .Node.Data.installDisk }}" in disk.symlinks
|
||||||
|
{{- else }}
|
||||||
|
match: disk.serial == "{{ .Node.Data.installDiskSerial }}"
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: HostnameConfig
|
||||||
|
auto: "off"
|
||||||
|
hostname: "{{ .Node.Host }}"
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
machine:
|
||||||
|
certSANs:
|
||||||
|
- "127.0.0.1"
|
||||||
|
- "192.168.40.10"
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeNetworkConfig
|
||||||
|
podSubnets: ["10.42.0.0/16"]
|
||||||
|
serviceSubnets: ["10.43.0.0/16"]
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: LinkAliasConfig
|
||||||
|
name: ethSel0
|
||||||
|
selector:
|
||||||
|
match: glob("{{ .Node.Data.macAddr }}", mac(link.hardware_addr))
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: BondConfig
|
||||||
|
name: bond0
|
||||||
|
links:
|
||||||
|
- ethSel0
|
||||||
|
bondMode: active-backup
|
||||||
|
mtu: {{ .Node.Data.mtu }}
|
||||||
|
addresses:
|
||||||
|
- address: "{{ .Node.IP }}/24"
|
||||||
|
routes:
|
||||||
|
- gateway: "192.168.40.1"
|
||||||
|
{{- if eq .Node.Role "control-plane" }}
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: Layer2VIPConfig
|
||||||
|
link: bond0
|
||||||
|
name: "192.168.40.10"
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: ResolverConfig
|
||||||
|
nameservers:
|
||||||
|
- address: 192.168.40.1
|
||||||
|
- address: 1.1.1.1
|
||||||
|
searchDomains:
|
||||||
|
disableDefault: true
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: TimeSyncConfig
|
||||||
|
ntp:
|
||||||
|
servers:
|
||||||
|
- 192.168.40.1
|
||||||
|
- 162.159.200.1
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeletConfig
|
||||||
|
config:
|
||||||
|
crashLoopBackOff:
|
||||||
|
maxContainerRestartPeriod: 60s
|
||||||
|
imageMaximumGCAge: 168h
|
||||||
|
maxParallelImagePulls: 3
|
||||||
|
serializeImagePulls: false
|
||||||
|
shutdownGracePeriod: 90s
|
||||||
|
shutdownGracePeriodCriticalPods: 60s
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeNodeConfig
|
||||||
|
nodeIP:
|
||||||
|
validSubnets:
|
||||||
|
- 192.168.40.0/24
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: SysctlConfig
|
||||||
|
params:
|
||||||
|
fs.inotify.max_user_watches: "1048576" # Watchdog
|
||||||
|
fs.inotify.max_user_instances: "8192" # Watchdog
|
||||||
|
net.core.rmem_max: "7500000" # Cloudflared | QUIC
|
||||||
|
net.core.wmem_max: "7500000" # Cloudflared | QUIC
|
||||||
|
net.ipv4.neigh.default.gc_thresh1: "4096" # Prevent ARP cache overflows
|
||||||
|
net.ipv4.neigh.default.gc_thresh2: "8192" # Prevent ARP cache overflows
|
||||||
|
net.ipv4.neigh.default.gc_thresh3: "16384" # Prevent ARP cache overflows
|
||||||
|
net.ipv4.tcp_slow_start_after_idle: "0" # Preserve congestion window after idle
|
||||||
|
user.max_user_namespaces: "11255" # User Namespaces
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: CRICustomizationConfig
|
||||||
|
name: containerd
|
||||||
|
content: |
|
||||||
|
[plugins."io.containerd.cri.v1.images"]
|
||||||
|
discard_unpacked_layers = false
|
||||||
|
[plugins."io.containerd.cri.v1.runtime"]
|
||||||
|
device_ownership_from_security_context = true
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
{{- if .Node.Data.encryptDisk }}
|
||||||
|
# Encrypt system disk with TPM
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: VolumeConfig
|
||||||
|
name: STATE
|
||||||
|
encryption:
|
||||||
|
provider: luks2
|
||||||
|
keys:
|
||||||
|
- slot: 0
|
||||||
|
tpm: {}
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: VolumeConfig
|
||||||
|
name: EPHEMERAL
|
||||||
|
encryption:
|
||||||
|
provider: luks2
|
||||||
|
keys:
|
||||||
|
- slot: 0
|
||||||
|
tpm: {}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
{{- range .Node.Data.kernelModules }}
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KernelModuleConfig
|
||||||
|
name: {{ . }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
# Talos 1.14 defaults to running kubelet and pods in a sandboxed PID/mount
|
||||||
|
# namespace, which breaks workloads that rely on hostPID or host mounts
|
||||||
|
# (node-exporter, GPU plugins, in-tree iSCSI). Set to true to opt in; on
|
||||||
|
# encrypted disks expect a second reboot the first time it is enabled.
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: SecurityProfileConfig
|
||||||
|
workloadIsolation: false
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
# Weekly online maintenance for XFS volumes: trim discards unused blocks
|
||||||
|
# (SSDs, thin provisioning) and scrub checks filesystem metadata.
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: FilesystemTrimConfig
|
||||||
|
interval: 168h0m0s
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: FilesystemScrubConfig
|
||||||
|
interval: 168h0m0s
|
||||||
@@ -0,0 +1,61 @@
|
|||||||
|
cluster:
|
||||||
|
etcd:
|
||||||
|
extraArgs:
|
||||||
|
listen-metrics-urls: http://0.0.0.0:2381
|
||||||
|
advertisedSubnets:
|
||||||
|
- 192.168.40.0/24
|
||||||
|
---
|
||||||
|
# Allow scheduling on control-plane nodes
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeNodeConfig
|
||||||
|
taints:
|
||||||
|
node-role.kubernetes.io/control-plane:
|
||||||
|
$patch: delete
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeAdmissionControlConfig
|
||||||
|
name: PodSecurity
|
||||||
|
$patch: delete
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeAPIServerConfig
|
||||||
|
certExtraSANs:
|
||||||
|
- "127.0.0.1"
|
||||||
|
- "192.168.40.10"
|
||||||
|
extraArgs:
|
||||||
|
# https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/
|
||||||
|
enable-aggregator-routing: "true"
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeControllerManagerConfig
|
||||||
|
extraArgs:
|
||||||
|
bind-address: 0.0.0.0
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeCoreDNSConfig
|
||||||
|
enabled: false
|
||||||
|
---
|
||||||
|
# Disable built-in CNI and kube-proxy to use Cilium
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeFlannelCNIConfig
|
||||||
|
$patch: delete
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeProxyConfig
|
||||||
|
enabled: false
|
||||||
|
---
|
||||||
|
apiVersion: v1alpha1
|
||||||
|
kind: KubeSchedulerConfig
|
||||||
|
extraArgs:
|
||||||
|
bind-address: 0.0.0.0
|
||||||
|
config:
|
||||||
|
profiles:
|
||||||
|
- schedulerName: default-scheduler
|
||||||
|
pluginConfig:
|
||||||
|
- name: PodTopologySpread
|
||||||
|
args:
|
||||||
|
defaultingType: List
|
||||||
|
defaultConstraints:
|
||||||
|
- maxSkew: 1
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
whenUnsatisfiable: ScheduleAnyway
|
||||||
@@ -0,0 +1,64 @@
|
|||||||
|
set quiet
|
||||||
|
set shell := ['bash', '-euo', 'pipefail', '-c']
|
||||||
|
set script-interpreter := ['bash', '-euo', 'pipefail']
|
||||||
|
set default-list
|
||||||
|
set default-script
|
||||||
|
|
||||||
|
# Day-2 apply/upgrade recipes rely on topf's built-in diff-and-confirm
|
||||||
|
# prompt; only the destructive reset recipes disable it in favour of just's
|
||||||
|
# own confirmation.
|
||||||
|
|
||||||
|
[doc('Apply Talos config to all nodes (shows a diff and asks first)')]
|
||||||
|
[group('talos')]
|
||||||
|
apply:
|
||||||
|
topf apply
|
||||||
|
|
||||||
|
[arg('mode', pattern='auto|reboot|no-reboot|staged|try')]
|
||||||
|
[doc('Apply Talos config to a node (shows a diff and asks first)')]
|
||||||
|
[group('talos')]
|
||||||
|
apply-node node mode='auto':
|
||||||
|
topf apply --nodes-filter "^{{ node }}$" --mode "{{ mode }}"
|
||||||
|
|
||||||
|
[doc('Show pending config changes without applying them')]
|
||||||
|
[group('talos')]
|
||||||
|
diff:
|
||||||
|
topf apply --dry-run
|
||||||
|
|
||||||
|
[doc('List all nodes and their current state')]
|
||||||
|
[group('talos')]
|
||||||
|
nodes:
|
||||||
|
topf nodes
|
||||||
|
|
||||||
|
[doc('Render Talos machine configs to ./rendered')]
|
||||||
|
[group('talos')]
|
||||||
|
render:
|
||||||
|
topf render --output ./rendered
|
||||||
|
|
||||||
|
[confirm("This will destroy your cluster and reset all nodes to maintenance mode — continue? [y/N]")]
|
||||||
|
[doc('Reset all nodes back to maintenance mode (DESTRUCTIVE)')]
|
||||||
|
[group('talos')]
|
||||||
|
reset:
|
||||||
|
topf reset --confirm=false
|
||||||
|
|
||||||
|
[confirm("This will reset node " + node + " to maintenance mode — continue? [y/N]")]
|
||||||
|
[doc('Reset a single node back to maintenance mode (DESTRUCTIVE)')]
|
||||||
|
[group('talos')]
|
||||||
|
reset-node node:
|
||||||
|
topf reset --nodes-filter "^{{ node }}$" --confirm=false
|
||||||
|
|
||||||
|
# topf intentionally does not manage Kubernetes upgrades
|
||||||
|
[doc('Upgrade Kubernetes')]
|
||||||
|
[group('talos')]
|
||||||
|
upgrade-k8s:
|
||||||
|
talosctl --nodes "$(yq '[.nodes[] | select(.role == "control-plane")][0].ip' topf.yaml)" \
|
||||||
|
upgrade-k8s --to "$(yq '.kubernetesVersion' topf.yaml)"
|
||||||
|
|
||||||
|
[doc('Upgrade Talos on all nodes, one at a time (asks first)')]
|
||||||
|
[group('talos')]
|
||||||
|
upgrade:
|
||||||
|
topf upgrade
|
||||||
|
|
||||||
|
[doc('Upgrade Talos on a single node (asks first)')]
|
||||||
|
[group('talos')]
|
||||||
|
upgrade-node node:
|
||||||
|
topf upgrade --nodes-filter "^{{ node }}$"
|
||||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,45 @@
|
|||||||
|
---
|
||||||
|
clusterName: kubernetes
|
||||||
|
clusterEndpoint: https://192.168.40.10:6443
|
||||||
|
|
||||||
|
# renovate: datasource=github-releases depName=siderolabs/talos
|
||||||
|
talosVersion: v1.14.0
|
||||||
|
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
|
||||||
|
kubernetesVersion: v1.37.0
|
||||||
|
|
||||||
|
secretsPath: secrets.sops.yaml
|
||||||
|
|
||||||
|
nodes:
|
||||||
|
- host: "k8s-0"
|
||||||
|
ip: "192.168.40.20"
|
||||||
|
role: control-plane
|
||||||
|
schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
|
||||||
|
data:
|
||||||
|
installDisk: "/dev/sda"
|
||||||
|
installDiskSerial: ""
|
||||||
|
macAddr: "bc:24:11:00:00:20"
|
||||||
|
mtu: 1500
|
||||||
|
encryptDisk: false
|
||||||
|
kernelModules: []
|
||||||
|
- host: "k8s-1"
|
||||||
|
ip: "192.168.40.21"
|
||||||
|
role: control-plane
|
||||||
|
schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
|
||||||
|
data:
|
||||||
|
installDisk: "/dev/sda"
|
||||||
|
installDiskSerial: ""
|
||||||
|
macAddr: "bc:24:11:00:00:21"
|
||||||
|
mtu: 1500
|
||||||
|
encryptDisk: false
|
||||||
|
kernelModules: []
|
||||||
|
- host: "k8s-2"
|
||||||
|
ip: "192.168.40.22"
|
||||||
|
role: control-plane
|
||||||
|
schematicId: "e3fab82b561b5e559cdf1c0b1e5950c0e52700b9208a2cfaa5b18454796f3a7e"
|
||||||
|
data:
|
||||||
|
installDisk: "/dev/sda"
|
||||||
|
installDiskSerial: ""
|
||||||
|
macAddr: "bc:24:11:00:00:22"
|
||||||
|
mtu: 1500
|
||||||
|
encryptDisk: false
|
||||||
|
kernelModules: []
|
||||||
Reference in New Issue
Block a user