commit 21a45f1d098759d2105bfa05b82652da156ba8e7 Author: Wendell Jones Date: Tue May 13 08:49:46 2025 -0400 repo migration diff --git a/README.md b/README.md new file mode 100644 index 0000000..ca8c50b --- /dev/null +++ b/README.md @@ -0,0 +1,93 @@ +# clustertool + + + +## Getting started + +To make it easy for you to get started with GitLab, here's a list of recommended next steps. + +Already a pro? Just edit this README.md and make it your own. Want to make it easy? [Use the template at the bottom](#editing-this-readme)! + +## Add your files + +- [ ] [Create](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#create-a-file) or [upload](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#upload-a-file) files +- [ ] [Add files using the command line](https://docs.gitlab.com/ee/gitlab-basics/add-file.html#add-a-file-using-the-command-line) or push an existing Git repository with the following command: + +``` +cd existing_repo +git remote add origin https://gitlab.wpjones.com/wjones/clustertool.git +git branch -M main +git push -uf origin main +``` + +## Integrate with your tools + +- [ ] [Set up project integrations](https://gitlab.wpjones.com/wjones/clustertool/-/settings/integrations) + +## Collaborate with your team + +- [ ] [Invite team members and collaborators](https://docs.gitlab.com/ee/user/project/members/) +- [ ] [Create a new merge request](https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html) +- [ ] [Automatically close issues from merge requests](https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#closing-issues-automatically) +- [ ] [Enable merge request approvals](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/) +- [ ] [Set auto-merge](https://docs.gitlab.com/ee/user/project/merge_requests/merge_when_pipeline_succeeds.html) + +## Test and Deploy + +Use the built-in continuous integration in GitLab. + +- [ ] [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/index.html) +- [ ] [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/) +- [ ] [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html) +- [ ] [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/) +- [ ] [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html) + +*** + +# Editing this README + +When you're ready to make this README your own, just edit this file and use the handy template below (or feel free to structure it however you want - this is just a starting point!). Thanks to [makeareadme.com](https://www.makeareadme.com/) for this template. + +## Suggestions for a good README + +Every project is different, so consider which of these sections apply to yours. The sections used in the template are suggestions for most open source projects. Also keep in mind that while a README can be too long and detailed, too long is better than too short. If you think your README is too long, consider utilizing another form of documentation rather than cutting out information. + +## Name +Choose a self-explaining name for your project. + +## Description +Let people know what your project can do specifically. Provide context and add a link to any reference visitors might be unfamiliar with. A list of Features or a Background subsection can also be added here. If there are alternatives to your project, this is a good place to list differentiating factors. + +## Badges +On some READMEs, you may see small images that convey metadata, such as whether or not all the tests are passing for the project. You can use Shields to add some to your README. Many services also have instructions for adding a badge. + +## Visuals +Depending on what you are making, it can be a good idea to include screenshots or even a video (you'll frequently see GIFs rather than actual videos). Tools like ttygif can help, but check out Asciinema for a more sophisticated method. + +## Installation +Within a particular ecosystem, there may be a common way of installing things, such as using Yarn, NuGet, or Homebrew. However, consider the possibility that whoever is reading your README is a novice and would like more guidance. Listing specific steps helps remove ambiguity and gets people to using your project as quickly as possible. If it only runs in a specific context like a particular programming language version or operating system or has dependencies that have to be installed manually, also add a Requirements subsection. + +## Usage +Use examples liberally, and show the expected output if you can. It's helpful to have inline the smallest example of usage that you can demonstrate, while providing links to more sophisticated examples if they are too long to reasonably include in the README. + +## Support +Tell people where they can go to for help. It can be any combination of an issue tracker, a chat room, an email address, etc. + +## Roadmap +If you have ideas for releases in the future, it is a good idea to list them in the README. + +## Contributing +State if you are open to contributions and what your requirements are for accepting them. + +For people who want to make changes to your project, it's helpful to have some documentation on how to get started. Perhaps there is a script that they should run or some environment variables that they need to set. Make these steps explicit. These instructions could also be useful to your future self. + +You can also document commands to lint the code or run tests. These steps help to ensure high code quality and reduce the likelihood that the changes inadvertently break something. Having instructions for running tests is especially helpful if it requires external setup, such as starting a Selenium server for testing in a browser. + +## Authors and acknowledgment +Show your appreciation to those who have contributed to the project. + +## License +For open source projects, say how it is licensed. + +## Project status +If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers. diff --git a/clusters/main/.gitignore b/clusters/main/.gitignore new file mode 100644 index 0000000..e0cb75b --- /dev/null +++ b/clusters/main/.gitignore @@ -0,0 +1,15 @@ +talconfig.json +clusterconfig +patches/all.yaml +patches/controlplane.yaml +patches/worker.yaml +*patches/all.yaml +*patches/controlplane.yaml +*patches/worker.yaml +all.yaml +controlplane.yaml +worker.yaml +*sopssecret.secret.yaml +sopssecret.secret.yaml +cluster/main/kubernetes/**/bootstrap-values.yaml.ct +*kubeconfig \ No newline at end of file diff --git a/clusters/main/clusterenv.yaml b/clusters/main/clusterenv.yaml new file mode 100644 index 0000000..3e58d52 --- /dev/null +++ b/clusters/main/clusterenv.yaml @@ -0,0 +1,43 @@ +#ENC[AES256_GCM,data:ivlK3YpKOUqjcg9WZBhyONqJSMxwYu1G46U6LbJ9jbgD/omtZy5Ucin/6Vh+2r9980rJ4zomOC2BJ2kQ9+sDdN0=,iv:FnA29cUcvbixPFwiJkDnC0+BxXeOYY0kC8gJKkBYfD0=,tag:UGXMkl7lRqaMPlLbp6DWmQ==,type:comment] +#ENC[AES256_GCM,data:Bppx2CNz0EZragTJPWXZqfhe13ryCa7Er4+TPprZMEOgexWm/8ooXj2WFR8=,iv:Fq5+IxGM/sQkSjWkU6+737MlzFkqRzxV4RvCceQ09i8=,tag:BTFZ5QxaB0Ykhq++IC3D7A==,type:comment] +VIP: ENC[AES256_GCM,data:Uv98AXTJXy1On6bWG84=,iv:lx4hIP4qUcf74f3/iFccbVqwyRuwYttS6pCP+rFuX2Q=,tag:/oAq2l1A4JrB5bFpbhsldw==,type:str] +#ENC[AES256_GCM,data:7L6tWYFr5k4SIsJramEgXk1gMAKlrF2oT/YD,iv:8bt5i4S1q2v4ji8Fi62ZgMxKrxJp7Tuu/KxglNADdzU=,tag:PRQ/cfqxhCosTYCjKmmJAw==,type:comment] +#ENC[AES256_GCM,data:NSONj2MFQiwmi5/dTH6uXDLAS2T2GUEigzXgV+HYDWg0XJJy5nMyOnZDpy7a1Mc+FYKSALfSL3uqqVdmhhXQSJSbgmTPHAwBydbdODzwjK8f2VC2up8Ub88=,iv:ZrphGBtpT0T5ovdQfhVGCXL27SZJ3tdzbTWpD3WL7c4=,tag:Br7GAul9iu/hPOkNFub+pw==,type:comment] +MASTER1IP: ENC[AES256_GCM,data:E7MiHC/0BIcGg1m0a1g=,iv:rtSW16TRZ2Y0Um6ynpljTQFpNp5mO+PxdR5/xtFt5hs=,tag:f9cdE2zGGNmIlXQw0w6K0A==,type:str] +#ENC[AES256_GCM,data:pXAeQ708XL5X038epItt+vKfFfNmzXdZcRARfuNTY4hf0g==,iv:IefEzb6+pgvr3wQuw4JR0QWszALCMV9zM/mksuvfDDw=,tag:bmCyNhzxPEAjyULtxuWagQ==,type:comment] +GATEWAY: ENC[AES256_GCM,data:jo99rvL/2mZr1QmW,iv:/klNo9RcxOAIaTdfxOB4ECncqkqRYsTOUwFcUOlKPPA=,tag:/bUW/liFM2526SwQL5OPaA==,type:str] +#ENC[AES256_GCM,data:SQ+c5x0ttyXjb2OEKzapI4D7dDHs6o7UX1hE1XL62kRPOJy90QbrYXDg6XmRNCY=,iv:WT47h4mJXOFxH+dUUtJq1SYn9Escu9eWpPKgG9VFKxU=,tag:hmP0Lene9tpzFxAmmFybIw==,type:comment] +METALLB_RANGE: ENC[AES256_GCM,data:KOCmXROWGo5FORcJ9yUMFHCYYeBLJgyk6RpICbE=,iv:L+JXilO0WCjwOZm+c1xWzDfljvaW8kEirQ7HYb8vYMs=,tag:TpIdpLTfZapTs2zxYcVpNA==,type:str] +#ENC[AES256_GCM,data:MET5IzgvYtaCkYKSeEK2Ury8yBEMEoLioD71cUpkvBA/uxf7yDAYa0bKfn0K7E+kRPTnHkx1XMXl4hcwA7Z1eTXhOVuzYENjBHDVPOkDhe4=,iv:LgE01YlqS0fsLpXjniPOzn79SXElbXbqEAVmaV2XwX8=,tag:YVvpwYxW+pIPWul//EoaZg==,type:comment] +DASHBOARD_IP: ENC[AES256_GCM,data:XP5XyqUH69BYbrMvn3c=,iv:lnGNGmTYIAcTkatwoTuj7JlPdZpS4np7g+heMZzjU2Q=,tag:Z2cZphwUpm/nrfZZ42qlTA==,type:str] +#ENC[AES256_GCM,data:+AenhvLAoSl1L55niyNp9X9BsAQN2NhSRmyA83uMe5tymNH8B4AZKpjXTDXyARoH3fwIR5EHWW8=,iv:iWAWt1Rsr5/eJ0phPw1z/5yv3mBoLbCED0qilxlKaf0=,tag:WFhPlyXF2o5Mu+4AsSWjeQ==,type:comment] +#ENC[AES256_GCM,data:uz0Nzd6XawwKY7J8UNxCWh7nZ9hFwhswow==,iv:l3Y8jyHx6YxQgE0OTQDtHX9cSpud2nqci6bxy1qGZr4=,tag:SdARU5q0vYbymnpl04RsTQ==,type:comment] +#ENC[AES256_GCM,data:b5AFePED60sjR300CX6DQoKLneb9YWDT9Q7qW5woAg6yqWyfZOYY6QbtxCx3T4zYksHRn8vUkcJ0ASZSNQOf9swGFVW0xl+o7i3fclQ=,iv:+tguqQ69hAB+NNNnKfex+RmZNSntxcEhU+dUGmvn4m0=,tag:FD/gG3zgdIdFNXJtH+X5mA==,type:comment] +GITHUB_REPOSITORY: "" +#ENC[AES256_GCM,data:V75/HDxAPDmk+Z4lOee8nBwjRTmizrOE+s2Xlg16k47GclREPlYZ/622Ccm2TTs+QFgQZtnXF44qjckgaiTWKseIeGyNJmw=,iv:24vvye0kwWfTyL6G4I4bUn433Xvg07c85VSWf2UdpYo=,tag:dP7kjyfvusmLUKeQxSku1Q==,type:comment] +#ENC[AES256_GCM,data:6Z2muYxNZ3T8khpSCQ9KGwbNG4KmMFp+5MikXwii/anULJ0GAsDHj3bNq08YuA6oTX3rItuq,iv:xXrsqPXoxibPPhFnRwyYdJyUi3JLNbW/n/rkOD2TKQc=,tag:3GwrxTkcfGrg9YfMujmOGA==,type:comment] +#ENC[AES256_GCM,data:8qIATB8dT/lar5TRnvX/RXjr2OpjaXIOa0vdCxb/MFay9+Y=,iv:darE3gv5X7LlG43gP4ZSrN4MQAi43OUYicZ6kI2SNCE=,tag:9KQzt412IqnqEthF7kvDqg==,type:comment] +#ENC[AES256_GCM,data:N3E5+UhvkdKOSWxSNlwb1CGMsHRY+PzNQMNuR+AXfk3qaj+N2oid,iv:MUXmT25hGIkqYkUyIilthR0+E+0J4dGmYTZVudDxpQg=,tag:gLZ6LKzhNvR/Z6QvQXbGuw==,type:comment] +#ENC[AES256_GCM,data:UPZOh94uHTQ6O8ypX78=,iv:NBLUXe3ZzSUJuix+1y/qdflEI/cLx4CNO6uiRfouzyI=,tag:T6NkesW3tZTTNqrN2yCd9g==,type:comment] +PODNET: ENC[AES256_GCM,data:6bhhVR+yZ4HV3wf5Zg==,iv:GN13FZVqzOWfIa6FWqSb9ti3cm5dduwpW5XAJjs+hnc=,tag:DJtGCpIscYs40l3kOIgcrw==,type:str] +SVCNET: ENC[AES256_GCM,data:+Aw9NaKtqw48ardNKg==,iv:F0I8wPiMkb4TCmMqgmr6mNEJufZoy2p+v08pHTBNS9Y=,tag:5aq1bExpYCyt7uQn0oD40g==,type:str] +sops: + shamir_threshold: 3 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNTXRyWjl5QVE5M2hxNHVS + UWRGRkFFNHdZcDNVb1lyWWdkOWE5UW5pL0RvCmFOZlZDV3BERmZkVnBud25YVjJ3 + bDNySGhScjN6bHp4Mit3UFZPSit4VzAKLS0tIEtrcUNNM3B1aldLMStXSCtZUEhx + WWt1c052cjE4RzJIZ1NRbDFzTHpWN1kKRCMjS4EVveIsE9so1pJpZgeM5Ub/8rQj + WPz2XvrIpL7h+WY88JAP8JPDk3dIfYu41ZrmjykwLwpIAY4AJCGSRw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-05T18:25:50Z" + mac: ENC[AES256_GCM,data:FHqoHJ2/jG5AY63yxHM8yx6QcriMHwahF150xHAzPIVcZmYml7mB27b+pH1jMtdWK7t3JLtl3ZPRszrBm1NGqXW4FDwlJdpfgnQjRp434KUoENjWgzH/C6L8voLWqZS8HiJ86PpKaxp5s/V+BhjSv4eNkF7iZVNpGueF64b14LM=,iv:rN362UoGmejMWRm4a5ph40S0eMx6pf0Ocg3EfMJD8+g=,tag:yS9YrRhCTHVI5vW5yzn6Ew==,type:str] + pgp: [] + version: 3.9.1 diff --git a/clusters/main/kubernetes/apps/kubernetes-dashboard/app/helm-release.yaml b/clusters/main/kubernetes/apps/kubernetes-dashboard/app/helm-release.yaml new file mode 100644 index 0000000..9960f03 --- /dev/null +++ b/clusters/main/kubernetes/apps/kubernetes-dashboard/app/helm-release.yaml @@ -0,0 +1,39 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kubernetes-dashboard + namespace: kubernetes-dashboard +spec: + interval: 15m + chart: + spec: + chart: kubernetes-dashboard + version: 1.10.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + service: + main: + type: LoadBalancer + loadBalancerIP: ${DASHBOARD_IP} + ports: + main: + port: 80 diff --git a/clusters/main/kubernetes/apps/kubernetes-dashboard/app/kustomization.yaml b/clusters/main/kubernetes/apps/kubernetes-dashboard/app/kustomization.yaml new file mode 100644 index 0000000..8712859 --- /dev/null +++ b/clusters/main/kubernetes/apps/kubernetes-dashboard/app/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/apps/kubernetes-dashboard/app/namespace.yaml b/clusters/main/kubernetes/apps/kubernetes-dashboard/app/namespace.yaml new file mode 100644 index 0000000..997c30f --- /dev/null +++ b/clusters/main/kubernetes/apps/kubernetes-dashboard/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: kubernetes-dashboard + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/apps/kubernetes-dashboard/ks.yaml b/clusters/main/kubernetes/apps/kubernetes-dashboard/ks.yaml new file mode 100644 index 0000000..aeb95a9 --- /dev/null +++ b/clusters/main/kubernetes/apps/kubernetes-dashboard/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: kubernetes-dashboard + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/apps/kubernetes-dashboard/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/apps/kustomization.yaml b/clusters/main/kubernetes/apps/kustomization.yaml new file mode 100644 index 0000000..414f407 --- /dev/null +++ b/clusters/main/kubernetes/apps/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - kubernetes-dashboard/ks.yaml diff --git a/clusters/main/kubernetes/core/kustomization.yaml b/clusters/main/kubernetes/core/kustomization.yaml new file mode 100644 index 0000000..cb0eed2 --- /dev/null +++ b/clusters/main/kubernetes/core/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - kyverno-policies/ks.yaml + - metallb-config/ks.yaml + - system-upgrade-controller-plans/ks.yaml diff --git a/clusters/main/kubernetes/core/kyverno-policies/app/ensure-digest.yaml b/clusters/main/kubernetes/core/kyverno-policies/app/ensure-digest.yaml new file mode 100644 index 0000000..561254b --- /dev/null +++ b/clusters/main/kubernetes/core/kyverno-policies/app/ensure-digest.yaml @@ -0,0 +1,53 @@ +## This Can be enabled in the kustomization.yaml file. +## Please note not every chart or application is compatible with this behavior +## Primarily operators spinning their own pods, might include conflicting validation +## Add manual exclusions where needed +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: resolve-image-to-digest + annotations: + policies.kyverno.io/title: Resolve Image to Digest + policies.kyverno.io/category: Other + policies.kyverno.io/severity: medium + kyverno.io/kyverno-version: 1.6.0 + policies.kyverno.io/minversion: 1.6.0 + kyverno.io/kubernetes-version: "1.23" + policies.kyverno.io/subject: Pod + policies.kyverno.io/description: >- + Image tags are mutable and the change of an image can result in the same tag. + This policy resolves the image digest of each image in a container and replaces + the image with the fully resolved reference which includes the digest rather than tag. +spec: + background: false + rules: + - name: resolve-to-digest + match: + any: + - resources: + kinds: + - Pod + exclude: + any: + - resources: + kinds: + - Pod + name: '*cnpg*' + preconditions: + all: + - key: "{{request.operation || 'BACKGROUND'}}" + operator: NotEquals + value: DELETE + mutate: + foreach: + - list: "request.object.spec.containers" + context: + - name: resolvedRef + imageRegistry: + reference: "{{ element.image }}" + jmesPath: "resolvedImage" + patchStrategicMerge: + spec: + containers: + - name: "{{ element.name }}" + image: "{{ resolvedRef }}" diff --git a/clusters/main/kubernetes/core/kyverno-policies/app/kustomization.yaml b/clusters/main/kubernetes/core/kyverno-policies/app/kustomization.yaml new file mode 100644 index 0000000..65e2b0c --- /dev/null +++ b/clusters/main/kubernetes/core/kyverno-policies/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - schematic-to-pod.yaml + # - ensure-digest.yaml diff --git a/clusters/main/kubernetes/core/kyverno-policies/app/schematic-to-pod.yaml b/clusters/main/kubernetes/core/kyverno-policies/app/schematic-to-pod.yaml new file mode 100644 index 0000000..0b511b3 --- /dev/null +++ b/clusters/main/kubernetes/core/kyverno-policies/app/schematic-to-pod.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: kyverno.io/v2beta1 +kind: ClusterPolicy +metadata: + name: mutate-pod-binding + annotations: + pod-policies.kyverno.io/autogen-controllers: none + policies.kyverno.io/title: Mutate Pod Add Schematic + policies.kyverno.io/category: Other + policies.kyverno.io/subject: Pod + kyverno.io/kyverno-version: 1.10.0 + policies.kyverno.io/minversion: 1.10.0 + kyverno.io/kubernetes-version: "1.30" +spec: + background: false + rules: + - name: project-foo + match: + any: + - resources: + kinds: + - Pod/binding + names: + - apply-talos* + context: + - name: node + variable: + jmesPath: request.object.target.name + default: '' + - name: schematic + apiCall: + urlPath: "/api/v1/nodes/{{node}}" + jmesPath: "metadata.annotations.\"extensions.talos.dev/schematic\" || 'empty'" + mutate: + patchStrategicMerge: + metadata: + annotations: + extensions.talos.dev/schematic: "{{ schematic }}" diff --git a/clusters/main/kubernetes/core/kyverno-policies/ks.yaml b/clusters/main/kubernetes/core/kyverno-policies/ks.yaml new file mode 100644 index 0000000..21ca3d2 --- /dev/null +++ b/clusters/main/kubernetes/core/kyverno-policies/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: kyverno-policies + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/core/kyverno-policies/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/core/metallb-config/app/helm-release.yaml b/clusters/main/kubernetes/core/metallb-config/app/helm-release.yaml new file mode 100644 index 0000000..e1d7c94 --- /dev/null +++ b/clusters/main/kubernetes/core/metallb-config/app/helm-release.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: metallb-config + namespace: metallb-config +spec: + interval: 15m + chart: + spec: + chart: metallb-config + version: 8.2.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + L2Advertisements: + - name: main + addressPools: + - main + ipAddressPools: + - name: main + autoAssign: false + avoidBuggyIPs: true + addresses: + - ${METALLB_RANGE} diff --git a/clusters/main/kubernetes/core/metallb-config/app/kustomization.yaml b/clusters/main/kubernetes/core/metallb-config/app/kustomization.yaml new file mode 100644 index 0000000..8712859 --- /dev/null +++ b/clusters/main/kubernetes/core/metallb-config/app/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/core/metallb-config/app/namespace.yaml b/clusters/main/kubernetes/core/metallb-config/app/namespace.yaml new file mode 100644 index 0000000..6329a91 --- /dev/null +++ b/clusters/main/kubernetes/core/metallb-config/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: metallb-config + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/core/metallb-config/ks.yaml b/clusters/main/kubernetes/core/metallb-config/ks.yaml new file mode 100644 index 0000000..608cd28 --- /dev/null +++ b/clusters/main/kubernetes/core/metallb-config/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: metallb-config + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/core/metallb-config/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kubernetes.yaml b/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kubernetes.yaml new file mode 100644 index 0000000..f83b89e --- /dev/null +++ b/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kubernetes.yaml @@ -0,0 +1,52 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: kubernetes + namespace: system-upgrade +spec: + version: ${KUBERNETES_VERSION} + serviceAccountName: system-upgrade + secrets: + - name: talos + path: /var/run/secrets/talos.dev + ignoreUpdates: true + concurrency: 1 + exclusive: true + nodeSelector: + matchExpressions: + - key: feature.node.kubernetes.io/system-os_release.ID + operator: In + values: ["talos"] + - key: node-role.kubernetes.io/control-plane + operator: Exists + - key: feature.node.kubernetes.io/system-os_release.VERSION_ID + operator: In + values: ["${TALOS_VERSION}"] + - key: kubernetes.io/hostname + operator: In + values: ["k8s-control-1"] + tolerations: + - key: CriticalAddonsOnly + operator: Exists + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule + prepare: &prepare + image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION} + envs: + - name: NODE_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + args: + - --nodes=$(NODE_IP) + - health + - --server=false + upgrade: + <<: *prepare + args: + - --nodes=$(NODE_IP) + - upgrade-k8s + - --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION) diff --git a/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kustomization.yaml b/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kustomization.yaml new file mode 100644 index 0000000..76b5090 --- /dev/null +++ b/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/kustomization.yaml @@ -0,0 +1,8 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # - schematics.yaml + - kubernetes.yaml + - talos.yaml diff --git a/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/talos.yaml b/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/talos.yaml new file mode 100644 index 0000000..5cd2f22 --- /dev/null +++ b/clusters/main/kubernetes/core/system-upgrade-controller-plans/app/talos.yaml @@ -0,0 +1,53 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json +apiVersion: upgrade.cattle.io/v1 +kind: Plan +metadata: + name: talos + namespace: system-upgrade +spec: + version: ${TALOS_VERSION} + serviceAccountName: system-upgrade + secrets: + - name: talos + path: /var/run/secrets/talos.dev + ignoreUpdates: true + concurrency: 1 + exclusive: true + nodeSelector: + matchExpressions: + - key: feature.node.kubernetes.io/system-os_release.ID + operator: In + values: ["talos"] + - key: feature.node.kubernetes.io/system-os_release.VERSION_ID + operator: NotIn + values: ["${TALOS_VERSION}"] + tolerations: + - key: CriticalAddonsOnly + operator: Exists + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule + prepare: &prepare + image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION} + envs: + - name: NODE_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: SCHEMATIC + valueFrom: + fieldRef: + fieldPath: metadata.annotations['extensions.talos.dev/schematic'] + args: + - --nodes=$(NODE_IP) + - health + - --server=false + upgrade: + <<: *prepare + args: + - --nodes=$(NODE_IP) + - upgrade + - --image=factory.talos.dev/installer/$(SCHEMATIC):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION) + - --preserve=true + - --wait=false + - --force diff --git a/clusters/main/kubernetes/core/system-upgrade-controller-plans/ks.yaml b/clusters/main/kubernetes/core/system-upgrade-controller-plans/ks.yaml new file mode 100644 index 0000000..9d43546 --- /dev/null +++ b/clusters/main/kubernetes/core/system-upgrade-controller-plans/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: system-upgrade-controller-plans + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/core/system-upgrade-controller-plans/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/flux-entry.yaml b/clusters/main/kubernetes/flux-entry.yaml new file mode 100644 index 0000000..02ce8ee --- /dev/null +++ b/clusters/main/kubernetes/flux-entry.yaml @@ -0,0 +1,43 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-entry + namespace: flux-system +spec: + interval: 10m + path: ./clusters/main/kubernetes + prune: true + sourceRef: + kind: GitRepository + name: cluster + decryption: + provider: sops + secretRef: + name: sops-age + postBuild: + substituteFrom: + - kind: ConfigMap + name: cluster-config + patches: + - patch: |- + apiVersion: kustomize.toolkit.fluxcd.io/v1 + kind: Kustomization + metadata: + name: not-used + spec: + decryption: + provider: sops + secretRef: + name: sops-age + postBuild: + substituteFrom: + - kind: ConfigMap + name: cluster-config + - kind: ConfigMap + name: upgrade-settings + target: + group: kustomize.toolkit.fluxcd.io + kind: Kustomization + labelSelector: substitution.flux.home.arpa/disabled notin (true) diff --git a/clusters/main/kubernetes/flux-system/flux/bootstrap.yaml.ct b/clusters/main/kubernetes/flux-system/flux/bootstrap.yaml.ct new file mode 100644 index 0000000..2d7d9a0 --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/bootstrap.yaml.ct @@ -0,0 +1,62 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - github.com/fluxcd/flux2/manifests/install?ref=v2.3.0 + - ./deploykey.secret.yaml + - ./clustersettings.secret.yaml +patches: + # Remove the built-in network policies + - target: + group: networking.k8s.io + kind: NetworkPolicy + patch: | + $patch: delete + apiVersion: networking.k8s.io/v1 + kind: NetworkPolicy + metadata: + name: not-used + # Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests + - target: + kind: ResourceQuota + name: critical-pods + patch: | + - op: replace + path: /metadata/name + value: critical-pods-flux-system + - target: + kind: ClusterRoleBinding + name: cluster-reconciler + patch: | + - op: replace + path: /metadata/name + value: cluster-reconciler-flux-system + - target: + kind: ClusterRoleBinding + name: crd-controller + patch: | + - op: replace + path: /metadata/name + value: crd-controller-flux-system + - target: + kind: ClusterRole + name: crd-controller + patch: | + - op: replace + path: /metadata/name + value: crd-controller-flux-system + - target: + kind: ClusterRole + name: flux-edit + patch: | + - op: replace + path: /metadata/name + value: flux-edit-flux-system + - target: + kind: ClusterRole + name: flux-view + patch: | + - op: replace + path: /metadata/name + value: flux-view-flux-system diff --git a/clusters/main/kubernetes/flux-system/flux/clustersettings.secret.yaml b/clusters/main/kubernetes/flux-system/flux/clustersettings.secret.yaml new file mode 100644 index 0000000..f3a5d8d --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/clustersettings.secret.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-config + namespace: flux-system +data: + #ENC[AES256_GCM,data:6niImlDSQviFNVT+wpv5whjt7ZguY+f54tf/PrF0hAfGkSMtDiIhCgr6Et/YAFISMl5T749cMpURqs8tV1zeVgk=,iv:NVFPacP85GuM8UmX6ZFrNRrmtKLVRCCo9EXOszcmJAY=,tag:UBCBIF+HQdRjK8tXWmbKcg==,type:comment] + #ENC[AES256_GCM,data:akDxDmJ6Cv9hl27tOna6FrweZuGDIAxcmKgaJw3U+3n+Ur7BB99NjTqX1ZM=,iv:l4vLnUDcZOIxO9U1Wyhd8JVZ9vkpvQorgXtayM3v9ME=,tag:VOmz6x1wlU/dggtcYK5xAw==,type:comment] + VIP: ENC[AES256_GCM,data:jbuffX6q+hSIdovsBts=,iv:sfi9HYiKKuVKvCkaVpTMD0/v05JwpjIKhTv8cohpvmo=,tag:uyrAdF3No00Ha40FqAyJlg==,type:str] + #ENC[AES256_GCM,data:5G6PwTJ6afWfXC2juUtWFxaPnbQv6hty+48D,iv:107g3C7zLAIMPnTl6E6a8876rEj3Ktx7F/LcVemGQCs=,tag:07aa6W3IiPm2nGyXtMJDNg==,type:comment] + #ENC[AES256_GCM,data:4NKPCDJWoGd6BzrwSqKrwwLRwgSh8YSwS3/g+bwoULUG6MH6XiHV4HQ7RhYyq2mKvgSSu4rrgco12TK489v+K6kNo9f5eqKk9iXjDepM/eHTV9xECBzkoA4=,iv:X6cYcGVyD0F3aH9Y2zFveVI0XZqz10/j8skua+FDjfg=,tag:2hgXM4ep1ypNDKtYRhTRcg==,type:comment] + MASTER1IP: ENC[AES256_GCM,data:9TqnldHD1QMT13aKLwI=,iv:SsOmDkDgRdZDUrFxXK9uM01mzdBab7ukv7/oirfqcGI=,tag:vO2BwNjDGqnsPIxDqQig7Q==,type:str] + #ENC[AES256_GCM,data:B6V8Ts98f3ODrIpwnkMio0sPy6HYowl091ENhsAiuy6uEQ==,iv:8IwF6gB8N2oCwJ7SVhHPC8qiqdUNkoXZGQBnjZsghrc=,tag:8XfkNXg5lz5GvRRl4V2fxA==,type:comment] + GATEWAY: ENC[AES256_GCM,data:dwRSmkaQ7Z8SlMns,iv:sQUNWkRj8DbtYAMkaJ065wor/vCqEUDtHkOi9H7ckbI=,tag:InqxnwFE/2nT71BCSwEoHQ==,type:str] + #ENC[AES256_GCM,data:S88nu3SeeGJjADqto4w0g3iUAcnlR8nf14CMuOJXhJQxXDr4JgznAF3fIEc9UPQ=,iv:eaizFGe4ID3Fp/5d+6uIyoWVpdBHOCD6CGL++k+bXdg=,tag:9pJ7F+XtX+zb92B7Af0Eyg==,type:comment] + METALLB_RANGE: ENC[AES256_GCM,data:iKzw4CwM//ML26rwXmLM9UR0fnKGj2N3rBEfqos=,iv:aC/kAd4uejXNd0G8o84XW9jN1hKWuuFcarq7F/9xcj8=,tag:lIur2oQjzuhKsZ+xz8Yraw==,type:str] + #ENC[AES256_GCM,data:WFPGMGFllHwO3vFsbeMEnyWY/oEwEn2jyLPwvvjKqaNtc9ebtG9cqqV3/zLLP2yYUtnGfmjmAmoQiBgTVOQOb+y6VUty1OQPA0v73xYtNM8=,iv:SJ4Y2RlrPNSMs8WG2VgWEO1kIyYLDs6HQlXsWl5VLqA=,tag:bCXqgHsKQb+MHUXDFngKog==,type:comment] + DASHBOARD_IP: ENC[AES256_GCM,data:8xnbx9Ia+va2jlZ+EgI=,iv:mPAhjRH6hYD4kH0HTBNUMqbznytodakRfVKXm5CQR0c=,tag:bpBWLEJpuQL2vvX6Fqdw9A==,type:str] + #ENC[AES256_GCM,data:Sk8XfYXVLw9gdg4ttflghvml9PtnR+WsGb4y1Xb9aXa47DBzTkzMbz/o9hSg5y3z528i8wUeCK4=,iv:CPzT3IpTCk1nTD03UuVQycZDyaDyHuN4mvzK7h7MhAM=,tag:fv56PV3Qwja1tVPEdA9q8A==,type:comment] + #ENC[AES256_GCM,data:7EzBlNF5OGXHSKGGZUyIsBXPznEgmIH/JQ==,iv:WncKNSiaVFBz+n1WwsGsINCo/CSUlc46WnWknPKLwoQ=,tag:P6ffhRSOI8gY0FvcKIJCMw==,type:comment] + #ENC[AES256_GCM,data:zETwKu0C/izvA/yac7NXzIh/hUBZ9O12uvhpEa/xLWQCw3HR83aFYxOeALK/4yio/YRBmW525laSbawBe7sJ8rYRMhbs+f/0/JorJ4A=,iv:L3yOFifUWMSe0djQbMD+cbjwPtDn/q7KuW7RABmUigY=,tag:QAMYNeUJML0omyrgt6m+IA==,type:comment] + GITHUB_REPOSITORY: "" + #ENC[AES256_GCM,data:ACa3nQrqwjGZmlK5flUrZGwXxfFBjEYSjh1Epkh6sUp+De6FYrDJdiXcoHFcRBzUPOABiiHp5dPZjSZsLuE8azje74epxNI=,iv:ADMSMkzvqDzUGVv2M3uSlD82MQi9Gi5KLrT1AkxYyvo=,tag:sr4zTcydQGobL7+Muj8WvQ==,type:comment] + #ENC[AES256_GCM,data:RJFxS5mGXqnxI5G0B/FcL5MxY/3CXv9CvpFZHNmiZBIOeTiX5OUZsE3eNSeD3ja6KShQXUWp,iv:2D9CEtn1zH3+Rdln/qz00as66009PYdEORi5kK4fW+A=,tag:aWqc/IX5kXUS60Zn02scGg==,type:comment] + #ENC[AES256_GCM,data:KbpFKs+ijAQy0q/OM1kTiAqxVrYqD9AbxkMsSjkWCIV6DLo=,iv:P1W1MU42pfl2NRQ5d5YQjVeed+VjXt2ggpY7V1aP2qk=,tag:haGA0I65BTdV9AgalqS5Kg==,type:comment] + #ENC[AES256_GCM,data:9nTD4v8T/VEDTHFsWWPf5ZO83SlOWbpkVnkCFt/Y6nyk2UVs/KI0,iv:txxfhJyprXgbVsYXhJfEo1X5qqzlSuMVjSNj1Mbl8WM=,tag:Yeal+o/LfjIjptsCo6IWLQ==,type:comment] + #ENC[AES256_GCM,data:V+d/Qs89lqeqjEeLeJc=,iv:oWskIshGu/GsOyhLTO58GhmokgFoRlq95RXxFWkY4x8=,tag:Am+I8CsmieIBomnrhEgtnA==,type:comment] + PODNET: ENC[AES256_GCM,data:ewO6HIksqTvSSV3Kqg==,iv:ypzdCZaqOG9hTktbjSDGhAjPGlhQx3CFPGC00CpHZ2U=,tag:/VQL28wnkmJyrsCcfNvohA==,type:str] + SVCNET: ENC[AES256_GCM,data:CpGlBxFc7KtvKP0w1g==,iv:MFTqQbuoHy2//wQORRecOyBmyOLtheePJpk+MftyNW0=,tag:mSzr04c2Tf6xD8wR0JIIzA==,type:str] + CLUSTERNAME: ENC[AES256_GCM,data:Zqa1ew==,iv:gbTl6h/YadrBoAvU8/sp8xQ1eEjbUPjl6QtRoccJja8=,tag:D4/nRuF6RyX4pJBOncZdqA==,type:str] +sops: + shamir_threshold: 3 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlM3owZ3F6WHhQWE96QzZH + VVJzQjhUc2dGRTNMNXhGdHBVSU9tb004RDJVCnNUT2pYY3hzSVVEVjg5R29PMnpI + ZnNtdjBZSXdML0FIZ2NUWXZQQmhwdUEKLS0tIDM3eXRkSmtXak9tT3g1NU92YzFI + bGxJMDA4WWppZm1uL2l5QkRXUDZFbjAKhhOuASw+0mTaN817fRlCaMGCdeAFezm9 + FKHTVUHi03UXu6kwyZ3sa4x7V1Bw8hGroroL3Sp4BibrAwfYgGQxng== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-05T18:25:50Z" + mac: ENC[AES256_GCM,data:t+YlmYlUx9noaOr4id/+ZRmpkv2JR4I7jzdwm/p7UQLmByr11KgdakTQGhYY0mfqYZgGWzeQNeZVzjFoNFCIkSCJef7WdBeT7yzRRxscYovnlUZ0dBGTTuc1pWsYjDPc3kbHel7AdeDBB2l0qbMxD4At1r1UbvvOi0cdL/OoYFQ=,iv:RB3vdWiQcnywVxUGf+4jpP5t606akBnsf0REENzUF/U=,tag:aQGqxTgqrM7voYxnglqKGg==,type:str] + pgp: [] + encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData)) + version: 3.9.1 diff --git a/clusters/main/kubernetes/flux-system/flux/deploykey.secret.yaml b/clusters/main/kubernetes/flux-system/flux/deploykey.secret.yaml new file mode 100644 index 0000000..77df5d3 --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/deploykey.secret.yaml @@ -0,0 +1,31 @@ +apiVersion: v1 +kind: Secret +metadata: + name: deploy-key + namespace: flux-system +stringData: + identity: ENC[AES256_GCM,data:a+OyM/CAfSbL82Ii8FFc0pnmOS339fjx0MY6TcS5hxnq/o6T/ZRT5wyuEdAizQh1fg57iQfK5M3JB5V64I7Vf2/eUd6gQFMMG9DBS6xpbIdlrAq5fg51zlrQ0GdcdwtBE0TMQx9RARvgFRCM0Ibl5To9ztM5Dg5DSdYwO967VY8HhNa7RYt4ta6A/fD5xgSytVS2iChNk7bPGv40QS4tjam1gjInh4eA8K0YsBdz2L2IVotmDp3rfDbkSlgafAowcnwm5yHY8zMJMEAKGGdPz7ZTAUB/npM1AqZ5Xea4pO1WsgvmhX7j5zGmbLm3POyDEfKU12GI3RetKqPr1HKA/dXe+y5yJAf9Ryt16hFM+yff8OerYNPYOzSu7XH5omir,iv:VW6/5kReBh0BZBRXqaOVGhsAPQX9Z2b80J/eUHi2dvk=,tag:DSBJ6JP4cEg5LjqGjc6GpQ==,type:str] + identity.pub: ENC[AES256_GCM,data:1lsFtoFsl94Bn51rG6ltUq2xKcSJ16C8g8DK+nwZ7/k5sfUxtEEuDve1EuxuUcPt7jt2OqF1rWiQ0FR1mNhj9PeBmyewlON5MinuMaZ0yTLsCdZC25cYJ+Dz6nB66ihPbq2cCi3VdURQLhPOgdFELXmJ1sdaYLllk5II5otXKVSyJe2N/QJ6oQzlPHwIzr63GrB/YGpFtMEOwzH2MmK0tn8boG9PJ/HpLFKU/Z3NGrbjU1wo+UiiLYRE5YdRMwiT5x29ot/iMd6adyop4A==,iv:zuCnmxG+eLeofXkI42mYS4QlUxKFPVvpQjKHJklr6z0=,tag:scJIB2ZK9i5fhGFvMgqfcA==,type:str] + known_hosts: ENC[AES256_GCM,data:RM4p4j4LMRjezS3V/GzU45LA7pH2+E5wv575f2SUSmyNb03zrq6Ll+6c1ez2h/6ik6NxgU7goLBKy1F/szdRVu/Cc3P7E2/u8qRgld6lGU+yNjifbc9yu5YQk9SXEduyALVMgk/A0o/1nFfJloTaVOCgOQ8/leucwAsqRoBGmaqms2Hs8fhlpNuKHzgQE7H26422y6OhkkFZzNSsN5hFdwDjiOXIz8U+FIHu,iv:FVEqEqPUk8dRrEReV8aaAhBJRNew+TYbH9uorleTkeU=,tag:R5iJuxOCOYXYG7J3gj6Ecg==,type:str] +type: Opaque +sops: + shamir_threshold: 3 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDc0M3bWpvOTI3WDY3UURT + amd1dnNGd2dyQjRSYXhIVUZhajdyNWNpYkNFCjNDU3dOTTJXNWtJVkEwOXh3bVg3 + WVR0Z3VRdzlpamlGcTliRURmR0x4RmsKLS0tIHpmUk1MTjB0dXBOOGtsSE5zdFRq + QTRiNzhFQ0Q1MjNyMENNMzd4T29mdXcKUTurohm+cx2NJDwhAd03bfI8JGFdVNbx + eIamNTnvt/xEI8665fd2piuxe9BTljp8Jgxul+k/n4ZT1V4wnX2tJg== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-05T18:25:50Z" + mac: ENC[AES256_GCM,data:TiLcKT3Khdne8sep2FqTYgm9zVMzQupJneUmzjPqz3M3W0/itiOQtlQvn/DzAZ1nIm36wzBZL80mZ+2Yj5SPAeJ3QE1NJH7FBJ3fUszKQNgzqWO95W2E0OYR+2BjOtkq7hUoq2jBY2ZeqSHYR+WX04b5X6+H1Vwt8cfHIwYONlU=,iv:wqQa+2gW3wpIN4PpVq0+ATwC9ExGYSeqDTD1AyBC+fA=,tag:UoaGeYkUkQGpaoR/A5RWPw==,type:str] + pgp: [] + encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData)) + version: 3.9.1 diff --git a/clusters/main/kubernetes/flux-system/flux/flux.yaml b/clusters/main/kubernetes/flux-system/flux/flux.yaml new file mode 100644 index 0000000..d1ccf2c --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/flux.yaml @@ -0,0 +1,87 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux + namespace: flux-system +spec: + interval: 10m + path: ./ + prune: true + wait: true + sourceRef: + kind: OCIRepository + name: flux-manifests + patches: + # Remove the network policies that does not work with k3s + - patch: | + $patch: delete + apiVersion: networking.k8s.io/v1 + kind: NetworkPolicy + metadata: + name: not-used + target: + group: networking.k8s.io + kind: NetworkPolicy + # Increase the number of reconciliations that can be performed in parallel and bump the resources limits + # Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#increase-the-number-of-workers + - patch: | + - op: add + path: /spec/template/spec/containers/0/args/- + value: --concurrent=12 + - op: add + path: /spec/template/spec/containers/0/args/- + value: --kube-api-qps=500 + - op: add + path: /spec/template/spec/containers/0/args/- + value: --kube-api-burst=1000 + - op: add + path: /spec/template/spec/containers/0/args/- + value: --requeue-dependency=5s + target: + kind: Deployment + name: (kustomize-controller|helm-controller|source-controller) + - patch: | + apiVersion: apps/v1 + kind: Deployment + metadata: + name: not-used + spec: + template: + spec: + containers: + - name: manager + resources: + limits: + memory: 2Gi + target: + kind: Deployment + name: (kustomize-controller|helm-controller|source-controller) + # Enable in-memory-kustomize builds + # Ref: https://fluxcd.io/flux/installation/configuration/vertical-scaling/#enable-in-memory-kustomize-builds + - patch: | + - op: replace + path: /spec/template/spec/volumes/0 + value: + name: temp + emptyDir: + medium: Memory + target: + kind: Deployment + name: kustomize-controller + # Enable Helm near OOM detection + # Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#enable-helm-near-oom-detection + - patch: | + - op: add + path: /spec/template/spec/containers/0/args/- + value: --feature-gates=OOMWatch=true + - op: add + path: /spec/template/spec/containers/0/args/- + value: --oom-watch-memory-threshold=95 + - op: add + path: /spec/template/spec/containers/0/args/- + value: --oom-watch-interval=500ms + target: + kind: Deployment + name: helm-controller diff --git a/clusters/main/kubernetes/flux-system/flux/kustomization.yaml b/clusters/main/kubernetes/flux-system/flux/kustomization.yaml new file mode 100644 index 0000000..db77bc1 --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/kustomization.yaml @@ -0,0 +1,11 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./deploykey.secret.yaml + - ./clustersettings.secret.yaml + - ./flux.yaml + - ./upgradesettings.yaml + - ./namespace.yaml + # - sopssecret.secret.yaml diff --git a/clusters/main/kubernetes/flux-system/flux/namespace.yaml b/clusters/main/kubernetes/flux-system/flux/namespace.yaml new file mode 100644 index 0000000..2dcf862 --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/namespace.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: flux-system + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/flux-system/flux/upgradesettings.yaml b/clusters/main/kubernetes/flux-system/flux/upgradesettings.yaml new file mode 100644 index 0000000..7a7ee1d --- /dev/null +++ b/clusters/main/kubernetes/flux-system/flux/upgradesettings.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: upgrade-settings + namespace: flux-system +data: + # renovate: datasource=docker depName=ghcr.io/siderolabs/installer + TALOS_VERSION: v1.8.2 + # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet + KUBERNETES_VERSION: v1.31.2 diff --git a/clusters/main/kubernetes/flux-system/kustomization.yaml b/clusters/main/kubernetes/flux-system/kustomization.yaml new file mode 100644 index 0000000..d6b492a --- /dev/null +++ b/clusters/main/kubernetes/flux-system/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - flux diff --git a/clusters/main/kubernetes/kube-system/cilium/app/bootstrap-values.yaml.ct b/clusters/main/kubernetes/kube-system/cilium/app/bootstrap-values.yaml.ct new file mode 100644 index 0000000..9ef632b --- /dev/null +++ b/clusters/main/kubernetes/kube-system/cilium/app/bootstrap-values.yaml.ct @@ -0,0 +1,3 @@ +## DO NOT ALTER THIS FILE, CHANGE DO NOT PERSIST. Alter clusterenv.yaml instead. +hubble: + enabled: false diff --git a/clusters/main/kubernetes/kube-system/cilium/app/helm-release.yaml b/clusters/main/kubernetes/kube-system/cilium/app/helm-release.yaml new file mode 100644 index 0000000..9f11531 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/cilium/app/helm-release.yaml @@ -0,0 +1,80 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cilium + namespace: kube-system + annotations: + meta.helm.sh/release-name: cilium + meta.helm.sh/release-namespace: kube-system + labels: + app.kubernetes.io/managed-by: Helm +spec: + interval: 15m + chart: + spec: + chart: cilium + version: 1.16.3 + sourceRef: + kind: HelmRepository + name: cilium + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + remediateLastFailure: true + uninstall: + keepHistory: false + values: + # autoDirectNodeRoutes: true + # routingMode: native + hubble: + enabled: false + cluster: + name: ${CLUSTERNAME} + id: 1 + ipv4NativeRoutingCIDR: ${PODNET} + securityContext: + privileged: true + capabilities: + ciliumAgent: + - CHOWN + - KILL + - NET_ADMIN + - NET_RAW + - IPC_LOCK + - SYS_ADMIN + - SYS_RESOURCE + - DAC_OVERRIDE + - FOWNER + - SETGID + - SETUID + cleanCiliumState: + - NET_ADMIN + - SYS_ADMIN + - SYS_RESOURCE + cgroup: + automount: + enabled: false + hostRoot: /sys/fs/cgroup + enableRuntimeDeviceDetection: true + endpointRoutes: + enabled: true + ipam: + mode: kubernetes + k8sServiceHost: 127.0.0.1 + k8sServicePort: 7445 + kubeProxyReplacement: true + kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256 + localRedirectPolicy: true + operator: + rollOutPods: true + rollOutCiliumPods: true diff --git a/clusters/main/kubernetes/kube-system/cilium/app/kustomization.yaml b/clusters/main/kubernetes/kube-system/cilium/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/cilium/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/kube-system/cilium/ks.yaml b/clusters/main/kubernetes/kube-system/cilium/ks.yaml new file mode 100644 index 0000000..8bd1402 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/cilium/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cilium + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/kube-system/cilium/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/kube-system/descheduler/app/helm-release.yaml b/clusters/main/kubernetes/kube-system/descheduler/app/helm-release.yaml new file mode 100644 index 0000000..660f9a2 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/descheduler/app/helm-release.yaml @@ -0,0 +1,68 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: descheduler + namespace: kube-system +spec: + interval: 15m + chart: + spec: + chart: descheduler + version: 0.1.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + + kind: Deployment + deschedulerPolicy: + strategies: + RemoveDuplicates: + enabled: true + RemovePodsViolatingNodeTaints: + enabled: true + RemovePodsViolatingNodeAffinity: + enabled: true + params: + nodeAffinityType: + - requiredDuringSchedulingIgnoredDuringExecution + RemovePodsViolatingTopologySpreadConstraint: + enabled: true + params: + includeSoftConstraints: true + RemovePodsViolatingInterPodAntiAffinity: + enabled: true + params: + nodeFit: true + LowNodeUtilization: + enabled: false + RemoveFailedPods: + enabled: true + params: + failedPods: + includingInitContainers: true + excludeOwnerKinds: + - Job + minPodLifetimeSeconds: 3600 + RemovePodsHavingTooManyRestarts: + enabled: true + params: + podsHavingTooManyRestarts: + podRestartThreshold: 100 + includingInitContainers: true diff --git a/clusters/main/kubernetes/kube-system/descheduler/app/kustomization.yaml b/clusters/main/kubernetes/kube-system/descheduler/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/descheduler/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/kube-system/descheduler/ks.yaml b/clusters/main/kubernetes/kube-system/descheduler/ks.yaml new file mode 100644 index 0000000..9cb9ff8 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/descheduler/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: descheduler + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/kube-system/descheduler/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/bootstrap-values.yaml.ct b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/bootstrap-values.yaml.ct new file mode 100644 index 0000000..729c060 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/bootstrap-values.yaml.ct @@ -0,0 +1,3 @@ +metrics: + main: + enabled: false diff --git a/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/helm-release.yaml b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/helm-release.yaml new file mode 100644 index 0000000..556eef4 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/helm-release.yaml @@ -0,0 +1,18 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kubelet-csr-approver + namespace: kube-system +spec: + interval: 30m + chart: + spec: + chart: kubelet-csr-approver + version: 1.1.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 30m + values: {} diff --git a/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/kustomization.yaml b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/kube-system/kubelet-csr-approver/ks.yaml b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/ks.yaml new file mode 100644 index 0000000..7a2d216 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/kubelet-csr-approver/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: kubelet-csr-approver + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/kube-system/kubelet-csr-approver/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/kube-system/kustomization.yaml b/clusters/main/kubernetes/kube-system/kustomization.yaml new file mode 100644 index 0000000..31db60c --- /dev/null +++ b/clusters/main/kubernetes/kube-system/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - cilium/ks.yaml + - descheduler/ks.yaml + - kubelet-csr-approver/ks.yaml + - metrics-server/ks.yaml + - node-feature-discovery/ks.yaml diff --git a/clusters/main/kubernetes/kube-system/metrics-server/app/helm-release.yaml b/clusters/main/kubernetes/kube-system/metrics-server/app/helm-release.yaml new file mode 100644 index 0000000..40a0dca --- /dev/null +++ b/clusters/main/kubernetes/kube-system/metrics-server/app/helm-release.yaml @@ -0,0 +1,31 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: metrics-server + namespace: kube-system +spec: + interval: 15m + chart: + spec: + chart: metrics-server + version: 0.1.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + uninstall: + keepHistory: false + values: diff --git a/clusters/main/kubernetes/kube-system/metrics-server/app/kustomization.yaml b/clusters/main/kubernetes/kube-system/metrics-server/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/metrics-server/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/kube-system/metrics-server/ks.yaml b/clusters/main/kubernetes/kube-system/metrics-server/ks.yaml new file mode 100644 index 0000000..1300ed8 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/metrics-server/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: metrics-server + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/kube-system/metrics-server/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/kube-system/namespace.yaml b/clusters/main/kubernetes/kube-system/namespace.yaml new file mode 100644 index 0000000..b78f22d --- /dev/null +++ b/clusters/main/kubernetes/kube-system/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: kube-system + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/kube-system/node-feature-discovery/app/helm-release.yaml b/clusters/main/kubernetes/kube-system/node-feature-discovery/app/helm-release.yaml new file mode 100644 index 0000000..de233f5 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/node-feature-discovery/app/helm-release.yaml @@ -0,0 +1,34 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: node-feature-discovery + namespace: kube-system +spec: + interval: 30m + chart: + spec: + chart: node-feature-discovery + version: 0.1.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + crds: CreateReplace + remediation: + strategy: rollback + retries: 3 + values: + worker: + config: + core: + sources: ["pci", "system", "usb"] + prometheus: + enable: true diff --git a/clusters/main/kubernetes/kube-system/node-feature-discovery/app/kustomization.yaml b/clusters/main/kubernetes/kube-system/node-feature-discovery/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/node-feature-discovery/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/kube-system/node-feature-discovery/ks.yaml b/clusters/main/kubernetes/kube-system/node-feature-discovery/ks.yaml new file mode 100644 index 0000000..f931f50 --- /dev/null +++ b/clusters/main/kubernetes/kube-system/node-feature-discovery/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: node-feature-discovery + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/kube-system/node-feature-discovery/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/kustomization.yaml b/clusters/main/kubernetes/kustomization.yaml new file mode 100644 index 0000000..2712954 --- /dev/null +++ b/clusters/main/kubernetes/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - apps + - core + - flux-entry.yaml + - flux-system + - kube-system + - system diff --git a/clusters/main/kubernetes/system/cert-manager/app/helm-release.yaml b/clusters/main/kubernetes/system/cert-manager/app/helm-release.yaml new file mode 100644 index 0000000..303e73e --- /dev/null +++ b/clusters/main/kubernetes/system/cert-manager/app/helm-release.yaml @@ -0,0 +1,27 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager + namespace: cert-manager +spec: + interval: 5m + chart: + spec: + + chart: cert-manager + version: 6.2.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 5m + install: + createNamespace: true + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + values: diff --git a/clusters/main/kubernetes/system/cert-manager/app/kustomization.yaml b/clusters/main/kubernetes/system/cert-manager/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/system/cert-manager/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/cert-manager/ks.yaml b/clusters/main/kubernetes/system/cert-manager/ks.yaml new file mode 100644 index 0000000..5a9cac9 --- /dev/null +++ b/clusters/main/kubernetes/system/cert-manager/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cert-manager + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/cert-manager/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/cloudnative-pg/app/helm-release.yaml b/clusters/main/kubernetes/system/cloudnative-pg/app/helm-release.yaml new file mode 100644 index 0000000..0d870a6 --- /dev/null +++ b/clusters/main/kubernetes/system/cloudnative-pg/app/helm-release.yaml @@ -0,0 +1,27 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cloudnative-pg + namespace: cloudnative-pg +spec: + interval: 5m + chart: + spec: + + chart: cloudnative-pg + version: 8.2.0 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 5m + install: + createNamespace: true + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + values: diff --git a/clusters/main/kubernetes/system/cloudnative-pg/app/kustomization.yaml b/clusters/main/kubernetes/system/cloudnative-pg/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/system/cloudnative-pg/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/cloudnative-pg/ks.yaml b/clusters/main/kubernetes/system/cloudnative-pg/ks.yaml new file mode 100644 index 0000000..84df34e --- /dev/null +++ b/clusters/main/kubernetes/system/cloudnative-pg/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cloudnative-pg + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/cloudnative-pg/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/kubernetes-reflector/app/helm-release.yaml b/clusters/main/kubernetes/system/kubernetes-reflector/app/helm-release.yaml new file mode 100644 index 0000000..e3693d4 --- /dev/null +++ b/clusters/main/kubernetes/system/kubernetes-reflector/app/helm-release.yaml @@ -0,0 +1,31 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kubernetes-reflector + namespace: snapshot-controller +spec: + interval: 15m + chart: + spec: + chart: kubernetes-reflector + version: 6.2.1 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false diff --git a/clusters/main/kubernetes/system/kubernetes-reflector/app/kustomization.yaml b/clusters/main/kubernetes/system/kubernetes-reflector/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/system/kubernetes-reflector/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/kubernetes-reflector/ks.yaml b/clusters/main/kubernetes/system/kubernetes-reflector/ks.yaml new file mode 100644 index 0000000..83c67ad --- /dev/null +++ b/clusters/main/kubernetes/system/kubernetes-reflector/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: kubernetes-reflector + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/kubernetes-reflector/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/kustomization.yaml b/clusters/main/kubernetes/system/kustomization.yaml new file mode 100644 index 0000000..85b24bd --- /dev/null +++ b/clusters/main/kubernetes/system/kustomization.yaml @@ -0,0 +1,16 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - cert-manager/ks.yaml + - cloudnative-pg/ks.yaml + - kubernetes-reflector/ks.yaml + - kyverno/ks.yaml + - longhorn/ks.yaml + - metallb/ks.yaml + - openebs/ks.yaml + - prometheus-operator/ks.yaml + - snapshot-controller/ks.yaml + - spegel/ks.yaml + - system-upgrade-controller/ks.yaml + - traefik-crds/ks.yaml + - volsync/ks.yaml diff --git a/clusters/main/kubernetes/system/kyverno/app/helm-release.yaml b/clusters/main/kubernetes/system/kyverno/app/helm-release.yaml new file mode 100644 index 0000000..7c9ff71 --- /dev/null +++ b/clusters/main/kubernetes/system/kyverno/app/helm-release.yaml @@ -0,0 +1,198 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kyverno + namespace: kyverno +spec: + interval: 15m + chart: + spec: + chart: kyverno + version: 3.3.2 + sourceRef: + kind: HelmRepository + name: kyverno + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: + + crds: + install: true + grafana: + enabled: true + annotations: + grafana_folder: System + backgroundController: + serviceMonitor: + enabled: true + rbac: + clusterRole: + extraResources: + - apiGroups: + - "" + resources: + - ingresses + - pods + - nodes + verbs: + - create + - update + - patch + - delete + - get + - list + cleanupController: + serviceMonitor: + enabled: true + reportsController: + serviceMonitor: + enabled: true + admissionController: + replicas: 3 + serviceMonitor: + enabled: true + rbac: + clusterRole: + extraResources: + - apiGroups: + - "" + resources: + - ingresses + - pods + - nodes + verbs: + - get + - create + - update + - delete + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app.kubernetes.io/instance: kyverno + app.kubernetes.io/component: kyverno + + config: + # -- Resource types to be skipped by the Kyverno policy engine. + # Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list. + # These are joined together without spaces, run through `tpl`, and the result is set in the config map. + # @default -- See [values.yaml](values.yaml) + resourceFilters: + - '[Event,*,*]' + - '[*/*,kube-system,*]' + - '[*/*,kube-public,*]' + - '[*/*,kube-node-lease,*]' + - '[Node,*,*]' + - '[Node/*,*,*]' + - '[APIService,*,*]' + - '[APIService/*,*,*]' + - '[TokenReview,*,*]' + - '[SubjectAccessReview,*,*]' + - '[SelfSubjectAccessReview,*,*]' + - '[ReplicaSet,*,*]' + - '[ReplicaSet/*,*,*]' + # exclude resources from the chart + - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]' + - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]' + - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]' + - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]' + - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]' + - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]' + - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' + - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]' + - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]' + - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]' + - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]' + - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]' + - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]' + - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]' + - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' + - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]' + - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' + - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' + - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' + - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' + - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' + - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' + - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' + - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' + - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' + - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' + - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' + - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' + - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' + - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' + - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' + - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' + - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]' + - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]' + - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' + - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' + - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' + - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' + - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' + - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' + - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' + - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' + - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' + - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' + - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' + - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' + - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' + - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' + - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' + - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' + - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]' + - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]' + - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]' + - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]' + - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]' diff --git a/clusters/main/kubernetes/system/kyverno/app/kustomization.yaml b/clusters/main/kubernetes/system/kyverno/app/kustomization.yaml new file mode 100644 index 0000000..4c6cb03 --- /dev/null +++ b/clusters/main/kubernetes/system/kyverno/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml + - namespace.yaml diff --git a/clusters/main/kubernetes/system/kyverno/app/namespace.yaml b/clusters/main/kubernetes/system/kyverno/app/namespace.yaml new file mode 100644 index 0000000..9dda695 --- /dev/null +++ b/clusters/main/kubernetes/system/kyverno/app/namespace.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: kyverno + labels: + kustomize.toolkit.fluxcd.io/prune: disabled + goldilocks.fairwinds.com/enabled: "true" + pod-security.kubernetes.io/enforce: privileged diff --git a/clusters/main/kubernetes/system/kyverno/ks.yaml b/clusters/main/kubernetes/system/kyverno/ks.yaml new file mode 100644 index 0000000..ca0c567 --- /dev/null +++ b/clusters/main/kubernetes/system/kyverno/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: kyverno + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/kyverno/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/longhorn/app/helm-release.yaml b/clusters/main/kubernetes/system/longhorn/app/helm-release.yaml new file mode 100644 index 0000000..93e5e34 --- /dev/null +++ b/clusters/main/kubernetes/system/longhorn/app/helm-release.yaml @@ -0,0 +1,38 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: longhorn + namespace: longhorn-system +spec: + interval: 5m + releaseName: longhorn + chart: + spec: + + chart: longhorn + version: 1.7.2 + sourceRef: + kind: HelmRepository + name: longhorn + namespace: flux-system + install: + createNamespace: true + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + values: + defaultSettings: + # Increase to 3 for a multi-node cluster + defaultReplicaCount: 1 + # Overprovisioning might be needed when using volsync + storageOverProvisioningPercentage: 100000 + # v2DataEngine: true + persistence: + # Set to false to pick another CSI as default + defaultClass: true + # Increase to 3 for a multi-node cluster + defaultClassReplicaCount: 1 diff --git a/clusters/main/kubernetes/system/longhorn/app/kustomization.yaml b/clusters/main/kubernetes/system/longhorn/app/kustomization.yaml new file mode 100644 index 0000000..6848593 --- /dev/null +++ b/clusters/main/kubernetes/system/longhorn/app/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml + - volumeSnapshotClass.yaml diff --git a/clusters/main/kubernetes/system/longhorn/app/namespace.yaml b/clusters/main/kubernetes/system/longhorn/app/namespace.yaml new file mode 100644 index 0000000..d1d13dd --- /dev/null +++ b/clusters/main/kubernetes/system/longhorn/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: longhorn-system + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/system/longhorn/app/volumeSnapshotClass.yaml b/clusters/main/kubernetes/system/longhorn/app/volumeSnapshotClass.yaml new file mode 100644 index 0000000..8475769 --- /dev/null +++ b/clusters/main/kubernetes/system/longhorn/app/volumeSnapshotClass.yaml @@ -0,0 +1,11 @@ +--- +kind: VolumeSnapshotClass +apiVersion: snapshot.storage.k8s.io/v1 +metadata: + name: longhorn-snapshot-vsc + annotations: + snapshot.storage.kubernetes.io/is-default-class: 'true' +driver: driver.longhorn.io +deletionPolicy: Delete +parameters: + type: snap diff --git a/clusters/main/kubernetes/system/longhorn/ks.yaml b/clusters/main/kubernetes/system/longhorn/ks.yaml new file mode 100644 index 0000000..c769fd7 --- /dev/null +++ b/clusters/main/kubernetes/system/longhorn/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: longhorn + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/longhorn/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/metallb/app/helm-release.yaml b/clusters/main/kubernetes/system/metallb/app/helm-release.yaml new file mode 100644 index 0000000..5c4f853 --- /dev/null +++ b/clusters/main/kubernetes/system/metallb/app/helm-release.yaml @@ -0,0 +1,26 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: metallb + namespace: metallb +spec: + interval: 5m + chart: + spec: + chart: metallb + version: 0.14.8 + sourceRef: + kind: HelmRepository + name: metallb + namespace: flux-system + interval: 5m + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 + values: + speaker: + ignoreExcludeLB: true diff --git a/clusters/main/kubernetes/system/metallb/app/kustomization.yaml b/clusters/main/kubernetes/system/metallb/app/kustomization.yaml new file mode 100644 index 0000000..8712859 --- /dev/null +++ b/clusters/main/kubernetes/system/metallb/app/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/metallb/app/namespace.yaml b/clusters/main/kubernetes/system/metallb/app/namespace.yaml new file mode 100644 index 0000000..8fa433d --- /dev/null +++ b/clusters/main/kubernetes/system/metallb/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: metallb + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/system/metallb/ks.yaml b/clusters/main/kubernetes/system/metallb/ks.yaml new file mode 100644 index 0000000..8d39ad7 --- /dev/null +++ b/clusters/main/kubernetes/system/metallb/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: metallb + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/metallb/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/openebs/app/helm-release.yaml b/clusters/main/kubernetes/system/openebs/app/helm-release.yaml new file mode 100644 index 0000000..7d03689 --- /dev/null +++ b/clusters/main/kubernetes/system/openebs/app/helm-release.yaml @@ -0,0 +1,45 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: openebs + namespace: openebs +spec: + interval: 5m + releaseName: openebs + chart: + spec: + + chart: openebs + version: 4.1.1 + sourceRef: + kind: HelmRepository + name: openebs + namespace: flux-system + install: + createNamespace: true + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + values: + openebs-crds: + csi: + volumeSnapshots: + enabled: false + keep: false + + engines: + local: + # The lvm-localpv backend contains a duplicate of snapshot controller which will cause conflicts + lvm: + enabled: false + # The ZFS backend contains a duplicate of snapshot controller which will cause conflicts + zfs: + enabled: false + replicated: + # The Mayastor backend contains a duplicate of snapshot controller which will cause conflicts + mayastor: + enabled: false diff --git a/clusters/main/kubernetes/system/openebs/app/kustomization.yaml b/clusters/main/kubernetes/system/openebs/app/kustomization.yaml new file mode 100644 index 0000000..8712859 --- /dev/null +++ b/clusters/main/kubernetes/system/openebs/app/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/openebs/app/namespace.yaml b/clusters/main/kubernetes/system/openebs/app/namespace.yaml new file mode 100644 index 0000000..bb54305 --- /dev/null +++ b/clusters/main/kubernetes/system/openebs/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openebs + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/system/openebs/ks.yaml b/clusters/main/kubernetes/system/openebs/ks.yaml new file mode 100644 index 0000000..337bb07 --- /dev/null +++ b/clusters/main/kubernetes/system/openebs/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: openebs + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/openebs/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/prometheus-operator/app/helm-release.yaml b/clusters/main/kubernetes/system/prometheus-operator/app/helm-release.yaml new file mode 100644 index 0000000..a0505ee --- /dev/null +++ b/clusters/main/kubernetes/system/prometheus-operator/app/helm-release.yaml @@ -0,0 +1,27 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: prometheus-operator + namespace: prometheus-operator +spec: + interval: 5m + chart: + spec: + + chart: prometheus-operator + version: 8.8.2 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 5m + install: + createNamespace: true + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + remediation: + retries: 3 + values: {} diff --git a/clusters/main/kubernetes/system/prometheus-operator/app/kustomization.yaml b/clusters/main/kubernetes/system/prometheus-operator/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/system/prometheus-operator/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/prometheus-operator/ks.yaml b/clusters/main/kubernetes/system/prometheus-operator/ks.yaml new file mode 100644 index 0000000..cd699c6 --- /dev/null +++ b/clusters/main/kubernetes/system/prometheus-operator/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: prometheus-operator + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/prometheus-operator/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/snapshot-controller/app/helm-release.yaml b/clusters/main/kubernetes/system/snapshot-controller/app/helm-release.yaml new file mode 100644 index 0000000..15129e8 --- /dev/null +++ b/clusters/main/kubernetes/system/snapshot-controller/app/helm-release.yaml @@ -0,0 +1,27 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: snapshot-controller + namespace: snapshot-controller +spec: + interval: 5m + chart: + spec: + chart: snapshot-controller + version: 3.3.1 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 5m + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + crds: CreateReplace + remediation: + strategy: rollback + retries: 3 + values: diff --git a/clusters/main/kubernetes/system/snapshot-controller/app/kustomization.yaml b/clusters/main/kubernetes/system/snapshot-controller/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/system/snapshot-controller/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/snapshot-controller/ks.yaml b/clusters/main/kubernetes/system/snapshot-controller/ks.yaml new file mode 100644 index 0000000..0bb29a1 --- /dev/null +++ b/clusters/main/kubernetes/system/snapshot-controller/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: snapshot-controller + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/snapshot-controller/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/spegel/app/helm-release.yaml b/clusters/main/kubernetes/system/spegel/app/helm-release.yaml new file mode 100644 index 0000000..249d33f --- /dev/null +++ b/clusters/main/kubernetes/system/spegel/app/helm-release.yaml @@ -0,0 +1,26 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: spegel + namespace: spegel +spec: + interval: 30m + chart: + spec: + chart: spegel + version: 2.0.7 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + strategy: rollback + retries: 3 + values: {} diff --git a/clusters/main/kubernetes/system/spegel/app/kustomization.yaml b/clusters/main/kubernetes/system/spegel/app/kustomization.yaml new file mode 100644 index 0000000..8712859 --- /dev/null +++ b/clusters/main/kubernetes/system/spegel/app/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/spegel/app/namespace.yaml b/clusters/main/kubernetes/system/spegel/app/namespace.yaml new file mode 100644 index 0000000..c275d6e --- /dev/null +++ b/clusters/main/kubernetes/system/spegel/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: spegel + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/system/spegel/ks.yaml b/clusters/main/kubernetes/system/spegel/ks.yaml new file mode 100644 index 0000000..542a15b --- /dev/null +++ b/clusters/main/kubernetes/system/spegel/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: spegel + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/spegel/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/system-upgrade-controller/app/helm-release.yaml b/clusters/main/kubernetes/system/system-upgrade-controller/app/helm-release.yaml new file mode 100644 index 0000000..1da944d --- /dev/null +++ b/clusters/main/kubernetes/system/system-upgrade-controller/app/helm-release.yaml @@ -0,0 +1,102 @@ +--- +# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: system-upgrade-controller + namespace: system-upgrade +spec: + interval: 30m + chart: + spec: + chart: app-template + version: 3.5.1 + sourceRef: + kind: HelmRepository + name: bjw-s + namespace: flux-system + install: + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + strategy: rollback + retries: 3 + values: + controllers: + system-upgrade-controller: + strategy: RollingUpdate + containers: + app: + image: + repository: docker.io/rancher/system-upgrade-controller + tag: v0.14.1@sha256:7e13a9b2b984f0c0fd6328439b575348723cc6954b91db3453057fcb784e2d29 + env: + SYSTEM_UPGRADE_CONTROLLER_DEBUG: false + SYSTEM_UPGRADE_CONTROLLER_THREADS: 2 + SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900 + SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99 + SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent + SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.1 + SYSTEM_UPGRADE_JOB_POD_REPLACEMENT_POLICY: Failed + SYSTEM_UPGRADE_JOB_PRIVILEGED: true + SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900 + SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m + SYSTEM_UPGRADE_CONTROLLER_NAME: system-update-controller + SYSTEM_UPGRADE_CONTROLLER_NAMESPACE: + valueFrom: + fieldRef: + fieldPath: metadata.namespace + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: { drop: ["ALL"] } + seccompProfile: + type: RuntimeDefault + defaultPodOptions: + securityContext: + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + seccompProfile: { type: RuntimeDefault } + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: Exists + tolerations: + - key: CriticalAddonsOnly + operator: Exists + - key: node-role.kubernetes.io/control-plane + operator: Exists + effect: NoSchedule + - key: node-role.kubernetes.io/master + operator: Exists + effect: NoSchedule + serviceAccount: + create: true + name: system-upgrade + persistence: + tmp: + type: emptyDir + etc-ssl: + type: hostPath + hostPath: /etc/ssl + hostPathType: DirectoryOrCreate + globalMounts: + - readOnly: true + etc-pki: + type: hostPath + hostPath: /etc/pki + hostPathType: DirectoryOrCreate + globalMounts: + - readOnly: true + etc-ca-certificates: + type: hostPath + hostPath: /etc/ca-certificates + hostPathType: DirectoryOrCreate + globalMounts: + - readOnly: true diff --git a/clusters/main/kubernetes/system/system-upgrade-controller/app/kustomization.yaml b/clusters/main/kubernetes/system/system-upgrade-controller/app/kustomization.yaml new file mode 100644 index 0000000..a6851bf --- /dev/null +++ b/clusters/main/kubernetes/system/system-upgrade-controller/app/kustomization.yaml @@ -0,0 +1,8 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml + - rbac.yaml diff --git a/clusters/main/kubernetes/system/system-upgrade-controller/app/namespace.yaml b/clusters/main/kubernetes/system/system-upgrade-controller/app/namespace.yaml new file mode 100644 index 0000000..1a1d3c4 --- /dev/null +++ b/clusters/main/kubernetes/system/system-upgrade-controller/app/namespace.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: system-upgrade + annotations: + volsync.backube/privileged-movers: "true" + labels: + kustomize.toolkit.fluxcd.io/prune: disabled + goldilocks.fairwinds.com/enabled: "true" + pod-security.kubernetes.io/enforce: privileged diff --git a/clusters/main/kubernetes/system/system-upgrade-controller/app/rbac.yaml b/clusters/main/kubernetes/system/system-upgrade-controller/app/rbac.yaml new file mode 100644 index 0000000..3396e11 --- /dev/null +++ b/clusters/main/kubernetes/system/system-upgrade-controller/app/rbac.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system-upgrade +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: + - kind: ServiceAccount + name: system-upgrade + namespace: system-upgrade +--- +apiVersion: talos.dev/v1alpha1 +kind: ServiceAccount +metadata: + name: talos + namespace: system-upgrade +spec: + roles: + - os:admin diff --git a/clusters/main/kubernetes/system/system-upgrade-controller/ks.yaml b/clusters/main/kubernetes/system/system-upgrade-controller/ks.yaml new file mode 100644 index 0000000..04661f9 --- /dev/null +++ b/clusters/main/kubernetes/system/system-upgrade-controller/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: system-upgrade-controller + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/system-upgrade-controller/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/traefik-crds/app/helm-release.yaml b/clusters/main/kubernetes/system/traefik-crds/app/helm-release.yaml new file mode 100644 index 0000000..05c3b62 --- /dev/null +++ b/clusters/main/kubernetes/system/traefik-crds/app/helm-release.yaml @@ -0,0 +1,32 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: traefik-crds + namespace: system +spec: + interval: 15m + chart: + spec: + chart: traefik-crds + version: 3.2.3 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 15m + timeout: 20m + maxHistory: 3 + driftDetection: + mode: warn + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + cleanupOnFail: true + remediation: + retries: 3 + uninstall: + keepHistory: false + values: {} diff --git a/clusters/main/kubernetes/system/traefik-crds/app/kustomization.yaml b/clusters/main/kubernetes/system/traefik-crds/app/kustomization.yaml new file mode 100644 index 0000000..34a8531 --- /dev/null +++ b/clusters/main/kubernetes/system/traefik-crds/app/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/traefik-crds/ks.yaml b/clusters/main/kubernetes/system/traefik-crds/ks.yaml new file mode 100644 index 0000000..7cfbaec --- /dev/null +++ b/clusters/main/kubernetes/system/traefik-crds/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: traefik-crds + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/traefik-crds/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/kubernetes/system/volsync/app/helm-release.yaml b/clusters/main/kubernetes/system/volsync/app/helm-release.yaml new file mode 100644 index 0000000..855dc21 --- /dev/null +++ b/clusters/main/kubernetes/system/volsync/app/helm-release.yaml @@ -0,0 +1,24 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: volsync + namespace: volsync +spec: + interval: 5m + chart: + spec: + + chart: volsync + version: 2.4.1 + sourceRef: + kind: HelmRepository + name: truecharts + namespace: flux-system + interval: 5m + install: + createNamespace: true + remediation: + retries: 3 + upgrade: + remediation: + retries: 3 diff --git a/clusters/main/kubernetes/system/volsync/app/kustomization.yaml b/clusters/main/kubernetes/system/volsync/app/kustomization.yaml new file mode 100644 index 0000000..8712859 --- /dev/null +++ b/clusters/main/kubernetes/system/volsync/app/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - namespace.yaml + - helm-release.yaml diff --git a/clusters/main/kubernetes/system/volsync/app/namespace.yaml b/clusters/main/kubernetes/system/volsync/app/namespace.yaml new file mode 100644 index 0000000..76e5bdb --- /dev/null +++ b/clusters/main/kubernetes/system/volsync/app/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: volsync + labels: + pod-security.kubernetes.io/enforce: privileged + topolvm.io/webhook: ignore diff --git a/clusters/main/kubernetes/system/volsync/ks.yaml b/clusters/main/kubernetes/system/volsync/ks.yaml new file mode 100644 index 0000000..b2ddcef --- /dev/null +++ b/clusters/main/kubernetes/system/volsync/ks.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: volsync + namespace: flux-system +spec: + interval: 10m + path: clusters/main/kubernetes/system/volsync/app + prune: true + sourceRef: + kind: GitRepository + name: cluster + diff --git a/clusters/main/talos/generated/.gitignore b/clusters/main/talos/generated/.gitignore new file mode 100644 index 0000000..2914994 --- /dev/null +++ b/clusters/main/talos/generated/.gitignore @@ -0,0 +1,2 @@ +main-k8s-control-1.yaml +talosconfig diff --git a/clusters/main/talos/generated/talsecret.yaml b/clusters/main/talos/generated/talsecret.yaml new file mode 100644 index 0000000..ea20568 --- /dev/null +++ b/clusters/main/talos/generated/talsecret.yaml @@ -0,0 +1,43 @@ +cluster: + id: ENC[AES256_GCM,data:EusBYuYyx4iLHCGQyDaoJ8kSRL3GL8zjDXO57a5sZ17f1cqcyzxoODehows=,iv:hD11N3D+NSQPw+KQAwAt8ygdMeZsjU2c2NRfnH9STeA=,tag:BuW3EidqT+IWnaXekBSKRw==,type:str] + secret: ENC[AES256_GCM,data:vGXjrBiJaCBoZCTcpboOSr5Edg4oLXn1O2ez3UgrjC4TdAeY1NjW5z6WW0E=,iv:CAipozS+irrI32Vlz+yCxBDz/cFQT2H4r5I123tping=,tag:SpSLYM/ilAklcTEV9ONjxA==,type:str] +secrets: + bootstraptoken: ENC[AES256_GCM,data:NtKlSto2lgJvie8hT9A9rSphoonL4a0=,iv:S8z5qFNL6kjhlJdG3nUedqWtmynaG1uUnotZLdbQyeY=,tag:ioQjpudRX5U/k1oxw9eXIA==,type:str] + secretboxencryptionsecret: ENC[AES256_GCM,data:G4ScjKMh22HPPYZ2yI9UOUs1mrB8JfMgvMNQAG3kkzzcz2efGLO8z/ZCp+k=,iv:2isNqg1CUd54vaP7kzAImILVqqFnydA+uzcca8lrTyI=,tag:vR4NtVoNYFcP54K7LtXlAQ==,type:str] +trustdinfo: + token: ENC[AES256_GCM,data:+pmlbH8gqAKLik6oC+MOH0kIpHfI4H8=,iv:j5g1uwwbPjyyTGaaAhJ7EDUM8T5g1LRiRowLWIqC/vg=,tag:zszuo3UwXOW7EonmM9RBOg==,type:str] +certs: + etcd: + crt: ENC[AES256_GCM,data:T4LkvkYA86FFO8q5Fx+6UY8yZJhSnBHvjJ4IAUrPfo5TtMRt5eEO2fK1CB1ef0j3GRn9THfowpjiL+Jm/D8M6IkhxUD8OIF7iNuLmcN/U6QxIi10bfxJ7mLTz5Wgz7pfi9c6M4QHa3kHJ4p06LjhgnJ5Sfs+m5r4+djM+YZ7cFgRWxDNbw39IkdKvVdCDWLA8N5OLUQA2rf9sHOV5qG7I+fijoDsRxCtWTE1y5AWzReYzD4GPVc3rm3GgMGuhpM3rAVhcXe+XIjPbgaD7KVqxJQRCSk8YHzkEfTByevuciaO5VLPkfRUP9nB3qvp2dv5+hOg1PZcROd7N4FMp3kV1KlRjsK8OAnXmtPad5iRvm6GgUBDfPYRXDN9RbBVMPxT0hZOkawZVIlbUv6myyPwDIZGiaa7unpfEhdheQI63vwwgZSvHobDaH5Cvc3Vkcp5/G+HD0UdrlHHXHyY7IQpcQXrH1rm+AiBWQqeK2PFpvh68roft/itJPvjcEjTL7crwe4mWsBod1kjrRo58SwLWX42soyYttFu9yA7pPB/cGKR5bDKC8jB0NLRugbwtrjKOFX4vfwaCqw6NaBmKfLUrQusjIPPoiU248AKsuO8Ku0mPnWhsruHg5ViCAnCSaNm0i3SWgQ//ESe1dHALxABgTcJccV/PeQzytRWQcHmCgjfj/fVo/23R/QjlhKZxGUL54AAwuSoNCxqlBTgoS3aeF0v7jR4lxE38YtOcYAafLt/T9OS7gxSU6pgjkSk8Mx1BCvEwEulSyhMYg6/5qNX0AgbEb7vHwNqJMP2QiUNK1GB87AxPyIR1XvpRjJ6jutxDSU1CtBHIH4ll3vWHANcm2EbKmKALXrB84/mGR6JrnGSTAdH+kYyJYyadNPvpnxGvJCG4haNluaU6BG/Ojhw23qwF1HFsqyuK0oSALk4m4uP54vs0Y7zkr2vixL9L6EL8iP5zrF6wGc96oljnVgNWnPCj37Qmx1LYBIppZJG3us0yzVgzvj+SIqI/By/lk3k,iv:dkCxEt7mZXBxmym1z08vWyUNvo5UqDre9KplV5SLflY=,tag:/53L6FUORv+RH4Ucm/rImA==,type:str] + key: ENC[AES256_GCM,data:hP4oVKbBw6+LCHQi/uigr2NuQr2mz+cbDq9f25+v+k2mC04MQMv0zt+ZtmmQZGEVv7Ag+ZoxGWs69pSVzjlIx81IzfM+wxGsgef8Yq1V+puKmwRy45YN8GO7ayzwdQeByCsa7fy/Qqs1W/Ig7lI7Yo2EsdtOFmhekMZupQQN5HZCgValOhgCdWyOebKGYDsY4WY0wmtlEz9pZvlG88C8o7O9XHsiXUX1R3VKYeyX3Umm4CSAufyOIj8Gc7Zki+U7WWU4XmPZ8N6sb3mncKZznTCBgL5zvm3POXOZO2yJiWQmx/B5d9xkR8VUTLmHwrqXA2Q/zf6Uvpss60yjA0q3OEG38MS+IihYNXOrJWACHeRx4HOS/25lTCZHXYwdtFsjFFBat+3sLwEiB3KnqGR6Cg==,iv:/wtouVlzau9/zvSo84LY4h7PLleQzC4NB+7K9uI3GXs=,tag:9WDbOhN/fGINYSy+qLKU3Q==,type:str] + k8s: + crt: ENC[AES256_GCM,data:3Irdd1rGHEiTu8oXIIpvOS7oRRVptmP5EQSVe+hezb8Hn1h2cRslOOK8pA3kN/EKEfdew4FUlcK8byUdvTmTs0vT+MVvfWhTJKKa2jsbSBDwatRB+L+hOXBJCTsiz/2xvlhAwv2N2G536BenKIbFH1X9nboFijygZt9PT9du+NUaONGZvI+Awa/wvYWaXO3Zb6+M59L0asXoO6Yu+WX3GsGHQ3IGmMg5WEJriHEdXSuW0RAtSRLHdzEWWdhlncv/NnxKNJxmYsOf3exPfGDaRofNeqtxwsAJmG5xTM+znJisB47OETbEGf54Y0NIuRHPEMPxIhLljFDOSEePyzvcaMVxOmYAtjUvbLYRcJXZV8liP+Lw5xEBy5fDrR2b1lwJJ3cr9tB7qDzqIe48/H/rs+9XLQJeHE4O1Wsxejek3JLdZhEuKDYQ0U9O7pQ9a7fmper3nCbSyjqNqXNRCyouUgM/D4Z7+Z25T5FQlrd74Qq1oqJJi8uwtV4eF8by3ShiCvUhw0zr/vGbeKh6JS/nWdG4n7eS3RpoYzc/KvnHZlOGmvupYcUSsZPbDv+e+sDFBz3P3w7LAZG/hJqj0eSZrSRN5Nod+VmvrVQ/c4E8WNh9/eNuQmS4thf3Rjmm77d9nuhb8uLHSZOSqcH7pcsgFeK9ttE5MMyLmCMIYxjzfczQyLUgQ8sZzb+Coa4bkcmpytYcCN5RXSUCu8KNMrqG6o/pgmF3o9YEYqoztGKrWZ8Zi8V6g6lA1ly3HWapb88AHthSu2xcotoaabb+ttpx12TK85EisqKmEqGXOF1McC23L8/wDP9kCAadYmBaGaYTIKvVXAxOv840RbYMIKrCxNO3hTuCJR5/cTJoo/uOE4MI5OZ+Ivxc1d9lbDGUtcn9il8Lz3Lzc+Bcd5kYXrrwU+i9Uv5+rPrZ3ZcpWzAt3L8BHl55X3Iew/b8a/l21KVuHYmEM4BDgxSfbRFJ/nejgEFhqvjqJJ++4alNhvRu6ONGpnh55/hIoB7YMN49iruNjwwNI7zqYsCXDJfNDKQCJjclrRQBBz6c0O8b4Q==,iv:+Fc+HAqrUmYLU4s5mtJhrIJhEO7iNjUWANg8raeLSYk=,tag:NvAv6GRYQy+bU9hjscxkTA==,type:str] + key: ENC[AES256_GCM,data:hoYC4VOWWn7d1PElJuN2Pzue/1oZjxR45FufGb6aurN9ug5ubTm7QSvNIyGad+REoK3J3lfeD/F0PjNVHeCfz9wGcpg1bG7UdK3L05UQWN4dC28sfoyeEKQ3FErv9JEBYQ/ydl5dfK0S+NAXns1lEBWI4s2gXENXKRQjU8r2m/TaoGHyuFahYYdB1qjlVz1S2HsDoIx9RV6OFiec3lhqsWUjGTlG5gigtbSVt7s46E6NS83i+9y14L8+Q5fjyD0zWNm62giRqfdGu91kCZGCyo6pBl+1z9Nc5jmKN4XD6NGTPQa9LPxJN56egbglaS3dzuoUrGYkuYKZrRoOsm1fkUH8ucpXtCmdtHjnnKwa8H3qEQXnUh6dqdEohci6iIflUlY+v/CSPaJjT3FBvoz58A==,iv:NgdCs8pGtURWPByLOuPPaQlu/JOMdUfTA1Ri44buCxU=,tag:oQrZHqcpxuN3WTWL9y7AMg==,type:str] + k8saggregator: + crt: ENC[AES256_GCM,data:P11lbvvNs1ymXO6XtLoKBsktU99UrY737sCA+oQPMWVmXoD6QDHtKlwEuQ7UmKy1u2yTMlhic0T6btkcRZvjL+d+6+MPA/9XQDQmII5bqPuAdxJokCd0seXylUJAP6UhQ5pbvnmwYS2sgvMkeujcydGOMbsr4XPneuI77PSDbidUlwxO3pqCZjddsTXHtf7ME1qolJwktNvnyeVfxydqWAiCid7YSUUWa1oYREjlyVC5L/DDhWVT6I39w9auPqfOxq9EhUOlpiYlYHxZD6qEoqWvxIiJda6jhUTECDLBMs+FKFgrSJopy7FmauwEtf4oN6Y9Cnp2Y6yOU1R5yEerSo5q+K/Qz3Z6pEhqkmoxoYTC3e8NSv4sR4F55emhaOXmeT+S1mrt4w4R8WuJy/SHqNvi2U37m2qb5dehLDuuzweUn4XSaZI/ymain7hVuc3dnGRkscqtpj4uuJ2T+zuOvMeXtcazkwR/bl5p7rg5TS68nbo8elgTpYOHhtOjIWG4PiYG90wN5rBn6xeOw3C3VQ+Q+YvaG4bHJHwGn9gwNZFYONu21eVlijFbdjOhysh4H0Il3iIo/XJXXdVrEMdX046GdmfVCRbUPf/VyeKjQuE7AKAk7UIJK1Ff4VFTodLBxW3MDHaX6BcgNgVEmKHDDTp+IeAUKpzQLMta6s6DLQYVX6JN2l0VN4hPfT2lqbGrEi7B79GEeINscIxMxbO+vhyuxb0rmgDCNMvpIkNIgVR9pZPxozxwzsYKBtASSLGuYOH+1OvTZgEgyfuIYHa8Ttedj80mw0pDKIM22W/I4uhfMjWrb0fNIyg2CM9ZESLsRE3lUmzjjWx/TnNU3WJD/ZzONHJbMx2N5sL2zIOMP3vEOG/XBu0V3c6/6iIaERivGKdloXyv1TQqmBHhv9mRfHai5T5Ta3CxXH5lyySDP4RIF0xsVIeFhA==,iv:78u9QDE9YM15Q4AtbH8BJVXVt0bzya03AlUGHVrPjO4=,tag:kHo78+mEBZHxTLLtos+a5A==,type:str] + key: ENC[AES256_GCM,data:LmEQwLXjy27bmgwk6tkam++kq6DRIKRNYnMI90aclVjwbemlgkBgd2EnkFQypUCW9OhuvzDYvZOuT+HyO9AknzI7AzaO0AuUUF0Qq5kdPPGD8xRS+aklkxuZsk+1FEQQlpOap+ahpLpHs2hFJ3p3XAA1WiQNTVQNY9ekjSo9LqG1gdw3JS+3JuzAy6DJE9IVpGul3Vlz8NvKCaLdlJn+ufnDhfrbG16W7Y/mYFeX7MbPXXafc+1mB4kAsKQrxK8lzfzTVv1p97o+7k2USIwbLWxFCtkjvDTkD4bOtFie0f5fODJmWQYcdHESjQPS/iIxc1WlhJAGdTXPtraTOwoYWBelfL5Arp5r/kJzAUoJqLFM8kTLkD9c6oBW1s/QG1Y/l//Ehlk+lNwooE2FIDAg1w==,iv:PppDgP5Q0NpOzwhw5o0AbppWQ1ufijF7CdFDGXbFL2w=,tag:Np6RE3HS8BLliHJg1z2BCw==,type:str] + k8sserviceaccount: + key: ENC[AES256_GCM,data:dVovfA4DZBMrU4Hkid9hBW3GIURT2MDtDqz2oMe8DdP2cokuySYm2xNLJpUqLoYWFSJcjT4rnkN7yXt84C0oNKu1aHXKhFOIiLCyNcUQZIuWYbhtS37lUUCLcg9c51oyEp7/BO17xjAjmlvCz3vZMJAgEGh5X1JgAYsZMnaTSIoo1lRc8Xrgj7nC1RmKtzjwfeDX1dKo7njy4o7ry9clpIS43IgqWb6krdSKl5PR4sdNWRiMllmvi1nfdXyL9SgNPlcwL35cKuwNSf38DjbHVfkH7yO3k9nbqrfnscNJar8Beo/7t7sPB9Fj1+CpHkz0cDayCZPThAUpzeqA+YgXFDUM5UqM0L2Mst0f2i7MXzXJB4boWe1dtnv4zMs2ZR5fhzE+HGBtk+jNhu7999MvWJ0lR/cNLg2gDp1z/Zy5Qkyx4l8GgEUuI1h1P+vIsfTT1f5KuGThwGt5FXrMk6Qthf96I4qX3rj0VwQ0dcdvMSlhpOKQAjbISPfOFhQZJEfp9JWIq2YTAmSlP3nYro3hsZ7u9XumO9pnt1hKIN6EFXudlgOkRV3djyuTC4uP9vdAv3QVamtJ+N/1qFUYOroo2gBlTG6jKCeAsIi/aHZzuMsyfBJW1Smwxi7W4ybJg3FoIUA28o8GXIl/0infjUu7WkKzKxFzLEhEitq6QD3c5Mf0UEdA53oqyC9Irw3ln1RTImGoyXsca3Fxgd2nTBgpr4HTGgmoI7GuCykMJKLXHba1/wWuJ/JxXAlOjTNo0+vBmajkpITDx6Z82U0/Il2GZil3qy0z5iZrivYs1kUEugBHQedo1ttB0GAlSlGgziJr4evsCVBbh9ReLmuVeMWXaSXbFo4NT+9IgTZxxmJzwnelMCpl9QTupXjyKPfdVEtLS56d6RO9q4qIhWU8MrFS/UrrHlKFlcUrtPUW6cR9Ng4DfiDewvaiqnAos40nu/4zhkUAua4z9C13Z6DGotPzHENsRRY1e34/Lrz8fqzc3BFMcXoVag3FrXaJoOUTw2BqsyD/mrE2QA5pkn7AXNGUtpsHQbBcAsNRCkynKQ320nRg4jy/bEWbxfk+/icsZRT7xKFSkYr+fSPgyT7MrJo10Px4/YHxyUg3Y+u5LPZyFrXohb5Pj911yHc6+RjUUn/uxPAi8jUqO6Sc62umfsNhdZ0h4XFRkr4bdI6QZg0DAJ2GfVHg7sBrDdUb7dc0Rr68QVjam1MTgcdWQGbV6czf/VNhJwgXd7FltEDYCvSw4TPN6MRfMG8SeCYGpEBao/Xdd3hmty/wLUP7MW+NyJds86DtJsg5FUoRtY2MiM1OaQ4hRD+thLEaySeosufY3SwSKY1dbbFbS8suFUHKON7S+3Mmb4ZjEJ4FaHAWULo72IKpwn+aQOaN+18v/K7o5eomgP5BDaqddEfqabjB8lPNErL0emIMyWEiBq2Rs0SQtnIK1ZcQU7Bk+utvCv2E4HfmEzydvFUkrLKK3HQVqpt7uUbkd6Zl4vhVaaGkldwTTz2YoUCsh0iksaHNWDJDT6YeMrDehAkubrspuBNhuBJotNFJiYA+BMLTvwP0AqYp7NFyk44AvXgBOFbFFJ4g93VXZRjJbW+fnZyXAwc9SfVC/YhMXJA+1glfwAhNOES7wO56w7TduC16ZJ1SeTKrYH2l1tcfGrO3g6zopkyasoHxTU3pfTcYv/tjIfP7u+10XMPTgvH9YeCV6h7MAls2GBImUrLWCAzGFLBByDVQOWzGG+0Iqsbn5kRo/0ayU8nv4x2FTHkwKfeXN+LxI3u4Md3icfhaMH/IHio9e+7Hlu0PMS2iHK8QbiQK6RW9wT1rfVbgBqehK3eSayEGhpFvuriZv76RFB+7Y0XeHzXqyr8ur0m2Ld1AGg8Y88unRPuvZ+4WXpUGLIAOJdFmyFxIijH9SQu4dY9SdSLEZgdjJNWTN2aQHhWI9KQ7ZrSxnq215ijvE9o8dfyRIXItB/2vw/9emWZJ4uuLdAmjHr6u+X3Z87FBLqefUEwshKM/4od/30fVqvwB9SrAL+i/wjLhnPywkwgGNYF0mG05/ySK9VdKmbPVwIF6EnBhbUv70hg0pM/A17GZLqGiQl3jv7VHys6yDabwpv+xwbAsp6ENNzwDDbi8wAj0lZLAO+1b3vJMt3K5elBoUc8ZP3Dpsbb+E5JqcWS029IR3zcq1mjpjyocEZFwQpd4mm9CaQPjsUnEMz1TRPOj/iuBbG7KSI+hawRbt9ZlCGSMRVSYxKxd5u+WiJ1ZkSHmjPEq00A7tO+dkSHjvGWc8kDgLyMMCwS9VHiNSZCQr5BxegVuq++h7u2ifir8K/3ZXCFMWHnYEHqj6+/HrNVmvURHy+/XMv9CBm44Aw00qAF6oPlFdl+katN6qTxKo1mMvnKRde8HoCfmRMMoBfeZ9weA/T5SCshUgVImUIh9Ne8rFY6tRsElkEHCtsyy3esql6EjlyTsW6R2nPQlofPCelSbQ6ZHa9eM+CDf+BS/OETBA0hoSvJ7emhhsl9PrYsgK0Xx/ZFIAsRhLhdn3ocNbeUX5BzT/TVwxmQB5ut8VqepdUaz6H3zED2AZOxyz9pozQyavqs8qX3x9Rrp5ueKxsxE4rslEH7qx1U4Wgal6wwAM9UlzJRwN7mYQBhx+jsHJEqD8GesnlWzkwBnfXDtQ6TD+uh7g8xWa3s1a6cJ87iiVYcP958vNdivjlMEhb4Gv8MDHiqOVWh//jqshVZMW6iXP22VeQ8rfmMbD5s+Y/cvByudzapTPZS65CrMlP6Zgb/iTReDUa/4BfEKQFZuzJG+ccyOpJAGUxQK17gNcY0AKpliPt+Gt/4K1SFPPwWd8fy6gauSga9qJ3+2j5hCI9C2NEH+0KWXHrM5HIJ83BPxwUx+lNMaYqff7l2G+nZ+yMsCy/FyX8faMD01yjHIjPBTn50YVqLgZ19rlhasn/uophwMG3C+BQBIKTEpldRIKO+rOhVDOq6wzBupO4cMidyljG3YMDTKAE1eu//zDJUrP4ZvrDi3D0QusPinKGawV9NEQyT6zWjUsvQlGuJyuiRnFjjnsKM8nCkmIV9b8yPSvmnG7aASKRxsjF3B0Juud8KJv6O2LpPpJecGhWV4DKIDFXSYwSFyN9HPY7b3RQjcWHWhRJtHZ5RsF+vALiGlyikP5WmKOZb1QXcXm9D/QX40x4XuErl+OdlskXoRygYoXNGTcQ3zrTcpzdoL+j9KZVefj2mCg7w6hhJYGGMyzp3deTGOGdfg6BUVJQtbuEqZn4zLX14FirbrDit9zDczUvwvKTegzI1V53gZ23Gw5qR7rrPGntQ2n/VzBr5XMuPtqcWXy7/DoRo9g16wSrUOWh3sScGvLeu2NzepCDPubkLEqvA4Du/lctrm26hUwdJBFlUR+JUYZBCrry6DgMtJfEAbGRTYpv9qYTfCEVyrq1IZpW9H6vdirgITvPwQsjnwribX04/jbwvpDs28JhpbIm6BYZMxzN/su1ER4IBuQPr5rRC4QkY0QC7ACaNbGFehjFOtrCEyHrtKBjMZoLbww0oI7DWfCvIPmt4CiF/lIlmzYubvYJ6YuDfz9zX3BwrtPLywTAbAN2KJwt7Dn05L008mDDI0n+Npa3FGTaf/FlywEF3diSPg2AjW4W0gb0Ju+tPEAdEjDnSwaXvXP6iH3bpTaMY5X4xINmlqLhSF7B6b39y2nQtqMqKAaSWZYgQcZJ8UHzYotUC9kedFQZ9JQQaUD5xnkDFgGRFppZx1E1505dOUUf6eJu9WrL8QaycossKquJuaTu87JUzTxCB7o4DOr2qrkgLKnErJFqtckVOf7o524nc8dl3W8RN+fBaBhWxuBwkYd9Nf/81psto9Z+SDRGW0sRhDUpCO/rVemOZhvhHRN1G5ogZ5oAtTIXlrNMtGYZaTJYdl/IIEtl0v/AuaZ4WgSKULwSOS3Sa3ThQ/Cc1iRcIul8kimOsC4dAsFAkIrDZi55795y07+ZdI2hClheuwxJA3Qzb4CvpGOH5umQd2n1UOIU7Y/HAv6QT02xBTYUOsMksJzBTLKFZez/VcLms1cUcrd4B+rLHOacTuVyQy7+Zri5stepJcVYxaaV9euF1LxsL22VhmLxeHGghB7KUpyapscqKSp1SUz8b1OcYR/xtqbS9qvVWhLQAqInI5KHUdjSKwfkKOVIsWjEFNkbIyWfCJIz1maBQTkeqX1SdpeO+HAS0f6m7iYMEiY61TExfvnNUztxhEIvEEVT+jCHMXMxUrO3oD7Wer1qn71IdiDz+FCSvxMe2v2hf841qKvAwXokC9fHBzopYNrQRqrgoVm6ro+aYHzjg8xNTZT+02ykKvWcaFl6yEJWCs7iPh0Dn6RA8ysQkTHrW7vCuar2XDvMU1NqDoXENAZdqIBo4J/q8sFOHkx/6zPvqDSSFMbnW74f/GAs397AuTCk1KL/1c30gIB86wzE4ublD01210BxzeheP3DKnKQGn3mmVA0g/P3TORg67hJQMfSvAl9hHQ9fs8g3h3fNJsyPV31rsEmBYyAYCRzin7UK9gdQoRJy4K6YMPIIU0U86nnQFSdUluD4NUi06cYryD6TL3epvYQ94eWPv74SUhSvP6kWDq5GjtYDwNun/QdU+1CybOMdksaHWFO73EWTE3BvoMpWH2xsNBLT63tASQI80cfJPaqdM0nJhsZVTF+HOZwxqLd2Emnmar1XfKe1NqnAZ9JPwXqufblyWDEU4LxHZgkwikueIm6NdEOIUGOZL1b3pjSljP82EwF1IC8vQ7NWdT5ywlF85yOqoh513+g6H2GOZV3MZDol5wFfnkQoLUDiiaCapro1/6BhZrLNDwRXxc7A5jGgXqXgw55sx36iyzwHA99zfv8vs4Ip1NxCvmFWGk1jN68BEPcTH7oCu5bWX9HPApEszJXTSLtIIYvkQLPuX3p3w8xYRAJU8grlTxmhsPYMABT5MAVyLnNINKzsmNym7n23f6qzn7YsIPfXR05Ue97L7cxlPL2C1sqzUvvXPlDIIk58rHK/y1nd9Rw5DXbyePumIv0pz7rtLXls10OCNos5cgwu8xM/5twaEJOr734lT/DWQAbDHjg7tr/bPYH2x5DuvCt1I1Yx0I/3aKenDSLsVjQ61iw85mgPKvowMdO8FO1yP2YmD14rHQV0xEdosBWJ9a+EA3eFOeCO0bhk+s5IJt+1apj+1hKCr5TfQ9/y0P7PiuApkWxZqn9jgrU9klL4Ho9nEDMl7xBW6GBmRukS2FUVsZw937kmfPdUleBI4qx28qk2YG662wTQRUUr0NEzue1khESw1lvA1gqTtFNBiDE1TGznnyTFXulwXMbFky8wLvmfiOuQ7DGIAM6qtSuMRmi9yrxLNh9qcS7Qay7M6eF5TWGlpXpKxrrkXMQqOh/6WdP40vrG4k2PM5RG4SJtLHVZ769grnZZrWUSVP1/Xzxpq/7RMloXIz/WZTdXbxhdL5Bhk2eJEDAKWh6s0S9Uybb4O5vN4+PttohX30T01aEeHvK+00SSUWqIUlbq5T8KLabmU9T/7muERg9ic1I9RQpzR8NIsA5ckaFTeOFQveocYGZpkc002kEsTQQZYcnnAQXaaGR/wB0MPmKZpXWuK8PH6KvMnyrhC4R2LvhiId4U1mLBYF9l1N6jwGzdOk28b2Z23ZV7a9mNYhoVFm4afrPi54EIinBpvPS0lpRnCv3HHolf2h4UJsX8OjnlMahTrzSl7wgAa4hk6r+V5ZtrpFV9MefbfXew==,iv:JDvlGGUNgGL8NR686ICKAK4ubuUigPhcpmL4mZ99K10=,tag:LQHxGNXR3bqe9FS6zCEFXw==,type:str] + os: + crt: ENC[AES256_GCM,data:VUbC46+eWBhMH1Nr1u7p4dCcZAwmxzEUzQGZpJJ/JSYXFfdmQ6DpfzodM1AmzcTWUzEco9xKrrMBRpQ2sGdSAwuOMjDPrfNZagXZoggV1x+MY5OqU9GKgY29GyhHeKcCVNf5xl71EytZ7Y5RYtzjkdnrq/UyQd/Yoypq3ONYiKE3t4V4MYMW4tlxcsuLsDuhV9edCdtfxbz0tbqZ212zN9UTiFalF+waM/sbFPYML+zYFhifjPtdCnqZ4diaGGOcgnYeZOXpCyDUpTpmDw3o5KoTo0RAPxVw6EN147CVMjCBGIZ76AqcVHfkLroj8WX2B3KrkRrEF3yp98kQYNuIBywzL41lFxSrE0xzoeNydbfxn/ec7CN4Sr4dZ723LaSyPU1OIp5Pl49GVeeWfIInw5RAiZ6+4/YSQ5Q8TOeUfjTMREak+9vO7j4YjNWP94g3GBAUh3pxRWkOaT5sn1KFfuPs+YiI2nj0bX1CPxWFRYskujvGFqziG55QNZruIFTAcmp1T8sWEjTIwboUYDtfp2wSImzTNaeaHpCoRKb4jCTxqXpgcAWsX+LLXjqRHucygvNOwUGLQLWwdd19uo5CCkpH/AO44/bJ1xBfrzSoTjF+tdGCA/nOToQmXPt3VKQRpkj7D2tBHnyUoR4eTtT3luznUUkY6Okr9U1WIuxeuAMwrINN3jV24vSTwYHAKmkqBA4nw/8s42sVIKENZwLdlh/bKqy6q1xiqH+x4QTTtkvvV3gW+UyPMIsKtBcUrw+jy+O0/sRifbmeMxDkPY9RYxcbsWdlqYoWq46hssBmedUwaWSTfLRrWq66PNCIu4jJrFs/ofn0U5Dul8be31DYHVZ6nLCY4LbO5ivdZ/u6Ff0+/uTV,iv:jMZjzQDTzsXT9XgEzkZheUbNC4TgiY8dl8a/Cf8LjaQ=,tag:X3P6aAE+Xny3o3EV+2AlxQ==,type:str] + key: ENC[AES256_GCM,data:eGDX+x/nMYStzTuOOxfNgY4oQ77f5YwkEia1Epf+yZFmU65tDcRMN07oU7Ud00hmvwcd7jdupCXpYNMOEcyUueVE81sAfi3EEn+/J9OTgM+GAnJYLfUUyE/FrkH7h5NzRigtuGxvMGjyNiZb9lEPW99LtVMCrkCWfGhkYZwAqQsZ+lRkIFiSkpEy/RCdQZ6b1UnxFSC3x1hlzoGfTVHkV3AobwCKRhcjOU3AWJHTR7eZ9I9H,iv:fIMUiGTCLyYEftLOvNuyW5rSdvLYXfeLO3g7ukr2cOo=,tag:sxliwJWj3Bj7Dmxal6AcLQ==,type:str] +sops: + shamir_threshold: 3 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKeVRTUUJRZ2Zqa1R1Y1cz + b2w1cHdnQlNzSTl3aXZEVlI5dXdXTDhTd2hjClAvNFo2SmVaMURFRVJqQzhUUG82 + QlpCT21GUFFxOEVBaGlnVS9vK2R2RmsKLS0tIC8wbHkyZ2dKdlo5ODJzUXZYVGRE + ZnlJZFROUE9pMVcrL0xiNDgzd3llSXMKQtILrCh9graeW8lTd0PEHUwDFHn+XZLe + Ergq4uC/ilHOQO++NGXa2VhXvg6ROkgroELMyKW5JwEuyBiadbsdpw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-11-05T18:25:50Z" + mac: ENC[AES256_GCM,data:LZOzQV15a5VXBFDXDkCCUxHUMaJ920lC1PaoxY9VJzV8OH7AlYIMGzZPoYmdJf7Ol4lzmNUX48csUdctcQzWEsRs9P9n8Qfpr+wI1riRwT6K7RtD+iDz3aOrOjOGSGcBUBdK9/KrMXAqWfOhCIXz/kXptx6nAaMLmodhqSaaiFs=,iv:ku3sr4L1b/Ttwg9eS0YVNhUJSWRo4eaGisDXXYMLVa0=,tag:L/q/Kk0sC9qvNNz6zgo5Gg==,type:str] + pgp: [] + version: 3.9.1 diff --git a/clusters/main/talos/talconfig.yaml b/clusters/main/talos/talconfig.yaml new file mode 100644 index 0000000..359703a --- /dev/null +++ b/clusters/main/talos/talconfig.yaml @@ -0,0 +1,121 @@ +clusterName: ${CLUSTERNAME} +# renovate: datasource=docker depName=ghcr.io/siderolabs/installer +talosVersion: v1.8.2 +# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet +kubernetesVersion: v1.31.2 +endpoint: https://${VIP}:6443 +allowSchedulingOnControlPlanes: true +additionalMachineCertSans: + - 127.0.0.1 + - ${VIP} +additionalApiServerCertSans: + - 127.0.0.1 + - ${VIP} +# Warning: Also used in Cilium CNI values! +clusterPodNets: + - ${PODNET} +clusterSvcNets: + - ${SVCNET} +cniConfig: + name: none +patches: + - '@./patches/all.yaml' +nodes: + # We would adivce to always stick to a "k8s-something-1" style naming scheme + - hostname: k8s-control-1 + ipAddress: ${MASTER1IP_IP} + controlPlane: true + nameservers: + - 1.1.1.1 + - 8.8.8.8 + installDiskSelector: + size: <= 1600GB + networkInterfaces: + # suffix is the adapter mac adres. + - interface: eth0 + addresses: + - ${MASTER1IP_CIDR} + routes: + - network: 0.0.0.0/0 + gateway: ${GATEWAY} + vip: + ip: ${VIP} +controlPlane: + patches: + - '@./patches/controlplane.yaml' + kernelModules: + - name: nvme_tcp + - name: vfio_pci + - name: uio_pci_generic + schematic: + customization: + extraKernelArgs: + - net.ifnames=0 + systemExtensions: + officialExtensions: + - siderolabs/util-linux-tools + - siderolabs/iscsi-tools + - siderolabs/qemu-guest-agent + machineFiles: + - content: | + [plugins."io.containerd.grpc.v1.cri"] + enable_unprivileged_ports = true + enable_unprivileged_icmp = true + [plugins."io.containerd.grpc.v1.cri".containerd] + discard_unpacked_layers = false + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] + discard_unpacked_layers = false + permissions: 0 + path: /etc/cri/conf.d/20-customization.part + op: create + - content: | + [ NFSMount_Global_Options ] + nfsvers=4.2 + hard=True + noatime=True + nodiratime=True + rsize=131072 + wsize=131072 + nconnect=8 + permissions: 420 + path: /etc/nfsmount.conf + op: overwrite + +worker: + patches: + - '@./patches/worker.yaml' + kernelModules: + - name: nvme_tcp + - name: vfio_pci + - name: uio_pci_generic + schematic: + customization: + systemExtensions: + officialExtensions: + - siderolabs/util-linux-tools + - siderolabs/iscsi-tools + - siderolabs/qemu-guest-agent + machineFiles: + - content: | + [plugins."io.containerd.grpc.v1.cri"] + enable_unprivileged_ports = true + enable_unprivileged_icmp = true + [plugins."io.containerd.grpc.v1.cri".containerd] + discard_unpacked_layers = false + [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc] + discard_unpacked_layers = false + permissions: 0 + path: /etc/cri/conf.d/20-customization.part + op: create + - content: | + [ NFSMount_Global_Options ] + nfsvers=4.2 + hard=True + noatime=True + nodiratime=True + rsize=131072 + wsize=131072 + nconnect=8 + permissions: 420 + path: /etc/nfsmount.conf + op: overwrite diff --git a/repositories/entries/kustomization.yaml b/repositories/entries/kustomization.yaml new file mode 100644 index 0000000..8fb7c14 --- /dev/null +++ b/repositories/entries/kustomization.yaml @@ -0,0 +1,5 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: [] diff --git a/repositories/flux-entry.yaml b/repositories/flux-entry.yaml new file mode 100644 index 0000000..6e329e7 --- /dev/null +++ b/repositories/flux-entry.yaml @@ -0,0 +1,41 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-entry-repos + namespace: flux-system +spec: + interval: 10m + path: ./repositories + prune: true + sourceRef: + kind: GitRepository + name: cluster + decryption: + provider: sops + secretRef: + name: sops-age + postBuild: + substituteFrom: + - kind: ConfigMap + name: cluster-config + patches: + - patch: |- + apiVersion: kustomize.toolkit.fluxcd.io/v1 + kind: Kustomization + metadata: + name: not-used + spec: + decryption: + provider: sops + secretRef: + name: sops-age + postBuild: + substituteFrom: + - kind: ConfigMap + name: cluster-config + target: + group: kustomize.toolkit.fluxcd.io + kind: Kustomization + labelSelector: substitution.flux.home.arpa/disabled notin (true) diff --git a/repositories/git/kustomization.yaml b/repositories/git/kustomization.yaml new file mode 100644 index 0000000..b726625 --- /dev/null +++ b/repositories/git/kustomization.yaml @@ -0,0 +1,7 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - this-repo.yaml + - truecharts.yaml diff --git a/repositories/git/this-repo.yaml b/repositories/git/this-repo.yaml new file mode 100644 index 0000000..4008b58 --- /dev/null +++ b/repositories/git/this-repo.yaml @@ -0,0 +1,20 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/gitrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: cluster + namespace: flux-system +spec: + interval: 30m + url: ssh://REPLACEWITHGITREPO + ref: + branch: main + secretRef: + name: deploy-key + ignore: | + # exclude all + /* + # include flux directories + !/clusters + !/repositories diff --git a/repositories/git/truecharts.yaml b/repositories/git/truecharts.yaml new file mode 100644 index 0000000..5d422a8 --- /dev/null +++ b/repositories/git/truecharts.yaml @@ -0,0 +1,19 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/gitrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: truecharts + namespace: flux-system +spec: + interval: 30m + url: https://github.com/truecharts/public/ + ref: + branch: master + secretRef: + name: deploy-key + ignore: | + # exclude all + /* + # include flux directories + !/repositories diff --git a/repositories/helm/bjw-s.yaml b/repositories/helm/bjw-s.yaml new file mode 100644 index 0000000..c32ccd8 --- /dev/null +++ b/repositories/helm/bjw-s.yaml @@ -0,0 +1,11 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: bjw-s + namespace: flux-system +spec: + type: oci + interval: 5m + url: oci://ghcr.io/bjw-s/helm diff --git a/repositories/helm/cilium.yaml b/repositories/helm/cilium.yaml new file mode 100644 index 0000000..2cd7146 --- /dev/null +++ b/repositories/helm/cilium.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cilium + namespace: flux-system +spec: + interval: 2h + url: https://helm.cilium.io diff --git a/repositories/helm/cloudnative-pg.yaml b/repositories/helm/cloudnative-pg.yaml new file mode 100644 index 0000000..4b2f0e6 --- /dev/null +++ b/repositories/helm/cloudnative-pg.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cloudnative-pg + namespace: flux-system +spec: + interval: 2h + url: https://cloudnative-pg.github.io/charts diff --git a/repositories/helm/coredns.yaml b/repositories/helm/coredns.yaml new file mode 100644 index 0000000..ed0bb65 --- /dev/null +++ b/repositories/helm/coredns.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: coredns + namespace: flux-system +spec: + interval: 2h + url: https://coredns.github.io/helm diff --git a/repositories/helm/csi-driver-nfs.yaml b/repositories/helm/csi-driver-nfs.yaml new file mode 100644 index 0000000..869fce3 --- /dev/null +++ b/repositories/helm/csi-driver-nfs.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: csi-driver-nfs + namespace: flux-system +spec: + interval: 2h + url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts diff --git a/repositories/helm/descheduler.yaml b/repositories/helm/descheduler.yaml new file mode 100644 index 0000000..147045c --- /dev/null +++ b/repositories/helm/descheduler.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: descheduler + namespace: flux-system +spec: + interval: 2h + url: https://kubernetes-sigs.github.io/descheduler diff --git a/repositories/helm/intel.yaml b/repositories/helm/intel.yaml new file mode 100644 index 0000000..fb2c66b --- /dev/null +++ b/repositories/helm/intel.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: intel + namespace: flux-system +spec: + interval: 2h + url: https://intel.github.io/helm-charts diff --git a/repositories/helm/jetstack.yaml b/repositories/helm/jetstack.yaml new file mode 100644 index 0000000..4bc09d0 --- /dev/null +++ b/repositories/helm/jetstack.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: jetstack + namespace: flux-system +spec: + interval: 2h + url: https://charts.jetstack.io/ diff --git a/repositories/helm/kubernetes-sigs-metrics-server.yaml b/repositories/helm/kubernetes-sigs-metrics-server.yaml new file mode 100644 index 0000000..76ceb47 --- /dev/null +++ b/repositories/helm/kubernetes-sigs-metrics-server.yaml @@ -0,0 +1,10 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/source.toolkit.fluxcd.io/helmrepository_v1beta2.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: kubernetes-sigs-metrics-server + namespace: flux-system +spec: + interval: 30m + url: https://kubernetes-sigs.github.io/metrics-server/ + timeout: 3m diff --git a/repositories/helm/kustomization.yaml b/repositories/helm/kustomization.yaml new file mode 100644 index 0000000..f45b04a --- /dev/null +++ b/repositories/helm/kustomization.yaml @@ -0,0 +1,31 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: helm-repos + namespace: flux-system +resources: + - bjw-s.yaml + - cilium.yaml + - cloudnative-pg.yaml + - coredns.yaml + - csi-driver-nfs.yaml + - descheduler.yaml + - intel.yaml + - jetstack.yaml + - kubernetes-sigs-metrics-server.yaml + - kustomization.yaml + - kyverno.yaml + - longhorn.yaml + - metallb.yaml + - metrics-server.yaml + - node-feature-discovery.yaml + - nvidia.yaml + - openebs.yaml + - piraeus.yaml + - postfinance.yaml + - prometheus-community.yaml + - spegel.yaml + - stakater.yaml + - topolvm.yaml + - truecharts.yaml +# more goes here! diff --git a/repositories/helm/kyverno.yaml b/repositories/helm/kyverno.yaml new file mode 100644 index 0000000..b86efb0 --- /dev/null +++ b/repositories/helm/kyverno.yaml @@ -0,0 +1,11 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: kyverno + namespace: flux-system +spec: + type: oci + interval: 5m + url: oci://ghcr.io/kyverno/charts diff --git a/repositories/helm/longhorn.yaml b/repositories/helm/longhorn.yaml new file mode 100644 index 0000000..72c7b08 --- /dev/null +++ b/repositories/helm/longhorn.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: longhorn + namespace: flux-system +spec: + interval: 2h + url: https://charts.longhorn.io diff --git a/repositories/helm/metallb.yaml b/repositories/helm/metallb.yaml new file mode 100644 index 0000000..582103f --- /dev/null +++ b/repositories/helm/metallb.yaml @@ -0,0 +1,9 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: metallb + namespace: flux-system +spec: + interval: 10m + url: https://metallb.github.io/metallb + timeout: 3m diff --git a/repositories/helm/metrics-server.yaml b/repositories/helm/metrics-server.yaml new file mode 100644 index 0000000..5b2d20f --- /dev/null +++ b/repositories/helm/metrics-server.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: metrics-server + namespace: flux-system +spec: + interval: 2h + url: https://kubernetes-sigs.github.io/metrics-server diff --git a/repositories/helm/node-feature-discovery.yaml b/repositories/helm/node-feature-discovery.yaml new file mode 100644 index 0000000..5e45d5a --- /dev/null +++ b/repositories/helm/node-feature-discovery.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: node-feature-discovery + namespace: flux-system +spec: + interval: 2h + url: https://kubernetes-sigs.github.io/node-feature-discovery/charts diff --git a/repositories/helm/nvidia.yaml b/repositories/helm/nvidia.yaml new file mode 100644 index 0000000..15b22d7 --- /dev/null +++ b/repositories/helm/nvidia.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: nvidia + namespace: flux-system +spec: + interval: 2h + url: https://helm.ngc.nvidia.com/nvidia diff --git a/repositories/helm/openebs.yaml b/repositories/helm/openebs.yaml new file mode 100644 index 0000000..1393038 --- /dev/null +++ b/repositories/helm/openebs.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: openebs + namespace: flux-system +spec: + interval: 2h + url: https://openebs.github.io/openebs diff --git a/repositories/helm/piraeus.yaml b/repositories/helm/piraeus.yaml new file mode 100644 index 0000000..4fe31dd --- /dev/null +++ b/repositories/helm/piraeus.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: piraeus + namespace: flux-system +spec: + interval: 2h + url: https://piraeus.io/helm-charts/ diff --git a/repositories/helm/postfinance.yaml b/repositories/helm/postfinance.yaml new file mode 100644 index 0000000..015568b --- /dev/null +++ b/repositories/helm/postfinance.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: postfinance + namespace: flux-system +spec: + interval: 2h + url: https://postfinance.github.io/kubelet-csr-approver diff --git a/repositories/helm/prometheus-community.yaml b/repositories/helm/prometheus-community.yaml new file mode 100644 index 0000000..78c4f0c --- /dev/null +++ b/repositories/helm/prometheus-community.yaml @@ -0,0 +1,11 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: prometheus-community + namespace: flux-system +spec: + type: oci + interval: 5m + url: oci://ghcr.io/prometheus-community/charts diff --git a/repositories/helm/spegel.yaml b/repositories/helm/spegel.yaml new file mode 100644 index 0000000..0350b3a --- /dev/null +++ b/repositories/helm/spegel.yaml @@ -0,0 +1,11 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: spegel + namespace: flux-system +spec: + type: oci + interval: 5m + url: oci://ghcr.io/spegel-org/helm-charts diff --git a/repositories/helm/stakater.yaml b/repositories/helm/stakater.yaml new file mode 100644 index 0000000..838185d --- /dev/null +++ b/repositories/helm/stakater.yaml @@ -0,0 +1,11 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: stakater + namespace: flux-system +spec: + type: oci + interval: 5m + url: oci://ghcr.io/stakater/charts diff --git a/repositories/helm/topolvm.yaml b/repositories/helm/topolvm.yaml new file mode 100644 index 0000000..3b438b6 --- /dev/null +++ b/repositories/helm/topolvm.yaml @@ -0,0 +1,10 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: topolvm + namespace: flux-system +spec: + interval: 2h + url: https://topolvm.github.io/topolvm diff --git a/repositories/helm/truecharts.yaml b/repositories/helm/truecharts.yaml new file mode 100644 index 0000000..f6b2170 --- /dev/null +++ b/repositories/helm/truecharts.yaml @@ -0,0 +1,10 @@ +# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/source.toolkit.fluxcd.io/helmrepository_v1beta2.json +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: truecharts + namespace: flux-system +spec: + type: oci + interval: 5m + url: oci://tccr.io/truecharts diff --git a/repositories/kustomization.yaml b/repositories/kustomization.yaml new file mode 100644 index 0000000..b3cdd96 --- /dev/null +++ b/repositories/kustomization.yaml @@ -0,0 +1,9 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./git + - ./helm + - ./oci + - ./entries diff --git a/repositories/oci/flux-manifests.yaml b/repositories/oci/flux-manifests.yaml new file mode 100644 index 0000000..5ea8be3 --- /dev/null +++ b/repositories/oci/flux-manifests.yaml @@ -0,0 +1,12 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json +apiVersion: source.toolkit.fluxcd.io/v1beta2 +kind: OCIRepository +metadata: + name: flux-manifests + namespace: flux-system +spec: + interval: 10m + url: oci://ghcr.io/fluxcd/flux-manifests + ref: + tag: v2.4.0 diff --git a/repositories/oci/kustomization.yaml b/repositories/oci/kustomization.yaml new file mode 100644 index 0000000..c3cad7b --- /dev/null +++ b/repositories/oci/kustomization.yaml @@ -0,0 +1,6 @@ +--- +# yaml-language-server: $schema=https://json.schemastore.org/kustomization +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - flux-manifests.yaml diff --git a/ssh-public-key.txt b/ssh-public-key.txt new file mode 100644 index 0000000..8f3ed9a --- /dev/null +++ b/ssh-public-key.txt @@ -0,0 +1 @@ +ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBNkxd9YxJp9mYQH/ZuUYCgMTm6G3yPDwy2f05k9J4/KNVYRbWYfBTHPbkCIOHzZGJxZlvVQoSVrLn398H5qRTVRf5eDb8HDTMu8tDoNhmCcLF96ZkI1IuWvSteeVSXxINw==