wjones/clustertool
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

repo migration

Browse Source
This commit is contained in:
Wendell Jones
2025-05-13 08:49:46 -04:00
commit 21a45f1d09
135 changed files with 2698 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+93
View File
@@ -0,0 +1,93 @@
# clustertool
## Getting started
To make it easy for you to get started with GitLab, here's a list of recommended next steps.
Already a pro? Just edit this README.md and make it your own. Want to make it easy? [Use the template at the bottom](#editing-this-readme)!
## Add your files
- [ ] [Create](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#create-a-file) or [upload](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#upload-a-file) files
- [ ] [Add files using the command line](https://docs.gitlab.com/ee/gitlab-basics/add-file.html#add-a-file-using-the-command-line) or push an existing Git repository with the following command:
```
cd existing_repo
git remote add origin https://gitlab.wpjones.com/wjones/clustertool.git
git branch -M main
git push -uf origin main
```
## Integrate with your tools
- [ ] [Set up project integrations](https://gitlab.wpjones.com/wjones/clustertool/-/settings/integrations)
## Collaborate with your team
- [ ] [Invite team members and collaborators](https://docs.gitlab.com/ee/user/project/members/)
- [ ] [Create a new merge request](https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html)
- [ ] [Automatically close issues from merge requests](https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#closing-issues-automatically)
- [ ] [Enable merge request approvals](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/)
- [ ] [Set auto-merge](https://docs.gitlab.com/ee/user/project/merge_requests/merge_when_pipeline_succeeds.html)
## Test and Deploy
Use the built-in continuous integration in GitLab.
- [ ] [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/index.html)
- [ ] [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/)
- [ ] [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html)
- [ ] [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/)
- [ ] [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
***
# Editing this README
When you're ready to make this README your own, just edit this file and use the handy template below (or feel free to structure it however you want - this is just a starting point!). Thanks to [makeareadme.com](https://www.makeareadme.com/) for this template.
## Suggestions for a good README
Every project is different, so consider which of these sections apply to yours. The sections used in the template are suggestions for most open source projects. Also keep in mind that while a README can be too long and detailed, too long is better than too short. If you think your README is too long, consider utilizing another form of documentation rather than cutting out information.
## Name
Choose a self-explaining name for your project.
## Description
Let people know what your project can do specifically. Provide context and add a link to any reference visitors might be unfamiliar with. A list of Features or a Background subsection can also be added here. If there are alternatives to your project, this is a good place to list differentiating factors.
## Badges
On some READMEs, you may see small images that convey metadata, such as whether or not all the tests are passing for the project. You can use Shields to add some to your README. Many services also have instructions for adding a badge.
## Visuals
Depending on what you are making, it can be a good idea to include screenshots or even a video (you'll frequently see GIFs rather than actual videos). Tools like ttygif can help, but check out Asciinema for a more sophisticated method.
## Installation
Within a particular ecosystem, there may be a common way of installing things, such as using Yarn, NuGet, or Homebrew. However, consider the possibility that whoever is reading your README is a novice and would like more guidance. Listing specific steps helps remove ambiguity and gets people to using your project as quickly as possible. If it only runs in a specific context like a particular programming language version or operating system or has dependencies that have to be installed manually, also add a Requirements subsection.
## Usage
Use examples liberally, and show the expected output if you can. It's helpful to have inline the smallest example of usage that you can demonstrate, while providing links to more sophisticated examples if they are too long to reasonably include in the README.
## Support
Tell people where they can go to for help. It can be any combination of an issue tracker, a chat room, an email address, etc.
## Roadmap
If you have ideas for releases in the future, it is a good idea to list them in the README.
## Contributing
State if you are open to contributions and what your requirements are for accepting them.
For people who want to make changes to your project, it's helpful to have some documentation on how to get started. Perhaps there is a script that they should run or some environment variables that they need to set. Make these steps explicit. These instructions could also be useful to your future self.
You can also document commands to lint the code or run tests. These steps help to ensure high code quality and reduce the likelihood that the changes inadvertently break something. Having instructions for running tests is especially helpful if it requires external setup, such as starting a Selenium server for testing in a browser.
## Authors and acknowledgment
Show your appreciation to those who have contributed to the project.
## License
For open source projects, say how it is licensed.
## Project status
If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers.
clusters/main/.gitignore
+15
View File
@@ -0,0 +1,15 @@
talconfig.json
clusterconfig
patches/all.yaml
patches/controlplane.yaml
patches/worker.yaml
*patches/all.yaml
*patches/controlplane.yaml
*patches/worker.yaml
all.yaml
controlplane.yaml
worker.yaml
*sopssecret.secret.yaml
sopssecret.secret.yaml
cluster/main/kubernetes/**/bootstrap-values.yaml.ct
*kubeconfig
clusters/main/clusterenv.yaml
+43
View File
@@ -0,0 +1,43 @@
#ENC[AES256_GCM,data:ivlK3YpKOUqjcg9WZBhyONqJSMxwYu1G46U6LbJ9jbgD/omtZy5Ucin/6Vh+2r9980rJ4zomOC2BJ2kQ9+sDdN0=,iv:FnA29cUcvbixPFwiJkDnC0+BxXeOYY0kC8gJKkBYfD0=,tag:UGXMkl7lRqaMPlLbp6DWmQ==,type:comment]
#ENC[AES256_GCM,data:Bppx2CNz0EZragTJPWXZqfhe13ryCa7Er4+TPprZMEOgexWm/8ooXj2WFR8=,iv:Fq5+IxGM/sQkSjWkU6+737MlzFkqRzxV4RvCceQ09i8=,tag:BTFZ5QxaB0Ykhq++IC3D7A==,type:comment]
VIP: ENC[AES256_GCM,data:Uv98AXTJXy1On6bWG84=,iv:lx4hIP4qUcf74f3/iFccbVqwyRuwYttS6pCP+rFuX2Q=,tag:/oAq2l1A4JrB5bFpbhsldw==,type:str]
#ENC[AES256_GCM,data:7L6tWYFr5k4SIsJramEgXk1gMAKlrF2oT/YD,iv:8bt5i4S1q2v4ji8Fi62ZgMxKrxJp7Tuu/KxglNADdzU=,tag:PRQ/cfqxhCosTYCjKmmJAw==,type:comment]
#ENC[AES256_GCM,data:NSONj2MFQiwmi5/dTH6uXDLAS2T2GUEigzXgV+HYDWg0XJJy5nMyOnZDpy7a1Mc+FYKSALfSL3uqqVdmhhXQSJSbgmTPHAwBydbdODzwjK8f2VC2up8Ub88=,iv:ZrphGBtpT0T5ovdQfhVGCXL27SZJ3tdzbTWpD3WL7c4=,tag:Br7GAul9iu/hPOkNFub+pw==,type:comment]
MASTER1IP: ENC[AES256_GCM,data:E7MiHC/0BIcGg1m0a1g=,iv:rtSW16TRZ2Y0Um6ynpljTQFpNp5mO+PxdR5/xtFt5hs=,tag:f9cdE2zGGNmIlXQw0w6K0A==,type:str]
#ENC[AES256_GCM,data:pXAeQ708XL5X038epItt+vKfFfNmzXdZcRARfuNTY4hf0g==,iv:IefEzb6+pgvr3wQuw4JR0QWszALCMV9zM/mksuvfDDw=,tag:bmCyNhzxPEAjyULtxuWagQ==,type:comment]
GATEWAY: ENC[AES256_GCM,data:jo99rvL/2mZr1QmW,iv:/klNo9RcxOAIaTdfxOB4ECncqkqRYsTOUwFcUOlKPPA=,tag:/bUW/liFM2526SwQL5OPaA==,type:str]
#ENC[AES256_GCM,data:SQ+c5x0ttyXjb2OEKzapI4D7dDHs6o7UX1hE1XL62kRPOJy90QbrYXDg6XmRNCY=,iv:WT47h4mJXOFxH+dUUtJq1SYn9Escu9eWpPKgG9VFKxU=,tag:hmP0Lene9tpzFxAmmFybIw==,type:comment]
METALLB_RANGE: ENC[AES256_GCM,data:KOCmXROWGo5FORcJ9yUMFHCYYeBLJgyk6RpICbE=,iv:L+JXilO0WCjwOZm+c1xWzDfljvaW8kEirQ7HYb8vYMs=,tag:TpIdpLTfZapTs2zxYcVpNA==,type:str]
#ENC[AES256_GCM,data:MET5IzgvYtaCkYKSeEK2Ury8yBEMEoLioD71cUpkvBA/uxf7yDAYa0bKfn0K7E+kRPTnHkx1XMXl4hcwA7Z1eTXhOVuzYENjBHDVPOkDhe4=,iv:LgE01YlqS0fsLpXjniPOzn79SXElbXbqEAVmaV2XwX8=,tag:YVvpwYxW+pIPWul//EoaZg==,type:comment]
DASHBOARD_IP: ENC[AES256_GCM,data:XP5XyqUH69BYbrMvn3c=,iv:lnGNGmTYIAcTkatwoTuj7JlPdZpS4np7g+heMZzjU2Q=,tag:Z2cZphwUpm/nrfZZ42qlTA==,type:str]
#ENC[AES256_GCM,data:+AenhvLAoSl1L55niyNp9X9BsAQN2NhSRmyA83uMe5tymNH8B4AZKpjXTDXyARoH3fwIR5EHWW8=,iv:iWAWt1Rsr5/eJ0phPw1z/5yv3mBoLbCED0qilxlKaf0=,tag:WFhPlyXF2o5Mu+4AsSWjeQ==,type:comment]
#ENC[AES256_GCM,data:uz0Nzd6XawwKY7J8UNxCWh7nZ9hFwhswow==,iv:l3Y8jyHx6YxQgE0OTQDtHX9cSpud2nqci6bxy1qGZr4=,tag:SdARU5q0vYbymnpl04RsTQ==,type:comment]
#ENC[AES256_GCM,data:b5AFePED60sjR300CX6DQoKLneb9YWDT9Q7qW5woAg6yqWyfZOYY6QbtxCx3T4zYksHRn8vUkcJ0ASZSNQOf9swGFVW0xl+o7i3fclQ=,iv:+tguqQ69hAB+NNNnKfex+RmZNSntxcEhU+dUGmvn4m0=,tag:FD/gG3zgdIdFNXJtH+X5mA==,type:comment]
GITHUB_REPOSITORY: ""
#ENC[AES256_GCM,data:V75/HDxAPDmk+Z4lOee8nBwjRTmizrOE+s2Xlg16k47GclREPlYZ/622Ccm2TTs+QFgQZtnXF44qjckgaiTWKseIeGyNJmw=,iv:24vvye0kwWfTyL6G4I4bUn433Xvg07c85VSWf2UdpYo=,tag:dP7kjyfvusmLUKeQxSku1Q==,type:comment]
#ENC[AES256_GCM,data:6Z2muYxNZ3T8khpSCQ9KGwbNG4KmMFp+5MikXwii/anULJ0GAsDHj3bNq08YuA6oTX3rItuq,iv:xXrsqPXoxibPPhFnRwyYdJyUi3JLNbW/n/rkOD2TKQc=,tag:3GwrxTkcfGrg9YfMujmOGA==,type:comment]
#ENC[AES256_GCM,data:8qIATB8dT/lar5TRnvX/RXjr2OpjaXIOa0vdCxb/MFay9+Y=,iv:darE3gv5X7LlG43gP4ZSrN4MQAi43OUYicZ6kI2SNCE=,tag:9KQzt412IqnqEthF7kvDqg==,type:comment]
#ENC[AES256_GCM,data:N3E5+UhvkdKOSWxSNlwb1CGMsHRY+PzNQMNuR+AXfk3qaj+N2oid,iv:MUXmT25hGIkqYkUyIilthR0+E+0J4dGmYTZVudDxpQg=,tag:gLZ6LKzhNvR/Z6QvQXbGuw==,type:comment]
#ENC[AES256_GCM,data:UPZOh94uHTQ6O8ypX78=,iv:NBLUXe3ZzSUJuix+1y/qdflEI/cLx4CNO6uiRfouzyI=,tag:T6NkesW3tZTTNqrN2yCd9g==,type:comment]
PODNET: ENC[AES256_GCM,data:6bhhVR+yZ4HV3wf5Zg==,iv:GN13FZVqzOWfIa6FWqSb9ti3cm5dduwpW5XAJjs+hnc=,tag:DJtGCpIscYs40l3kOIgcrw==,type:str]
SVCNET: ENC[AES256_GCM,data:+Aw9NaKtqw48ardNKg==,iv:F0I8wPiMkb4TCmMqgmr6mNEJufZoy2p+v08pHTBNS9Y=,tag:5aq1bExpYCyt7uQn0oD40g==,type:str]
sops:
shamir_threshold: 3
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNTXRyWjl5QVE5M2hxNHVS
UWRGRkFFNHdZcDNVb1lyWWdkOWE5UW5pL0RvCmFOZlZDV3BERmZkVnBud25YVjJ3
bDNySGhScjN6bHp4Mit3UFZPSit4VzAKLS0tIEtrcUNNM3B1aldLMStXSCtZUEhx
WWt1c052cjE4RzJIZ1NRbDFzTHpWN1kKRCMjS4EVveIsE9so1pJpZgeM5Ub/8rQj
WPz2XvrIpL7h+WY88JAP8JPDk3dIfYu41ZrmjykwLwpIAY4AJCGSRw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-11-05T18:25:50Z"
mac: ENC[AES256_GCM,data:FHqoHJ2/jG5AY63yxHM8yx6QcriMHwahF150xHAzPIVcZmYml7mB27b+pH1jMtdWK7t3JLtl3ZPRszrBm1NGqXW4FDwlJdpfgnQjRp434KUoENjWgzH/C6L8voLWqZS8HiJ86PpKaxp5s/V+BhjSv4eNkF7iZVNpGueF64b14LM=,iv:rN362UoGmejMWRm4a5ph40S0eMx6pf0Ocg3EfMJD8+g=,tag:yS9YrRhCTHVI5vW5yzn6Ew==,type:str]
pgp: []
version: 3.9.1
clusters/main/kubernetes/apps/kubernetes-dashboard/app/helm-release.yaml
+39
View File
@@ -0,0 +1,39 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
interval: 15m
chart:
spec:
chart: kubernetes-dashboard
version: 1.10.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
service:
main:
type: LoadBalancer
loadBalancerIP: ${DASHBOARD_IP}
ports:
main:
port: 80
clusters/main/kubernetes/apps/kubernetes-dashboard/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
clusters/main/kubernetes/apps/kubernetes-dashboard/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: kubernetes-dashboard
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/apps/kubernetes-dashboard/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubernetes-dashboard
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/apps/kubernetes-dashboard/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/apps/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- kubernetes-dashboard/ks.yaml
clusters/main/kubernetes/core/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- kyverno-policies/ks.yaml
- metallb-config/ks.yaml
- system-upgrade-controller-plans/ks.yaml
clusters/main/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
+53
View File
@@ -0,0 +1,53 @@
## This Can be enabled in the kustomization.yaml file.
## Please note not every chart or application is compatible with this behavior
## Primarily operators spinning their own pods, might include conflicting validation
## Add manual exclusions where needed
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: resolve-image-to-digest
annotations:
policies.kyverno.io/title: Resolve Image to Digest
policies.kyverno.io/category: Other
policies.kyverno.io/severity: medium
kyverno.io/kyverno-version: 1.6.0
policies.kyverno.io/minversion: 1.6.0
kyverno.io/kubernetes-version: "1.23"
policies.kyverno.io/subject: Pod
policies.kyverno.io/description: >-
Image tags are mutable and the change of an image can result in the same tag.
This policy resolves the image digest of each image in a container and replaces
the image with the fully resolved reference which includes the digest rather than tag.
spec:
background: false
rules:
- name: resolve-to-digest
match:
any:
- resources:
kinds:
- Pod
exclude:
any:
- resources:
kinds:
- Pod
name: '*cnpg*'
preconditions:
all:
- key: "{{request.operation || 'BACKGROUND'}}"
operator: NotEquals
value: DELETE
mutate:
foreach:
- list: "request.object.spec.containers"
context:
- name: resolvedRef
imageRegistry:
reference: "{{ element.image }}"
jmesPath: "resolvedImage"
patchStrategicMerge:
spec:
containers:
- name: "{{ element.name }}"
image: "{{ resolvedRef }}"
clusters/main/kubernetes/core/kyverno-policies/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- schematic-to-pod.yaml
# - ensure-digest.yaml
clusters/main/kubernetes/core/kyverno-policies/app/schematic-to-pod.yaml
+38
View File
@@ -0,0 +1,38 @@
---
apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
name: mutate-pod-binding
annotations:
pod-policies.kyverno.io/autogen-controllers: none
policies.kyverno.io/title: Mutate Pod Add Schematic
policies.kyverno.io/category: Other
policies.kyverno.io/subject: Pod
kyverno.io/kyverno-version: 1.10.0
policies.kyverno.io/minversion: 1.10.0
kyverno.io/kubernetes-version: "1.30"
spec:
background: false
rules:
- name: project-foo
match:
any:
- resources:
kinds:
- Pod/binding
names:
- apply-talos*
context:
- name: node
variable:
jmesPath: request.object.target.name
default: ''
- name: schematic
apiCall:
urlPath: "/api/v1/nodes/{{node}}"
jmesPath: "metadata.annotations.\"extensions.talos.dev/schematic\" || 'empty'"
mutate:
patchStrategicMerge:
metadata:
annotations:
extensions.talos.dev/schematic: "{{ schematic }}"
clusters/main/kubernetes/core/kyverno-policies/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kyverno-policies
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/core/kyverno-policies/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/core/metallb-config/app/helm-release.yaml
+42
View File
@@ -0,0 +1,42 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metallb-config
namespace: metallb-config
spec:
interval: 15m
chart:
spec:
chart: metallb-config
version: 8.2.2
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
L2Advertisements:
- name: main
addressPools:
- main
ipAddressPools:
- name: main
autoAssign: false
avoidBuggyIPs: true
addresses:
- ${METALLB_RANGE}
clusters/main/kubernetes/core/metallb-config/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
clusters/main/kubernetes/core/metallb-config/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: metallb-config
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/core/metallb-config/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: metallb-config
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/core/metallb-config/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kubernetes.yaml
+52
View File
@@ -0,0 +1,52 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: kubernetes
namespace: system-upgrade
spec:
version: ${KUBERNETES_VERSION}
serviceAccountName: system-upgrade
secrets:
- name: talos
path: /var/run/secrets/talos.dev
ignoreUpdates: true
concurrency: 1
exclusive: true
nodeSelector:
matchExpressions:
- key: feature.node.kubernetes.io/system-os_release.ID
operator: In
values: ["talos"]
- key: node-role.kubernetes.io/control-plane
operator: Exists
- key: feature.node.kubernetes.io/system-os_release.VERSION_ID
operator: In
values: ["${TALOS_VERSION}"]
- key: kubernetes.io/hostname
operator: In
values: ["k8s-control-1"]
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
prepare: &prepare
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
envs:
- name: NODE_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
args:
- --nodes=$(NODE_IP)
- health
- --server=false
upgrade:
<<: *prepare
args:
- --nodes=$(NODE_IP)
- upgrade-k8s
- --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
# - schematics.yaml
- kubernetes.yaml
- talos.yaml
clusters/main/kubernetes/core/system-upgrade-controller-plans/app/talos.yaml
+53
View File
@@ -0,0 +1,53 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: talos
namespace: system-upgrade
spec:
version: ${TALOS_VERSION}
serviceAccountName: system-upgrade
secrets:
- name: talos
path: /var/run/secrets/talos.dev
ignoreUpdates: true
concurrency: 1
exclusive: true
nodeSelector:
matchExpressions:
- key: feature.node.kubernetes.io/system-os_release.ID
operator: In
values: ["talos"]
- key: feature.node.kubernetes.io/system-os_release.VERSION_ID
operator: NotIn
values: ["${TALOS_VERSION}"]
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
prepare: &prepare
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
envs:
- name: NODE_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
- name: SCHEMATIC
valueFrom:
fieldRef:
fieldPath: metadata.annotations['extensions.talos.dev/schematic']
args:
- --nodes=$(NODE_IP)
- health
- --server=false
upgrade:
<<: *prepare
args:
- --nodes=$(NODE_IP)
- upgrade
- --image=factory.talos.dev/installer/$(SCHEMATIC):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
- --preserve=true
- --wait=false
- --force
clusters/main/kubernetes/core/system-upgrade-controller-plans/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: system-upgrade-controller-plans
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/core/system-upgrade-controller-plans/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/flux-entry.yaml
+43
View File
@@ -0,0 +1,43 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-entry
namespace: flux-system
spec:
interval: 10m
path: ./clusters/main/kubernetes
prune: true
sourceRef:
kind: GitRepository
name: cluster
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-config
patches:
- patch: |-
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: not-used
spec:
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-config
- kind: ConfigMap
name: upgrade-settings
target:
group: kustomize.toolkit.fluxcd.io
kind: Kustomization
labelSelector: substitution.flux.home.arpa/disabled notin (true)
clusters/main/kubernetes/flux-system/flux/bootstrap.yaml.ct
+62
View File
@@ -0,0 +1,62 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- github.com/fluxcd/flux2/manifests/install?ref=v2.3.0
- ./deploykey.secret.yaml
- ./clustersettings.secret.yaml
patches:
# Remove the built-in network policies
- target:
group: networking.k8s.io
kind: NetworkPolicy
patch: |
$patch: delete
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: not-used
# Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
- target:
kind: ResourceQuota
name: critical-pods
patch: |
- op: replace
path: /metadata/name
value: critical-pods-flux-system
- target:
kind: ClusterRoleBinding
name: cluster-reconciler
patch: |
- op: replace
path: /metadata/name
value: cluster-reconciler-flux-system
- target:
kind: ClusterRoleBinding
name: crd-controller
patch: |
- op: replace
path: /metadata/name
value: crd-controller-flux-system
- target:
kind: ClusterRole
name: crd-controller
patch: |
- op: replace
path: /metadata/name
value: crd-controller-flux-system
- target:
kind: ClusterRole
name: flux-edit
patch: |
- op: replace
path: /metadata/name
value: flux-edit-flux-system
- target:
kind: ClusterRole
name: flux-view
patch: |
- op: replace
path: /metadata/name
value: flux-view-flux-system
clusters/main/kubernetes/flux-system/flux/clustersettings.secret.yaml
+51
View File
@@ -0,0 +1,51 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-config
namespace: flux-system
data:
#ENC[AES256_GCM,data:6niImlDSQviFNVT+wpv5whjt7ZguY+f54tf/PrF0hAfGkSMtDiIhCgr6Et/YAFISMl5T749cMpURqs8tV1zeVgk=,iv:NVFPacP85GuM8UmX6ZFrNRrmtKLVRCCo9EXOszcmJAY=,tag:UBCBIF+HQdRjK8tXWmbKcg==,type:comment]
#ENC[AES256_GCM,data:akDxDmJ6Cv9hl27tOna6FrweZuGDIAxcmKgaJw3U+3n+Ur7BB99NjTqX1ZM=,iv:l4vLnUDcZOIxO9U1Wyhd8JVZ9vkpvQorgXtayM3v9ME=,tag:VOmz6x1wlU/dggtcYK5xAw==,type:comment]
VIP: ENC[AES256_GCM,data:jbuffX6q+hSIdovsBts=,iv:sfi9HYiKKuVKvCkaVpTMD0/v05JwpjIKhTv8cohpvmo=,tag:uyrAdF3No00Ha40FqAyJlg==,type:str]
#ENC[AES256_GCM,data:5G6PwTJ6afWfXC2juUtWFxaPnbQv6hty+48D,iv:107g3C7zLAIMPnTl6E6a8876rEj3Ktx7F/LcVemGQCs=,tag:07aa6W3IiPm2nGyXtMJDNg==,type:comment]
#ENC[AES256_GCM,data:4NKPCDJWoGd6BzrwSqKrwwLRwgSh8YSwS3/g+bwoULUG6MH6XiHV4HQ7RhYyq2mKvgSSu4rrgco12TK489v+K6kNo9f5eqKk9iXjDepM/eHTV9xECBzkoA4=,iv:X6cYcGVyD0F3aH9Y2zFveVI0XZqz10/j8skua+FDjfg=,tag:2hgXM4ep1ypNDKtYRhTRcg==,type:comment]
MASTER1IP: ENC[AES256_GCM,data:9TqnldHD1QMT13aKLwI=,iv:SsOmDkDgRdZDUrFxXK9uM01mzdBab7ukv7/oirfqcGI=,tag:vO2BwNjDGqnsPIxDqQig7Q==,type:str]
#ENC[AES256_GCM,data:B6V8Ts98f3ODrIpwnkMio0sPy6HYowl091ENhsAiuy6uEQ==,iv:8IwF6gB8N2oCwJ7SVhHPC8qiqdUNkoXZGQBnjZsghrc=,tag:8XfkNXg5lz5GvRRl4V2fxA==,type:comment]
GATEWAY: ENC[AES256_GCM,data:dwRSmkaQ7Z8SlMns,iv:sQUNWkRj8DbtYAMkaJ065wor/vCqEUDtHkOi9H7ckbI=,tag:InqxnwFE/2nT71BCSwEoHQ==,type:str]
#ENC[AES256_GCM,data:S88nu3SeeGJjADqto4w0g3iUAcnlR8nf14CMuOJXhJQxXDr4JgznAF3fIEc9UPQ=,iv:eaizFGe4ID3Fp/5d+6uIyoWVpdBHOCD6CGL++k+bXdg=,tag:9pJ7F+XtX+zb92B7Af0Eyg==,type:comment]
METALLB_RANGE: ENC[AES256_GCM,data:iKzw4CwM//ML26rwXmLM9UR0fnKGj2N3rBEfqos=,iv:aC/kAd4uejXNd0G8o84XW9jN1hKWuuFcarq7F/9xcj8=,tag:lIur2oQjzuhKsZ+xz8Yraw==,type:str]
#ENC[AES256_GCM,data:WFPGMGFllHwO3vFsbeMEnyWY/oEwEn2jyLPwvvjKqaNtc9ebtG9cqqV3/zLLP2yYUtnGfmjmAmoQiBgTVOQOb+y6VUty1OQPA0v73xYtNM8=,iv:SJ4Y2RlrPNSMs8WG2VgWEO1kIyYLDs6HQlXsWl5VLqA=,tag:bCXqgHsKQb+MHUXDFngKog==,type:comment]
DASHBOARD_IP: ENC[AES256_GCM,data:8xnbx9Ia+va2jlZ+EgI=,iv:mPAhjRH6hYD4kH0HTBNUMqbznytodakRfVKXm5CQR0c=,tag:bpBWLEJpuQL2vvX6Fqdw9A==,type:str]
#ENC[AES256_GCM,data:Sk8XfYXVLw9gdg4ttflghvml9PtnR+WsGb4y1Xb9aXa47DBzTkzMbz/o9hSg5y3z528i8wUeCK4=,iv:CPzT3IpTCk1nTD03UuVQycZDyaDyHuN4mvzK7h7MhAM=,tag:fv56PV3Qwja1tVPEdA9q8A==,type:comment]
#ENC[AES256_GCM,data:7EzBlNF5OGXHSKGGZUyIsBXPznEgmIH/JQ==,iv:WncKNSiaVFBz+n1WwsGsINCo/CSUlc46WnWknPKLwoQ=,tag:P6ffhRSOI8gY0FvcKIJCMw==,type:comment]
#ENC[AES256_GCM,data:zETwKu0C/izvA/yac7NXzIh/hUBZ9O12uvhpEa/xLWQCw3HR83aFYxOeALK/4yio/YRBmW525laSbawBe7sJ8rYRMhbs+f/0/JorJ4A=,iv:L3yOFifUWMSe0djQbMD+cbjwPtDn/q7KuW7RABmUigY=,tag:QAMYNeUJML0omyrgt6m+IA==,type:comment]
GITHUB_REPOSITORY: ""
#ENC[AES256_GCM,data:ACa3nQrqwjGZmlK5flUrZGwXxfFBjEYSjh1Epkh6sUp+De6FYrDJdiXcoHFcRBzUPOABiiHp5dPZjSZsLuE8azje74epxNI=,iv:ADMSMkzvqDzUGVv2M3uSlD82MQi9Gi5KLrT1AkxYyvo=,tag:sr4zTcydQGobL7+Muj8WvQ==,type:comment]
#ENC[AES256_GCM,data:RJFxS5mGXqnxI5G0B/FcL5MxY/3CXv9CvpFZHNmiZBIOeTiX5OUZsE3eNSeD3ja6KShQXUWp,iv:2D9CEtn1zH3+Rdln/qz00as66009PYdEORi5kK4fW+A=,tag:aWqc/IX5kXUS60Zn02scGg==,type:comment]
#ENC[AES256_GCM,data:KbpFKs+ijAQy0q/OM1kTiAqxVrYqD9AbxkMsSjkWCIV6DLo=,iv:P1W1MU42pfl2NRQ5d5YQjVeed+VjXt2ggpY7V1aP2qk=,tag:haGA0I65BTdV9AgalqS5Kg==,type:comment]
#ENC[AES256_GCM,data:9nTD4v8T/VEDTHFsWWPf5ZO83SlOWbpkVnkCFt/Y6nyk2UVs/KI0,iv:txxfhJyprXgbVsYXhJfEo1X5qqzlSuMVjSNj1Mbl8WM=,tag:Yeal+o/LfjIjptsCo6IWLQ==,type:comment]
#ENC[AES256_GCM,data:V+d/Qs89lqeqjEeLeJc=,iv:oWskIshGu/GsOyhLTO58GhmokgFoRlq95RXxFWkY4x8=,tag:Am+I8CsmieIBomnrhEgtnA==,type:comment]
PODNET: ENC[AES256_GCM,data:ewO6HIksqTvSSV3Kqg==,iv:ypzdCZaqOG9hTktbjSDGhAjPGlhQx3CFPGC00CpHZ2U=,tag:/VQL28wnkmJyrsCcfNvohA==,type:str]
SVCNET: ENC[AES256_GCM,data:CpGlBxFc7KtvKP0w1g==,iv:MFTqQbuoHy2//wQORRecOyBmyOLtheePJpk+MftyNW0=,tag:mSzr04c2Tf6xD8wR0JIIzA==,type:str]
CLUSTERNAME: ENC[AES256_GCM,data:Zqa1ew==,iv:gbTl6h/YadrBoAvU8/sp8xQ1eEjbUPjl6QtRoccJja8=,tag:D4/nRuF6RyX4pJBOncZdqA==,type:str]
sops:
shamir_threshold: 3
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlM3owZ3F6WHhQWE96QzZH
VVJzQjhUc2dGRTNMNXhGdHBVSU9tb004RDJVCnNUT2pYY3hzSVVEVjg5R29PMnpI
ZnNtdjBZSXdML0FIZ2NUWXZQQmhwdUEKLS0tIDM3eXRkSmtXak9tT3g1NU92YzFI
bGxJMDA4WWppZm1uL2l5QkRXUDZFbjAKhhOuASw+0mTaN817fRlCaMGCdeAFezm9
FKHTVUHi03UXu6kwyZ3sa4x7V1Bw8hGroroL3Sp4BibrAwfYgGQxng==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-11-05T18:25:50Z"
mac: ENC[AES256_GCM,data:t+YlmYlUx9noaOr4id/+ZRmpkv2JR4I7jzdwm/p7UQLmByr11KgdakTQGhYY0mfqYZgGWzeQNeZVzjFoNFCIkSCJef7WdBeT7yzRRxscYovnlUZ0dBGTTuc1pWsYjDPc3kbHel7AdeDBB2l0qbMxD4At1r1UbvvOi0cdL/OoYFQ=,iv:RB3vdWiQcnywVxUGf+4jpP5t606akBnsf0REENzUF/U=,tag:aQGqxTgqrM7voYxnglqKGg==,type:str]
pgp: []
encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))
version: 3.9.1
clusters/main/kubernetes/flux-system/flux/deploykey.secret.yaml
+31
View File
@@ -0,0 +1,31 @@
apiVersion: v1
kind: Secret
metadata:
name: deploy-key
namespace: flux-system
stringData:
identity: ENC[AES256_GCM,data:a+OyM/CAfSbL82Ii8FFc0pnmOS339fjx0MY6TcS5hxnq/o6T/ZRT5wyuEdAizQh1fg57iQfK5M3JB5V64I7Vf2/eUd6gQFMMG9DBS6xpbIdlrAq5fg51zlrQ0GdcdwtBE0TMQx9RARvgFRCM0Ibl5To9ztM5Dg5DSdYwO967VY8HhNa7RYt4ta6A/fD5xgSytVS2iChNk7bPGv40QS4tjam1gjInh4eA8K0YsBdz2L2IVotmDp3rfDbkSlgafAowcnwm5yHY8zMJMEAKGGdPz7ZTAUB/npM1AqZ5Xea4pO1WsgvmhX7j5zGmbLm3POyDEfKU12GI3RetKqPr1HKA/dXe+y5yJAf9Ryt16hFM+yff8OerYNPYOzSu7XH5omir,iv:VW6/5kReBh0BZBRXqaOVGhsAPQX9Z2b80J/eUHi2dvk=,tag:DSBJ6JP4cEg5LjqGjc6GpQ==,type:str]
identity.pub: ENC[AES256_GCM,data:1lsFtoFsl94Bn51rG6ltUq2xKcSJ16C8g8DK+nwZ7/k5sfUxtEEuDve1EuxuUcPt7jt2OqF1rWiQ0FR1mNhj9PeBmyewlON5MinuMaZ0yTLsCdZC25cYJ+Dz6nB66ihPbq2cCi3VdURQLhPOgdFELXmJ1sdaYLllk5II5otXKVSyJe2N/QJ6oQzlPHwIzr63GrB/YGpFtMEOwzH2MmK0tn8boG9PJ/HpLFKU/Z3NGrbjU1wo+UiiLYRE5YdRMwiT5x29ot/iMd6adyop4A==,iv:zuCnmxG+eLeofXkI42mYS4QlUxKFPVvpQjKHJklr6z0=,tag:scJIB2ZK9i5fhGFvMgqfcA==,type:str]
known_hosts: ENC[AES256_GCM,data:RM4p4j4LMRjezS3V/GzU45LA7pH2+E5wv575f2SUSmyNb03zrq6Ll+6c1ez2h/6ik6NxgU7goLBKy1F/szdRVu/Cc3P7E2/u8qRgld6lGU+yNjifbc9yu5YQk9SXEduyALVMgk/A0o/1nFfJloTaVOCgOQ8/leucwAsqRoBGmaqms2Hs8fhlpNuKHzgQE7H26422y6OhkkFZzNSsN5hFdwDjiOXIz8U+FIHu,iv:FVEqEqPUk8dRrEReV8aaAhBJRNew+TYbH9uorleTkeU=,tag:R5iJuxOCOYXYG7J3gj6Ecg==,type:str]
type: Opaque
sops:
shamir_threshold: 3
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDc0M3bWpvOTI3WDY3UURT
amd1dnNGd2dyQjRSYXhIVUZhajdyNWNpYkNFCjNDU3dOTTJXNWtJVkEwOXh3bVg3
WVR0Z3VRdzlpamlGcTliRURmR0x4RmsKLS0tIHpmUk1MTjB0dXBOOGtsSE5zdFRq
QTRiNzhFQ0Q1MjNyMENNMzd4T29mdXcKUTurohm+cx2NJDwhAd03bfI8JGFdVNbx
eIamNTnvt/xEI8665fd2piuxe9BTljp8Jgxul+k/n4ZT1V4wnX2tJg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-11-05T18:25:50Z"
mac: ENC[AES256_GCM,data:TiLcKT3Khdne8sep2FqTYgm9zVMzQupJneUmzjPqz3M3W0/itiOQtlQvn/DzAZ1nIm36wzBZL80mZ+2Yj5SPAeJ3QE1NJH7FBJ3fUszKQNgzqWO95W2E0OYR+2BjOtkq7hUoq2jBY2ZeqSHYR+WX04b5X6+H1Vwt8cfHIwYONlU=,iv:wqQa+2gW3wpIN4PpVq0+ATwC9ExGYSeqDTD1AyBC+fA=,tag:UoaGeYkUkQGpaoR/A5RWPw==,type:str]
pgp: []
encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))
version: 3.9.1
clusters/main/kubernetes/flux-system/flux/flux.yaml
+87
View File
@@ -0,0 +1,87 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux
namespace: flux-system
spec:
interval: 10m
path: ./
prune: true
wait: true
sourceRef:
kind: OCIRepository
name: flux-manifests
patches:
# Remove the network policies that does not work with k3s
- patch: |
$patch: delete
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: not-used
target:
group: networking.k8s.io
kind: NetworkPolicy
# Increase the number of reconciliations that can be performed in parallel and bump the resources limits
# Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#increase-the-number-of-workers
- patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --concurrent=12
- op: add
path: /spec/template/spec/containers/0/args/-
value: --kube-api-qps=500
- op: add
path: /spec/template/spec/containers/0/args/-
value: --kube-api-burst=1000
- op: add
path: /spec/template/spec/containers/0/args/-
value: --requeue-dependency=5s
target:
kind: Deployment
name: (kustomize-controller|helm-controller|source-controller)
- patch: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: not-used
spec:
template:
spec:
containers:
- name: manager
resources:
limits:
memory: 2Gi
target:
kind: Deployment
name: (kustomize-controller|helm-controller|source-controller)
# Enable in-memory-kustomize builds
# Ref: https://fluxcd.io/flux/installation/configuration/vertical-scaling/#enable-in-memory-kustomize-builds
- patch: |
- op: replace
path: /spec/template/spec/volumes/0
value:
name: temp
emptyDir:
medium: Memory
target:
kind: Deployment
name: kustomize-controller
# Enable Helm near OOM detection
# Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#enable-helm-near-oom-detection
- patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --feature-gates=OOMWatch=true
- op: add
path: /spec/template/spec/containers/0/args/-
value: --oom-watch-memory-threshold=95
- op: add
path: /spec/template/spec/containers/0/args/-
value: --oom-watch-interval=500ms
target:
kind: Deployment
name: helm-controller
clusters/main/kubernetes/flux-system/flux/kustomization.yaml
+11
View File
@@ -0,0 +1,11 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./deploykey.secret.yaml
- ./clustersettings.secret.yaml
- ./flux.yaml
- ./upgradesettings.yaml
- ./namespace.yaml
# - sopssecret.secret.yaml
clusters/main/kubernetes/flux-system/flux/namespace.yaml
+8
View File
@@ -0,0 +1,8 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/flux-system/flux/upgradesettings.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: upgrade-settings
namespace: flux-system
data:
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
TALOS_VERSION: v1.8.2
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
KUBERNETES_VERSION: v1.31.2
clusters/main/kubernetes/flux-system/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- flux
clusters/main/kubernetes/kube-system/cilium/app/bootstrap-values.yaml.ct
+3
View File
@@ -0,0 +1,3 @@
## DO NOT ALTER THIS FILE, CHANGE DO NOT PERSIST. Alter clusterenv.yaml instead.
hubble:
enabled: false
clusters/main/kubernetes/kube-system/cilium/app/helm-release.yaml
+80
View File
@@ -0,0 +1,80 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
annotations:
meta.helm.sh/release-name: cilium
meta.helm.sh/release-namespace: kube-system
labels:
app.kubernetes.io/managed-by: Helm
spec:
interval: 15m
chart:
spec:
chart: cilium
version: 1.16.3
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
remediateLastFailure: true
uninstall:
keepHistory: false
values:
# autoDirectNodeRoutes: true
# routingMode: native
hubble:
enabled: false
cluster:
name: ${CLUSTERNAME}
id: 1
ipv4NativeRoutingCIDR: ${PODNET}
securityContext:
privileged: true
capabilities:
ciliumAgent:
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
cleanCiliumState:
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
cgroup:
automount:
enabled: false
hostRoot: /sys/fs/cgroup
enableRuntimeDeviceDetection: true
endpointRoutes:
enabled: true
ipam:
mode: kubernetes
k8sServiceHost: 127.0.0.1
k8sServicePort: 7445
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
localRedirectPolicy: true
operator:
rollOutPods: true
rollOutCiliumPods: true
clusters/main/kubernetes/kube-system/cilium/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/kube-system/cilium/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cilium
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/kube-system/cilium/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/kube-system/descheduler/app/helm-release.yaml
+68
View File
@@ -0,0 +1,68 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: descheduler
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: descheduler
version: 0.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
kind: Deployment
deschedulerPolicy:
strategies:
RemoveDuplicates:
enabled: true
RemovePodsViolatingNodeTaints:
enabled: true
RemovePodsViolatingNodeAffinity:
enabled: true
params:
nodeAffinityType:
- requiredDuringSchedulingIgnoredDuringExecution
RemovePodsViolatingTopologySpreadConstraint:
enabled: true
params:
includeSoftConstraints: true
RemovePodsViolatingInterPodAntiAffinity:
enabled: true
params:
nodeFit: true
LowNodeUtilization:
enabled: false
RemoveFailedPods:
enabled: true
params:
failedPods:
includingInitContainers: true
excludeOwnerKinds:
- Job
minPodLifetimeSeconds: 3600
RemovePodsHavingTooManyRestarts:
enabled: true
params:
podsHavingTooManyRestarts:
podRestartThreshold: 100
includingInitContainers: true
clusters/main/kubernetes/kube-system/descheduler/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/kube-system/descheduler/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: descheduler
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/kube-system/descheduler/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/bootstrap-values.yaml.ct
+3
View File
@@ -0,0 +1,3 @@
metrics:
main:
enabled: false
clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/helm-release.yaml
+18
View File
@@ -0,0 +1,18 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kubelet-csr-approver
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: kubelet-csr-approver
version: 1.1.2
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 30m
values: {}
clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/kube-system/kubelet-csr-approver/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubelet-csr-approver
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/kube-system/kubelet-csr-approver/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/kube-system/kustomization.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- cilium/ks.yaml
- descheduler/ks.yaml
- kubelet-csr-approver/ks.yaml
- metrics-server/ks.yaml
- node-feature-discovery/ks.yaml
clusters/main/kubernetes/kube-system/metrics-server/app/helm-release.yaml
+31
View File
@@ -0,0 +1,31 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metrics-server
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: metrics-server
version: 0.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
uninstall:
keepHistory: false
values:
clusters/main/kubernetes/kube-system/metrics-server/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/kube-system/metrics-server/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: metrics-server
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/kube-system/metrics-server/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/kube-system/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/kube-system/node-feature-discovery/app/helm-release.yaml
+34
View File
@@ -0,0 +1,34 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: node-feature-discovery
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: node-feature-discovery
version: 0.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
install:
crds: CreateReplace
remediation:
retries: 3
upgrade:
cleanupOnFail: true
crds: CreateReplace
remediation:
strategy: rollback
retries: 3
values:
worker:
config:
core:
sources: ["pci", "system", "usb"]
prometheus:
enable: true
clusters/main/kubernetes/kube-system/node-feature-discovery/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/kube-system/node-feature-discovery/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: node-feature-discovery
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/kube-system/node-feature-discovery/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/kustomization.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- apps
- core
- flux-entry.yaml
- flux-system
- kube-system
- system
clusters/main/kubernetes/system/cert-manager/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 5m
chart:
spec:
chart: cert-manager
version: 6.2.2
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
clusters/main/kubernetes/system/cert-manager/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/system/cert-manager/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cert-manager
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/cert-manager/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/cloudnative-pg/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cloudnative-pg
namespace: cloudnative-pg
spec:
interval: 5m
chart:
spec:
chart: cloudnative-pg
version: 8.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
clusters/main/kubernetes/system/cloudnative-pg/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/system/cloudnative-pg/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: cloudnative-pg
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/cloudnative-pg/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/kubernetes-reflector/app/helm-release.yaml
+31
View File
@@ -0,0 +1,31 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kubernetes-reflector
namespace: snapshot-controller
spec:
interval: 15m
chart:
spec:
chart: kubernetes-reflector
version: 6.2.1
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
clusters/main/kubernetes/system/kubernetes-reflector/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/system/kubernetes-reflector/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kubernetes-reflector
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/kubernetes-reflector/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/kustomization.yaml
+16
View File
@@ -0,0 +1,16 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cert-manager/ks.yaml
- cloudnative-pg/ks.yaml
- kubernetes-reflector/ks.yaml
- kyverno/ks.yaml
- longhorn/ks.yaml
- metallb/ks.yaml
- openebs/ks.yaml
- prometheus-operator/ks.yaml
- snapshot-controller/ks.yaml
- spegel/ks.yaml
- system-upgrade-controller/ks.yaml
- traefik-crds/ks.yaml
- volsync/ks.yaml
clusters/main/kubernetes/system/kyverno/app/helm-release.yaml
+198
View File
@@ -0,0 +1,198 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kyverno
namespace: kyverno
spec:
interval: 15m
chart:
spec:
chart: kyverno
version: 3.3.2
sourceRef:
kind: HelmRepository
name: kyverno
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
crds:
install: true
grafana:
enabled: true
annotations:
grafana_folder: System
backgroundController:
serviceMonitor:
enabled: true
rbac:
clusterRole:
extraResources:
- apiGroups:
- ""
resources:
- ingresses
- pods
- nodes
verbs:
- create
- update
- patch
- delete
- get
- list
cleanupController:
serviceMonitor:
enabled: true
reportsController:
serviceMonitor:
enabled: true
admissionController:
replicas: 3
serviceMonitor:
enabled: true
rbac:
clusterRole:
extraResources:
- apiGroups:
- ""
resources:
- ingresses
- pods
- nodes
verbs:
- get
- create
- update
- delete
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/instance: kyverno
app.kubernetes.io/component: kyverno
config:
# -- Resource types to be skipped by the Kyverno policy engine.
# Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list.
# These are joined together without spaces, run through `tpl`, and the result is set in the config map.
# @default -- See [values.yaml](values.yaml)
resourceFilters:
- '[Event,*,*]'
- '[*/*,kube-system,*]'
- '[*/*,kube-public,*]'
- '[*/*,kube-node-lease,*]'
- '[Node,*,*]'
- '[Node/*,*,*]'
- '[APIService,*,*]'
- '[APIService/*,*,*]'
- '[TokenReview,*,*]'
- '[SubjectAccessReview,*,*]'
- '[SelfSubjectAccessReview,*,*]'
- '[ReplicaSet,*,*]'
- '[ReplicaSet/*,*,*]'
# exclude resources from the chart
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
- '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
- '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
- '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
- '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
- '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
clusters/main/kubernetes/system/kyverno/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
- namespace.yaml
clusters/main/kubernetes/system/kyverno/app/namespace.yaml
+8
View File
@@ -0,0 +1,8 @@
apiVersion: v1
kind: Namespace
metadata:
name: kyverno
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
goldilocks.fairwinds.com/enabled: "true"
pod-security.kubernetes.io/enforce: privileged
clusters/main/kubernetes/system/kyverno/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kyverno
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/kyverno/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/longhorn/app/helm-release.yaml
+38
View File
@@ -0,0 +1,38 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: longhorn
namespace: longhorn-system
spec:
interval: 5m
releaseName: longhorn
chart:
spec:
chart: longhorn
version: 1.7.2
sourceRef:
kind: HelmRepository
name: longhorn
namespace: flux-system
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
defaultSettings:
# Increase to 3 for a multi-node cluster
defaultReplicaCount: 1
# Overprovisioning might be needed when using volsync
storageOverProvisioningPercentage: 100000
# v2DataEngine: true
persistence:
# Set to false to pick another CSI as default
defaultClass: true
# Increase to 3 for a multi-node cluster
defaultClassReplicaCount: 1
clusters/main/kubernetes/system/longhorn/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
- volumeSnapshotClass.yaml
clusters/main/kubernetes/system/longhorn/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: longhorn-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/system/longhorn/app/volumeSnapshotClass.yaml
+11
View File
@@ -0,0 +1,11 @@
---
kind: VolumeSnapshotClass
apiVersion: snapshot.storage.k8s.io/v1
metadata:
name: longhorn-snapshot-vsc
annotations:
snapshot.storage.kubernetes.io/is-default-class: 'true'
driver: driver.longhorn.io
deletionPolicy: Delete
parameters:
type: snap
clusters/main/kubernetes/system/longhorn/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: longhorn
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/longhorn/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/metallb/app/helm-release.yaml
+26
View File
@@ -0,0 +1,26 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metallb
namespace: metallb
spec:
interval: 5m
chart:
spec:
chart: metallb
version: 0.14.8
sourceRef:
kind: HelmRepository
name: metallb
namespace: flux-system
interval: 5m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
speaker:
ignoreExcludeLB: true
clusters/main/kubernetes/system/metallb/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
clusters/main/kubernetes/system/metallb/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: metallb
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/system/metallb/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: metallb
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/metallb/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/openebs/app/helm-release.yaml
+45
View File
@@ -0,0 +1,45 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: openebs
namespace: openebs
spec:
interval: 5m
releaseName: openebs
chart:
spec:
chart: openebs
version: 4.1.1
sourceRef:
kind: HelmRepository
name: openebs
namespace: flux-system
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
openebs-crds:
csi:
volumeSnapshots:
enabled: false
keep: false
engines:
local:
# The lvm-localpv backend contains a duplicate of snapshot controller which will cause conflicts
lvm:
enabled: false
# The ZFS backend contains a duplicate of snapshot controller which will cause conflicts
zfs:
enabled: false
replicated:
# The Mayastor backend contains a duplicate of snapshot controller which will cause conflicts
mayastor:
enabled: false
clusters/main/kubernetes/system/openebs/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
clusters/main/kubernetes/system/openebs/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: openebs
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/system/openebs/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: openebs
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/openebs/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/prometheus-operator/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: prometheus-operator
namespace: prometheus-operator
spec:
interval: 5m
chart:
spec:
chart: prometheus-operator
version: 8.8.2
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values: {}
clusters/main/kubernetes/system/prometheus-operator/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/system/prometheus-operator/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: prometheus-operator
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/prometheus-operator/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/snapshot-controller/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: snapshot-controller
namespace: snapshot-controller
spec:
interval: 5m
chart:
spec:
chart: snapshot-controller
version: 3.3.1
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
crds: CreateReplace
remediation:
strategy: rollback
retries: 3
values:
clusters/main/kubernetes/system/snapshot-controller/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/system/snapshot-controller/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: snapshot-controller
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/snapshot-controller/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/spegel/app/helm-release.yaml
+26
View File
@@ -0,0 +1,26 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: spegel
namespace: spegel
spec:
interval: 30m
chart:
spec:
chart: spegel
version: 2.0.7
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values: {}
clusters/main/kubernetes/system/spegel/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
clusters/main/kubernetes/system/spegel/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: spegel
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/system/spegel/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: spegel
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/spegel/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/system-upgrade-controller/app/helm-release.yaml
+102
View File
@@ -0,0 +1,102 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: system-upgrade-controller
namespace: system-upgrade
spec:
interval: 30m
chart:
spec:
chart: app-template
version: 3.5.1
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
controllers:
system-upgrade-controller:
strategy: RollingUpdate
containers:
app:
image:
repository: docker.io/rancher/system-upgrade-controller
tag: v0.14.1@sha256:7e13a9b2b984f0c0fd6328439b575348723cc6954b91db3453057fcb784e2d29
env:
SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.1
SYSTEM_UPGRADE_JOB_POD_REPLACEMENT_POLICY: Failed
SYSTEM_UPGRADE_JOB_PRIVILEGED: true
SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
SYSTEM_UPGRADE_CONTROLLER_NAME: system-update-controller
SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities: { drop: ["ALL"] }
seccompProfile:
type: RuntimeDefault
defaultPodOptions:
securityContext:
runAsNonRoot: true
runAsUser: 65534
runAsGroup: 65534
seccompProfile: { type: RuntimeDefault }
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
- key: node-role.kubernetes.io/master
operator: Exists
effect: NoSchedule
serviceAccount:
create: true
name: system-upgrade
persistence:
tmp:
type: emptyDir
etc-ssl:
type: hostPath
hostPath: /etc/ssl
hostPathType: DirectoryOrCreate
globalMounts:
- readOnly: true
etc-pki:
type: hostPath
hostPath: /etc/pki
hostPathType: DirectoryOrCreate
globalMounts:
- readOnly: true
etc-ca-certificates:
type: hostPath
hostPath: /etc/ca-certificates
hostPathType: DirectoryOrCreate
globalMounts:
- readOnly: true
clusters/main/kubernetes/system/system-upgrade-controller/app/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
- rbac.yaml
clusters/main/kubernetes/system/system-upgrade-controller/app/namespace.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
annotations:
volsync.backube/privileged-movers: "true"
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
goldilocks.fairwinds.com/enabled: "true"
pod-security.kubernetes.io/enforce: privileged
clusters/main/kubernetes/system/system-upgrade-controller/app/rbac.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system-upgrade
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: system-upgrade
namespace: system-upgrade
---
apiVersion: talos.dev/v1alpha1
kind: ServiceAccount
metadata:
name: talos
namespace: system-upgrade
spec:
roles:
- os:admin
clusters/main/kubernetes/system/system-upgrade-controller/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: system-upgrade-controller
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/system-upgrade-controller/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/traefik-crds/app/helm-release.yaml
+32
View File
@@ -0,0 +1,32 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: traefik-crds
namespace: system
spec:
interval: 15m
chart:
spec:
chart: traefik-crds
version: 3.2.3
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
driftDetection:
mode: warn
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values: {}
clusters/main/kubernetes/system/traefik-crds/app/kustomization.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
clusters/main/kubernetes/system/traefik-crds/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: traefik-crds
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/traefik-crds/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/kubernetes/system/volsync/app/helm-release.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: volsync
namespace: volsync
spec:
interval: 5m
chart:
spec:
chart: volsync
version: 2.4.1
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
clusters/main/kubernetes/system/volsync/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
clusters/main/kubernetes/system/volsync/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: volsync
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clusters/main/kubernetes/system/volsync/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: volsync
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/volsync/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clusters/main/talos/generated/.gitignore
+2
View File
@@ -0,0 +1,2 @@
main-k8s-control-1.yaml
talosconfig

Some files were not shown because too many files have changed in this diff Show More