repo migration

2025-05-13 08:49:46 -04:00
commit 21a45f1d09
135 changed files with 2698 additions and 0 deletions
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - kyverno-policies/ks.yaml
+  - metallb-config/ks.yaml
+  - system-upgrade-controller-plans/ks.yaml
@@ -0,0 +1,53 @@
+## This Can be enabled in the kustomization.yaml file.
+## Please note not every chart or application is compatible with this behavior
+## Primarily operators spinning their own pods, might include conflicting validation
+## Add manual exclusions where needed
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: resolve-image-to-digest
+  annotations:
+    policies.kyverno.io/title: Resolve Image to Digest
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/severity: medium
+    kyverno.io/kyverno-version: 1.6.0
+    policies.kyverno.io/minversion: 1.6.0
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Image tags are mutable and the change of an image can result in the same tag.
+      This policy resolves the image digest of each image in a container and replaces
+      the image with the fully resolved reference which includes the digest rather than tag.
+spec:
+  background: false
+  rules:
+  - name: resolve-to-digest
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    exclude:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              name: '*cnpg*'
+    preconditions:
+      all:
+      - key: "{{request.operation || 'BACKGROUND'}}"
+        operator: NotEquals
+        value: DELETE
+    mutate:
+      foreach:
+      - list: "request.object.spec.containers"
+        context:
+          - name: resolvedRef
+            imageRegistry:
+              reference: "{{ element.image }}"
+              jmesPath: "resolvedImage"
+        patchStrategicMerge:
+          spec:
+            containers:
+            - name: "{{ element.name }}"
+              image: "{{ resolvedRef }}"
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - schematic-to-pod.yaml
+  # - ensure-digest.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: kyverno.io/v2beta1
+kind: ClusterPolicy
+metadata:
+  name: mutate-pod-binding
+  annotations:
+    pod-policies.kyverno.io/autogen-controllers: none
+    policies.kyverno.io/title: Mutate Pod Add Schematic
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.10.0
+    policies.kyverno.io/minversion: 1.10.0
+    kyverno.io/kubernetes-version: "1.30"
+spec:
+  background: false
+  rules:
+    - name: project-foo
+      match:
+        any:
+        - resources:
+            kinds:
+            - Pod/binding
+            names:
+            - apply-talos*
+      context:
+      - name: node
+        variable:
+          jmesPath: request.object.target.name
+          default: ''
+      - name: schematic
+        apiCall:
+          urlPath: "/api/v1/nodes/{{node}}"
+          jmesPath: "metadata.annotations.\"extensions.talos.dev/schematic\" || 'empty'"
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              extensions.talos.dev/schematic: "{{ schematic }}"
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/core/kyverno-policies/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,42 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metallb-config
+  namespace: metallb-config
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: metallb-config
+      version: 8.2.2
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  driftDetection:
+    mode: warn
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    L2Advertisements:
+      - name: main
+        addressPools:
+          - main
+    ipAddressPools:
+      - name: main
+        autoAssign: false
+        avoidBuggyIPs: true
+        addresses:
+          - ${METALLB_RANGE}
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-release.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: metallb-config
+    labels:
+        pod-security.kubernetes.io/enforce: privileged
+        topolvm.io/webhook: ignore
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-config
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/core/metallb-config/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+
@@ -0,0 +1,52 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: kubernetes
+  namespace: system-upgrade
+spec:
+  version: ${KUBERNETES_VERSION}
+  serviceAccountName: system-upgrade
+  secrets:
+  - name: talos
+    path: /var/run/secrets/talos.dev
+    ignoreUpdates: true
+  concurrency: 1
+  exclusive: true
+  nodeSelector:
+    matchExpressions:
+      - key: feature.node.kubernetes.io/system-os_release.ID
+        operator: In
+        values: ["talos"]
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+      - key: feature.node.kubernetes.io/system-os_release.VERSION_ID
+        operator: In
+        values: ["${TALOS_VERSION}"]
+      - key: kubernetes.io/hostname
+        operator: In
+        values: ["k8s-control-1"]
+  tolerations:
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+  prepare: &prepare
+    image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
+    envs:
+      - name: NODE_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.hostIP
+    args:
+      - --nodes=$(NODE_IP)
+      - health
+      - --server=false
+  upgrade:
+    <<: *prepare
+    args:
+      - --nodes=$(NODE_IP)
+      - upgrade-k8s
+      - --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - schematics.yaml
+  - kubernetes.yaml
+  - talos.yaml
@@ -0,0 +1,53 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
+apiVersion: upgrade.cattle.io/v1
+kind: Plan
+metadata:
+  name: talos
+  namespace: system-upgrade
+spec:
+  version: ${TALOS_VERSION}
+  serviceAccountName: system-upgrade
+  secrets:
+    - name: talos
+      path: /var/run/secrets/talos.dev
+      ignoreUpdates: true
+  concurrency: 1
+  exclusive: true
+  nodeSelector:
+    matchExpressions:
+      - key: feature.node.kubernetes.io/system-os_release.ID
+        operator: In
+        values: ["talos"]
+      - key: feature.node.kubernetes.io/system-os_release.VERSION_ID
+        operator: NotIn
+        values: ["${TALOS_VERSION}"]
+  tolerations:
+    - key: CriticalAddonsOnly
+      operator: Exists
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  prepare: &prepare
+    image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
+    envs:
+      - name: NODE_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.hostIP
+      - name: SCHEMATIC
+        valueFrom:
+          fieldRef:
+            fieldPath: metadata.annotations['extensions.talos.dev/schematic']
+    args:
+      - --nodes=$(NODE_IP)
+      - health
+      - --server=false
+  upgrade:
+    <<: *prepare
+    args:
+      - --nodes=$(NODE_IP)
+      - upgrade
+      - --image=factory.talos.dev/installer/$(SCHEMATIC):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
+      - --preserve=true
+      - --wait=false
+      - --force
@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: system-upgrade-controller-plans
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: clusters/main/kubernetes/core/system-upgrade-controller-plans/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: cluster
+