DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases 1 Wiki Activity

integrate clustertool sourcecode

Browse Source
This commit is contained in:
Kjeld Schouten
2024-10-16 14:06:31 +02:00
parent bc2a642e7a
commit 6365c6205f
265 changed files with 24073 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
clustertool/embed/generic/base/DOTREPLACEgitignore
+9
View File
@@ -0,0 +1,9 @@
talconfig.json
clusterconfig
patches/sopssecret.yaml
cluster/main/kubernetes/**/bootstrap-values.yaml.ct
*kubeconfig
clustertool/embed/generic/base/clusterenv.yaml
+17
View File
@@ -0,0 +1,17 @@
## The Following are required by ClusterTool and CANNOT be removed
# Ensure VIP is different from all master IPs
VIP: 192.168.20.200
# Defines the MasterNode IP
MASTER1IP: 192.168.20.210
# Defines the gateway for all nodes
GATEWAY: 192.168.20.1
# Defines the ip range metallb is allowed to use
METALLB_RANGE: 192.168.20.211-192.168.20.219
# Sets the Kubernetes Dashboard IP. Has to be within METALLB_RANGE and not in use
DASHBOARD_IP: 192.168.20.211
# Used to automatically generate a sshkey-pair for FluxCD
# Has to start with ssh://
GITHUB_REPOSITORY: ""
# DO NOT ALTER
PODNET: 172.16.0.0/16
SVCNET: 172.17.0.0/16
clustertool/embed/generic/base/talos/talconfig.yaml
+82
View File
@@ -0,0 +1,82 @@
clusterName: ${CLUSTERNAME}
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
talosVersion: v1.8.1
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
kubernetesVersion: v1.31.1
endpoint: https://${VIP}:6443
allowSchedulingOnControlPlanes: true
additionalMachineCertSans:
- ${VIP}
additionalApiServerCertSans:
- ${VIP}
# Warning: Also used in Cilium CNI values!
clusterPodNets:
- ${PODNET}
clusterSvcNets:
- ${SVCNET}
cniConfig:
name: none
patches:
- '@./patches/all.yaml'
nodes:
# We would adivce to always stick to a "k8s-something-1" style naming scheme
- hostname: k8s-control-1
ipAddress: ${MASTER1IP_IP}
controlPlane: true
nameservers:
- 1.1.1.1
- 8.8.8.8
installDiskSelector:
size: <= 1600GB
networkInterfaces:
# suffix is the adapter mac adres.
- interface: eth0
addresses:
- ${MASTER1IP_CIDR}
routes:
- network: 0.0.0.0/0
gateway: ${GATEWAY}
vip:
ip: ${VIP}
controlPlane:
patches:
- '@./patches/controlplane.yaml'
- '@./patches/sopssecret.yaml'
- '@./patches/manifests.yaml'
# - '@./patches/nvidia.yaml'
schematic:
customization:
extraKernelArgs:
- net.ifnames=0
systemExtensions:
officialExtensions:
- siderolabs/util-linux-tools
- siderolabs/iscsi-tools
- siderolabs/qemu-guest-agent
# Enable where needed
# - siderolabs/amd-ucode
# - siderolabs/bnx2-bnx2x
# - siderolabs/drbd
# - siderolabs/gasket-driver
# - siderolabs/i915-ucode
# - siderolabs/intel-ucode
# - siderolabs/thunderbolt
worker:
patches:
- '@./patches/worker.yaml'
# - '@./patches/nvidia.yaml'
schematic:
customization:
systemExtensions:
officialExtensions:
- siderolabs/util-linux-tools
- siderolabs/iscsi-tools
- siderolabs/qemu-guest-agent
# Enable where needed
# - siderolabs/amd-ucode
# - siderolabs/bnx2-bnx2x
# - siderolabs/drbd
# - siderolabs/gasket-driver
# - siderolabs/i915-ucode
# - siderolabs/intel-ucode
# - siderolabs/thunderbolt
clustertool/embed/generic/kubernetes/apps/kubernetes-dashboard/app/helm-release.yaml
+37
View File
@@ -0,0 +1,37 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
spec:
interval: 15m
chart:
spec:
chart: kubernetes-dashboard
version: 1.8.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
service:
main:
type: LoadBalancer
loadBalancerIP: ${DASHBOARD_IP}
ports:
main:
port: 80
clustertool/embed/generic/kubernetes/apps/kubernetes-dashboard/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: kubernetes-dashboard
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- schematic-to-pod.yaml
clustertool/embed/generic/kubernetes/core/kyverno-policies/app/schematic-to-pod.yaml
+38
View File
@@ -0,0 +1,38 @@
---
apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
name: mutate-pod-binding
annotations:
pod-policies.kyverno.io/autogen-controllers: none
policies.kyverno.io/title: Mutate Pod Add Schematic
policies.kyverno.io/category: Other
policies.kyverno.io/subject: Pod
kyverno.io/kyverno-version: 1.10.0
policies.kyverno.io/minversion: 1.10.0
kyverno.io/kubernetes-version: "1.30"
spec:
background: false
rules:
- name: project-foo
match:
any:
- resources:
kinds:
- Pod/binding
names:
- apply-talos*
context:
- name: node
variable:
jmesPath: request.object.target.name
default: ''
- name: schematic
apiCall:
urlPath: "/api/v1/nodes/{{node}}"
jmesPath: "metadata.annotations.\"extensions.talos.dev/schematic\" || 'empty'"
mutate:
patchStrategicMerge:
metadata:
annotations:
extensions.talos.dev/schematic: "{{ schematic }}"
clustertool/embed/generic/kubernetes/core/kyverno-policies/ks.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kyverno-policies
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/core/kyverno-policies/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clustertool/embed/generic/kubernetes/core/metallb-config/app/helm-release.yaml
+40
View File
@@ -0,0 +1,40 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metallb-config
namespace: metallb-config
spec:
interval: 15m
chart:
spec:
chart: metallb-config
version: 8.2.1
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
L2Advertisements:
- name: main
addressPools:
- main
ipAddressPools:
- name: main
autoAssign: false
avoidBuggyIPs: true
addresses:
- ${METALLB_RANGE}
clustertool/embed/generic/kubernetes/core/metallb-config/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: metallb-config
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/core/system-upgrade-controller-plans/app/kubernetes.yaml
+51
View File
@@ -0,0 +1,51 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: kubernetes
spec:
version: ${KUBERNETES_VERSION}
serviceAccountName: system-upgrade
secrets:
- name: talos
path: /var/run/secrets/talos.dev
ignoreUpdates: true
concurrency: 1
exclusive: true
nodeSelector:
matchExpressions:
- key: feature.node.kubernetes.io/system-os_release.ID
operator: In
values: ["talos"]
- key: node-role.kubernetes.io/control-plane
operator: Exists
- key: feature.node.kubernetes.io/system-os_release.VERSION_ID
operator: In
values: ["${TALOS_VERSION}"]
- key: kubernetes.io/hostname
operator: In
values: ["k8s-control-1"]
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
prepare: &prepare
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
envs:
- name: NODE_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
args:
- --nodes=$(NODE_IP)
- health
- --server=false
upgrade:
<<: *prepare
args:
- --nodes=$(NODE_IP)
- upgrade-k8s
- --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
clustertool/embed/generic/kubernetes/core/system-upgrade-controller-plans/app/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
# - schematics.yaml
- kubernetes.yaml
- talos.yaml
clustertool/embed/generic/kubernetes/core/system-upgrade-controller-plans/app/talos.yaml
+52
View File
@@ -0,0 +1,52 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
apiVersion: upgrade.cattle.io/v1
kind: Plan
metadata:
name: talos
spec:
version: ${TALOS_VERSION}
serviceAccountName: system-upgrade
secrets:
- name: talos
path: /var/run/secrets/talos.dev
ignoreUpdates: true
concurrency: 1
exclusive: true
nodeSelector:
matchExpressions:
- key: feature.node.kubernetes.io/system-os_release.ID
operator: In
values: ["talos"]
- key: feature.node.kubernetes.io/system-os_release.VERSION_ID
operator: NotIn
values: ["${TALOS_VERSION}"]
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
prepare: &prepare
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
envs:
- name: NODE_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
- name: SCHEMATIC
valueFrom:
fieldRef:
fieldPath: metadata.annotations['extensions.talos.dev/schematic']
args:
- --nodes=$(NODE_IP)
- health
- --server=false
upgrade:
<<: *prepare
args:
- --nodes=$(NODE_IP)
- upgrade
- --image=factory.talos.dev/installer/$(SCHEMATIC):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
- --preserve=true
- --wait=false
- --force
clustertool/embed/generic/kubernetes/core/system-upgrade-controller-plans/ks.yaml
+19
View File
@@ -0,0 +1,19 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: system-upgrade-controller-plans
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/core/system-upgrade-controller-plans/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
targetNamespace: system-upgrade
dependsOn:
- name: system-upgrade-controller
wait: false
retryInterval: 1m
timeout: 5m
clustertool/embed/generic/kubernetes/flux-entry.yaml
+43
View File
@@ -0,0 +1,43 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-entry
namespace: flux-system
spec:
interval: 10m
path: ./clusters/REPLACEWITHCLUSTERNAME/kubernetes
prune: true
sourceRef:
kind: GitRepository
name: cluster
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-config
patches:
- patch: |-
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: not-used
spec:
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-config
- kind: ConfigMap
name: upgrade-settings
target:
group: kustomize.toolkit.fluxcd.io
kind: Kustomization
labelSelector: substitution.flux.home.arpa/disabled notin (true)
clustertool/embed/generic/kubernetes/flux-system/flux/bootstrap.yaml.ct
+62
View File
@@ -0,0 +1,62 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- github.com/fluxcd/flux2/manifests/install?ref=v2.3.0
- ./deploykey.secret.yaml
- ./clustersettings.secret.yaml
patches:
# Remove the built-in network policies
- target:
group: networking.k8s.io
kind: NetworkPolicy
patch: |
$patch: delete
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: not-used
# Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
- target:
kind: ResourceQuota
name: critical-pods
patch: |
- op: replace
path: /metadata/name
value: critical-pods-flux-system
- target:
kind: ClusterRoleBinding
name: cluster-reconciler
patch: |
- op: replace
path: /metadata/name
value: cluster-reconciler-flux-system
- target:
kind: ClusterRoleBinding
name: crd-controller
patch: |
- op: replace
path: /metadata/name
value: crd-controller-flux-system
- target:
kind: ClusterRole
name: crd-controller
patch: |
- op: replace
path: /metadata/name
value: crd-controller-flux-system
- target:
kind: ClusterRole
name: flux-edit
patch: |
- op: replace
path: /metadata/name
value: flux-edit-flux-system
- target:
kind: ClusterRole
name: flux-view
patch: |
- op: replace
path: /metadata/name
value: flux-view-flux-system
clustertool/embed/generic/kubernetes/flux-system/flux/clustersettings.secret.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-config
namespace: flux-system
data:
REPLACEWITHENV
clustertool/embed/generic/kubernetes/flux-system/flux/flux.yaml
+87
View File
@@ -0,0 +1,87 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux
namespace: flux-system
spec:
interval: 10m
path: ./
prune: true
wait: true
sourceRef:
kind: OCIRepository
name: flux-manifests
patches:
# Remove the network policies that does not work with k3s
- patch: |
$patch: delete
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: not-used
target:
group: networking.k8s.io
kind: NetworkPolicy
# Increase the number of reconciliations that can be performed in parallel and bump the resources limits
# Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#increase-the-number-of-workers
- patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --concurrent=12
- op: add
path: /spec/template/spec/containers/0/args/-
value: --kube-api-qps=500
- op: add
path: /spec/template/spec/containers/0/args/-
value: --kube-api-burst=1000
- op: add
path: /spec/template/spec/containers/0/args/-
value: --requeue-dependency=5s
target:
kind: Deployment
name: (kustomize-controller|helm-controller|source-controller)
- patch: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: not-used
spec:
template:
spec:
containers:
- name: manager
resources:
limits:
memory: 2Gi
target:
kind: Deployment
name: (kustomize-controller|helm-controller|source-controller)
# Enable in-memory-kustomize builds
# Ref: https://fluxcd.io/flux/installation/configuration/vertical-scaling/#enable-in-memory-kustomize-builds
- patch: |
- op: replace
path: /spec/template/spec/volumes/0
value:
name: temp
emptyDir:
medium: Memory
target:
kind: Deployment
name: kustomize-controller
# Enable Helm near OOM detection
# Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#enable-helm-near-oom-detection
- patch: |
- op: add
path: /spec/template/spec/containers/0/args/-
value: --feature-gates=OOMWatch=true
- op: add
path: /spec/template/spec/containers/0/args/-
value: --oom-watch-memory-threshold=95
- op: add
path: /spec/template/spec/containers/0/args/-
value: --oom-watch-interval=500ms
target:
kind: Deployment
name: helm-controller
clustertool/embed/generic/kubernetes/flux-system/flux/kustomization.yaml
+10
View File
@@ -0,0 +1,10 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./deploykey.secret.yaml
- ./clustersettings.secret.yaml
- ./flux.yaml
- ./upgradesettings.yaml
- ./namespace.yaml
clustertool/embed/generic/kubernetes/flux-system/flux/namespace.yaml
+8
View File
@@ -0,0 +1,8 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/flux-system/flux/upgradesettings.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: upgrade-settings
namespace: flux-system
data:
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
TALOS_VERSION: v1.8.1
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
KUBERNETES_VERSION: v1.31.1
clustertool/embed/generic/kubernetes/kube-system/cilium/app/bootstrap-values.yaml.ct
+3
View File
@@ -0,0 +1,3 @@
## DO NOT ALTER THIS FILE, CHANGE DO NOT PERSIST. Alter TalEnv.yaml instead.
hubble:
enabled: false
clustertool/embed/generic/kubernetes/kube-system/cilium/app/helm-release.yaml
+78
View File
@@ -0,0 +1,78 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cilium
namespace: kube-system
annotations:
meta.helm.sh/release-name: cilium
meta.helm.sh/release-namespace: kube-system
labels:
app.kubernetes.io/managed-by: Helm
spec:
interval: 15m
chart:
spec:
chart: cilium
version: 1.16.2
sourceRef:
kind: HelmRepository
name: cilium
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
remediateLastFailure: true
uninstall:
keepHistory: false
values:
# autoDirectNodeRoutes: true
# routingMode: native
hubble:
enabled: false
cluster:
name: ${CLUSTERNAME}
id: 1
ipv4NativeRoutingCIDR: ${PODNET}
securityContext:
privileged: true
capabilities:
ciliumAgent:
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
cleanCiliumState:
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
cgroup:
automount:
enabled: false
hostRoot: /sys/fs/cgroup
enableRuntimeDeviceDetection: true
endpointRoutes:
enabled: true
ipam:
mode: kubernetes
k8sServiceHost: 127.0.0.1
k8sServicePort: 7445
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
localRedirectPolicy: true
operator:
rollOutPods: true
rollOutCiliumPods: true
clustertool/embed/generic/kubernetes/kube-system/descheduler/app/helm-release.yaml
+66
View File
@@ -0,0 +1,66 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: descheduler
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: descheduler
version: 0.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
kind: Deployment
deschedulerPolicy:
strategies:
RemoveDuplicates:
enabled: true
RemovePodsViolatingNodeTaints:
enabled: true
RemovePodsViolatingNodeAffinity:
enabled: true
params:
nodeAffinityType:
- requiredDuringSchedulingIgnoredDuringExecution
RemovePodsViolatingTopologySpreadConstraint:
enabled: true
params:
includeSoftConstraints: true
RemovePodsViolatingInterPodAntiAffinity:
enabled: true
params:
nodeFit: true
LowNodeUtilization:
enabled: false
RemoveFailedPods:
enabled: true
params:
failedPods:
includingInitContainers: true
excludeOwnerKinds:
- Job
minPodLifetimeSeconds: 3600
RemovePodsHavingTooManyRestarts:
enabled: true
params:
podsHavingTooManyRestarts:
podRestartThreshold: 100
includingInitContainers: true
clustertool/embed/generic/kubernetes/kube-system/kubelet-csr-approver/app/bootstrap-values.yaml.ct
+3
View File
@@ -0,0 +1,3 @@
metrics:
main:
enabled: false
clustertool/embed/generic/kubernetes/kube-system/kubelet-csr-approver/app/helm-release.yaml
+18
View File
@@ -0,0 +1,18 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kubelet-csr-approver
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: kubelet-csr-approver
version: 1.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 30m
values: {}
clustertool/embed/generic/kubernetes/kube-system/metrics-server/app/helm-release.yaml
+29
View File
@@ -0,0 +1,29 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metrics-server
namespace: kube-system
spec:
interval: 15m
chart:
spec:
chart: metrics-server
version: 0.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
uninstall:
keepHistory: false
values:
clustertool/embed/generic/kubernetes/kube-system/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: kube-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/kube-system/node-feature-discovery/app/helm-release.yaml
+34
View File
@@ -0,0 +1,34 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: node-feature-discovery
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: node-feature-discovery
version: 0.1.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
install:
crds: CreateReplace
remediation:
retries: 3
upgrade:
cleanupOnFail: true
crds: CreateReplace
remediation:
strategy: rollback
retries: 3
values:
worker:
config:
core:
sources: ["pci", "system", "usb"]
prometheus:
enable: true
clustertool/embed/generic/kubernetes/kube-system/spegel/app/helm-release.yaml
+49
View File
@@ -0,0 +1,49 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: spegel
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: spegel
version: v0.0.27
sourceRef:
kind: HelmRepository
name: spegel
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
grafanaDashboard:
enabled: true
serviceMonitor:
enabled: false
spegel:
containerdSock: /run/containerd/containerd.sock
containerdRegistryConfigPath: /etc/cri/conf.d/hosts
appendMirrors: true
registries:
- https://tccr.io
- https://cgr.dev
- https://docker.io
- https://ghcr.io
- https://quay.io
- https://mcr.microsoft.com
- https://public.ecr.aws
- https://gcr.io
- https://registry.k8s.io
- https://k8s.gcr.io
- https://lscr.io
service:
registry:
hostPort: 29999
clustertool/embed/generic/kubernetes/system/cert-manager/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cert-manager
namespace: cert-manager
spec:
interval: 5m
chart:
spec:
chart: cert-manager
version: 6.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
clustertool/embed/generic/kubernetes/system/cloudnative-pg/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: cloudnative-pg
namespace: cloudnative-pg
spec:
interval: 5m
chart:
spec:
chart: cloudnative-pg
version: 8.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
clustertool/embed/generic/kubernetes/system/csi-driver-nfs/app/helm-release.yaml
+26
View File
@@ -0,0 +1,26 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: csi-driver-nfs
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: csi-driver-nfs
version: 5.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
clustertool/embed/generic/kubernetes/system/csi-driver-smb/app/helm-release.yaml
+26
View File
@@ -0,0 +1,26 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: csi-driver-smb
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: csi-driver-smb
version: 5.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
clustertool/embed/generic/kubernetes/system/kubernetes-reflector/app/helm-release.yaml
+29
View File
@@ -0,0 +1,29 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kubernetes-reflector
namespace: snapshot-controller
spec:
interval: 15m
chart:
spec:
chart: kubernetes-reflector
version: 6.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
clustertool/embed/generic/kubernetes/system/kyverno/app/helm-release.yaml
+195
View File
@@ -0,0 +1,195 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: kyverno
namespace: kyverno
spec:
interval: 15m
chart:
spec:
chart: kyverno
version: 3.2.7
sourceRef:
kind: HelmRepository
name: kyverno
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values:
crds:
install: true
grafana:
enabled: true
annotations:
grafana_folder: System
backgroundController:
serviceMonitor:
enabled: true
rbac:
clusterRole:
extraResources:
- apiGroups:
- ""
resources:
- ingresses
- pods
- nodes
verbs:
- create
- update
- patch
- delete
- get
- list
cleanupController:
serviceMonitor:
enabled: true
reportsController:
serviceMonitor:
enabled: true
admissionController:
replicas: 3
serviceMonitor:
enabled: true
rbac:
clusterRole:
extraResources:
- apiGroups:
- ""
resources:
- ingresses
- pods
- nodes
verbs:
- create
- update
- delete
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedule
labelSelector:
matchLabels:
app.kubernetes.io/instance: kyverno
app.kubernetes.io/component: kyverno
config:
# -- Resource types to be skipped by the Kyverno policy engine.
# Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list.
# These are joined together without spaces, run through `tpl`, and the result is set in the config map.
# @default -- See [values.yaml](values.yaml)
resourceFilters:
- '[Event,*,*]'
- '[*/*,kube-system,*]'
- '[*/*,kube-public,*]'
- '[*/*,kube-node-lease,*]'
- '[Node,*,*]'
- '[Node/*,*,*]'
- '[APIService,*,*]'
- '[APIService/*,*,*]'
- '[TokenReview,*,*]'
- '[SubjectAccessReview,*,*]'
- '[SelfSubjectAccessReview,*,*]'
- '[ReplicaSet,*,*]'
- '[ReplicaSet/*,*,*]'
# exclude resources from the chart
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
- '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
- '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
- '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
- '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
- '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
clustertool/embed/generic/kubernetes/system/kyverno/app/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-release.yaml
- namespace.yaml
clustertool/embed/generic/kubernetes/system/kyverno/app/namespace.yaml
+8
View File
@@ -0,0 +1,8 @@
apiVersion: v1
kind: Namespace
metadata:
name: kyverno
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
goldilocks.fairwinds.com/enabled: "true"
pod-security.kubernetes.io/enforce: privileged
clustertool/embed/generic/kubernetes/system/kyverno/ks.yaml
+12
View File
@@ -0,0 +1,12 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: kyverno
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/kyverno/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clustertool/embed/generic/kubernetes/system/longhorn/app/helm-release.yaml
+38
View File
@@ -0,0 +1,38 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: longhorn
namespace: longhorn-system
spec:
interval: 5m
releaseName: longhorn
chart:
spec:
chart: longhorn
version: 1.7.1
sourceRef:
kind: HelmRepository
name: longhorn
namespace: flux-system
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
defaultSettings:
# Increase to 3 for a multi-node cluster
defaultReplicaCount: 1
# Overprovisioning might be needed when using volsync
storageOverProvisioningPercentage: 100000
# v2DataEngine: true
persistence:
# Set to false to pick another CSI as default
defaultClass: true
# Increase to 3 for a multi-node cluster
defaultClassReplicaCount: 1
clustertool/embed/generic/kubernetes/system/longhorn/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: longhorn-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/system/longhorn/app/volumeSnapshotClass.yaml
+11
View File
@@ -0,0 +1,11 @@
---
kind: VolumeSnapshotClass
apiVersion: snapshot.storage.k8s.io/v1
metadata:
name: longhorn-snapshot-vsc
annotations:
snapshot.storage.kubernetes.io/is-default-class: 'true'
driver: driver.longhorn.io
deletionPolicy: Delete
parameters:
type: snap
clustertool/embed/generic/kubernetes/system/metallb/app/helm-release.yaml
+26
View File
@@ -0,0 +1,26 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metallb
namespace: metallb
spec:
interval: 5m
chart:
spec:
chart: metallb
version: 0.14.8
sourceRef:
kind: HelmRepository
name: metallb
namespace: flux-system
interval: 5m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
values:
speaker:
ignoreExcludeLB: true
clustertool/embed/generic/kubernetes/system/metallb/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: metallb
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/system/openebs/app/helm-release.yaml
+45
View File
@@ -0,0 +1,45 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: openebs
namespace: openebs
spec:
interval: 5m
releaseName: openebs
chart:
spec:
chart: openebs
version: 4.1.1
sourceRef:
kind: HelmRepository
name: openebs
namespace: flux-system
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
openebs-crds:
csi:
volumeSnapshots:
enabled: false
keep: false
engines:
local:
# The lvm-localpv backend contains a duplicate of snapshot controller which will cause conflicts
lvm:
enabled: false
# The ZFS backend contains a duplicate of snapshot controller which will cause conflicts
zfs:
enabled: false
replicated:
# The Mayastor backend contains a duplicate of snapshot controller which will cause conflicts
mayastor:
enabled: false
clustertool/embed/generic/kubernetes/system/openebs/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: openebs
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/system/prometheus-operator/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: prometheus-operator
namespace: prometheus-operator
spec:
interval: 5m
chart:
spec:
chart: prometheus-operator
version: 8.5.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values: {}
clustertool/embed/generic/kubernetes/system/snapshot-controller/app/helm-release.yaml
+27
View File
@@ -0,0 +1,27 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: snapshot-controller
namespace: snapshot-controller
spec:
interval: 5m
chart:
spec:
chart: snapshot-controller
version: 3.3.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
crds: CreateReplace
remediation:
strategy: rollback
retries: 3
values:
clustertool/embed/generic/kubernetes/system/system-upgrade-controller/app/helm-release.yaml
+102
View File
@@ -0,0 +1,102 @@
---
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: system-upgrade-controller
namespace: system-upgrade
spec:
interval: 30m
chart:
spec:
chart: app-template
version: 3.5.1
sourceRef:
kind: HelmRepository
name: bjw-s
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
strategy: rollback
retries: 3
values:
controllers:
system-upgrade-controller:
strategy: RollingUpdate
containers:
app:
image:
repository: docker.io/rancher/system-upgrade-controller
tag: v0.14.1@sha256:7e13a9b2b984f0c0fd6328439b575348723cc6954b91db3453057fcb784e2d29
env:
SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.1
SYSTEM_UPGRADE_JOB_POD_REPLACEMENT_POLICY: Failed
SYSTEM_UPGRADE_JOB_PRIVILEGED: true
SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
SYSTEM_UPGRADE_CONTROLLER_NAME: system-update-controller
SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities: { drop: ["ALL"] }
seccompProfile:
type: RuntimeDefault
defaultPodOptions:
securityContext:
runAsNonRoot: true
runAsUser: 65534
runAsGroup: 65534
seccompProfile: { type: RuntimeDefault }
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
- key: node-role.kubernetes.io/master
operator: Exists
effect: NoSchedule
serviceAccount:
create: true
name: system-upgrade
persistence:
tmp:
type: emptyDir
etc-ssl:
type: hostPath
hostPath: /etc/ssl
hostPathType: DirectoryOrCreate
globalMounts:
- readOnly: true
etc-pki:
type: hostPath
hostPath: /etc/pki
hostPathType: DirectoryOrCreate
globalMounts:
- readOnly: true
etc-ca-certificates:
type: hostPath
hostPath: /etc/ca-certificates
hostPathType: DirectoryOrCreate
globalMounts:
- readOnly: true
clustertool/embed/generic/kubernetes/system/system-upgrade-controller/app/kustomization.yaml
+8
View File
@@ -0,0 +1,8 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- helm-release.yaml
- rbac.yaml
clustertool/embed/generic/kubernetes/system/system-upgrade-controller/app/namespace.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: v1
kind: Namespace
metadata:
name: system-upgrade
annotations:
volsync.backube/privileged-movers: "true"
labels:
kustomize.toolkit.fluxcd.io/prune: disabled
goldilocks.fairwinds.com/enabled: "true"
pod-security.kubernetes.io/enforce: privileged
clustertool/embed/generic/kubernetes/system/system-upgrade-controller/app/rbac.yaml
+22
View File
@@ -0,0 +1,22 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system-upgrade
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: system-upgrade
namespace: system-upgrade
---
apiVersion: talos.dev/v1alpha1
kind: ServiceAccount
metadata:
name: talos
namespace: system-upgrade
spec:
roles:
- os:admin
clustertool/embed/generic/kubernetes/system/system-upgrade-controller/ks.yaml
+13
View File
@@ -0,0 +1,13 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: system-upgrade-controller
namespace: flux-system
spec:
interval: 10m
path: clusters/main/kubernetes/system/system-upgrade-controller/app
prune: true
sourceRef:
kind: GitRepository
name: cluster
clustertool/embed/generic/kubernetes/system/topolvm/app/helm-release.yaml
+55
View File
@@ -0,0 +1,55 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: topolvm
namespace: topolvm-system
spec:
interval: 5m
releaseName: topolvm
chart:
spec:
chart: topolvm
version: 15.4.0
sourceRef:
kind: HelmRepository
name: topolvm
namespace: flux-system
install:
createNamespace: true
crds: CreateReplace
remediation:
retries: 3
upgrade:
crds: CreateReplace
remediation:
retries: 3
values:
lvmd:
managed: false
env:
- name: LVM_SYSTEM_DIR
value: /tmp
deviceClasses:
- name: thin
volume-group: topolvm_vg # Volume Group name used in LVM_Disk_Watcher
default: true
spare-gb: 10
type: thin
thin-pool:
name: topolvm_thin # Logical Volume name used in LVM_Disk_Watcher
overprovision-ratio: 10.0 # Adjust to your convenience
storageClasses:
- name: topolvm-thin-provisioner
storageClass:
fsType: xfs
isDefaultClass: false
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
additionalParameters:
"topolvm.io/device-class": "thin"
node:
lvmdEmbedded: true
controller:
replicaCount: 1
clustertool/embed/generic/kubernetes/system/topolvm/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: topolvm-system
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/kubernetes/system/topolvm/app/volumeSnapshotClass.yaml
+9
View File
@@ -0,0 +1,9 @@
---
apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshotClass
metadata:
name: topolvm-provisioner-thin
# annotations:
# snapshot.storage.kubernetes.io/is-default-class: "false"
driver: topolvm.io
deletionPolicy: Delete
clustertool/embed/generic/kubernetes/system/traefik-crds/app/helm-release.yaml
+30
View File
@@ -0,0 +1,30 @@
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: traefik-crds
namespace: system
spec:
interval: 15m
chart:
spec:
chart: traefik-crds
version: 3.2.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 15m
timeout: 20m
maxHistory: 3
install:
createNamespace: true
remediation:
retries: 3
upgrade:
cleanupOnFail: true
remediation:
retries: 3
uninstall:
keepHistory: false
values: {}
clustertool/embed/generic/kubernetes/system/volsync/app/helm-release.yaml
+24
View File
@@ -0,0 +1,24 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: volsync
namespace: volsync
spec:
interval: 5m
chart:
spec:
chart: volsync
version: 2.3.0
sourceRef:
kind: HelmRepository
name: truecharts
namespace: flux-system
interval: 5m
install:
createNamespace: true
remediation:
retries: 3
upgrade:
remediation:
retries: 3
clustertool/embed/generic/kubernetes/system/volsync/app/namespace.yaml
+7
View File
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Namespace
metadata:
name: volsync
labels:
pod-security.kubernetes.io/enforce: privileged
topolvm.io/webhook: ignore
clustertool/embed/generic/patches/all.yaml
+100
View File
@@ -0,0 +1,100 @@
- op: replace
path: /machine/time
value:
"disabled": false
"servers":
- "time.cloudflare.com"
- op: add
path: /machine/kernel
value:
modules:
- "name": "dm_thin_pool"
- "name": "dm_mod"
- "name": nvme_tcp
- "name": vfio_pci
- "name": uio_pci_generic
- op: replace
path: /cluster/proxy
value:
"disabled": true
- op: add
path: /machine/kubelet/extraArgs
value:
"rotate-server-certificates": true
- op: add
path: /machine/kubelet/extraConfig
value:
"maxPods": 250
"shutdownGracePeriod": "15s"
"shutdownGracePeriodCriticalPods": "10s"
- op: add
path: /machine/kubelet/extraMounts
value:
- "destination": "/var/openebs/local"
"type": "bind"
"source": "/var/openebs/local"
"options":
- "bind"
- "rshared"
- "rw"
- destination: /var/lib/longhorn
type: bind
source: /var/lib/longhorn
options:
- bind
- rshared
- rw
- op: replace
path: /machine/features/hostDNS
value:
enabled: true
resolveMemberNames: true
forwardKubeDNSToHost: false
- op: add
path: /machine/sysctls
value:
fs.inotify.max_queued_events: "65536"
fs.inotify.max_user_instances: "8192"
fs.inotify.max_user_watches: "524288"
net.core.rmem_max: "2500000"
net.core.wmem_max: "2500000"
vm.nr_hugepages: "2048"
## TODO: Check how we can have this pass checks
# - op: add
# path: /machine/udev
# value:
# # Thunderbolt
# - ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1"
# # Intel GPU
# - SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="44", MODE="0660"
# # Google Coral USB Accelerator
# - SUBSYSTEMS=="usb", ATTRS{idVendor}=="1a6e", ATTRS{idProduct}=="089a", GROUP="20", MODE="0660"
# - SUBSYSTEMS=="usb", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="9302", GROUP="20", MODE="0660"
- op: add
path: /machine/files
value:
- content: |
[plugins."io.containerd.grpc.v1.cri"]
enable_unprivileged_ports = true
enable_unprivileged_icmp = true
[plugins."io.containerd.grpc.v1.cri".containerd]
discard_unpacked_layers = false
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
discard_unpacked_layers = false
permissions: 0
path: /etc/cri/conf.d/20-customization.part
op: create
- content: |
[ NFSMount_Global_Options ]
nfsvers=4.2
hard=True
noatime=True
nodiratime=True
rsize=131072
wsize=131072
nconnect=8
permissions: 420
path: /etc/nfsmount.conf
op: overwrite
clustertool/embed/generic/patches/controlplane.yaml
+50
View File
@@ -0,0 +1,50 @@
- op: add
path: /cluster/proxy/extraArgs
value:
"metrics-bind-address": "0.0.0.0:10249"
- op: add
path: /cluster/controllerManager/extraArgs
value:
"bind-address": "0.0.0.0"
- op: add
path: /cluster/scheduler/extraArgs
value:
"bind-address": "0.0.0.0"
- op: replace
path: /cluster/apiServer/admissionControl
value:
- name: PodSecurity
configuration:
apiVersion: pod-security.admission.config.k8s.io/v1alpha1
defaults:
audit: restricted
audit-version: latest
enforce: baseline
enforce-version: latest
warn: restricted
warn-version: latest
exemptions:
namespaces:
- kube-system
- metallb
- metallb-config
- topolvm-system
- longhorn-system
- kyverno
- system-upgrade
- openebs
- snapshot-controller
- volsync
- flux-system
runtimeClasses: []
usernames: []
kind: PodSecurityConfiguration
- op: add
path: /machine/features/kubernetesTalosAPIAccess
value:
enabled: true
allowedRoles:
- os:admin
allowedKubernetesNamespaces:
- system-upgrade
clustertool/embed/generic/patches/manifests.yaml
+6
View File
@@ -0,0 +1,6 @@
- op: replace
path: /machine/time
value:
"disabled": false
"servers":
- "time.cloudflare.com"
clustertool/embed/generic/patches/sopssecret.yaml
+40
View File
@@ -0,0 +1,40 @@
- op: add
path: /cluster/inlineManifests
value:
- name: flux-system
contents: |-
apiVersion: v1
kind: Namespace
metadata:
name: flux-system
- name: sops-age
contents: |-
apiVersion: v1
stringData:
age.agekey: REPLACEWITHSOPS
kind: Secret
metadata:
creationTimestamp: null
name: sops-age
namespace: flux-system
- name: cluster-config
contents: |-
apiVersion: v1
kind: ConfigMap
metadata:
creationTimestamp: null
name: cluster-config
namespace: flux-system
data:
REPLACEWITHTALENV
- name: deploy-key
contents: |-
apiVersion: v1
kind: ConfigMap
metadata:
creationTimestamp: null
name: deploy-key
namespace: flux-system
stringData:
REPLACEWITHDEPLOYKEY
clustertool/embed/generic/patches/worker.yaml
+6
View File
@@ -0,0 +1,6 @@
- op: replace
path: /machine/time
value:
"disabled": false
"servers":
- "time.cloudflare.com"
clustertool/embed/generic/root/DOTREPLACEgithub/renovate.json5
+7
View File
@@ -0,0 +1,7 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": [
"config:recommended",
"github>truecharts/public//.github/renovate/main.json5"
]
}
clustertool/embed/generic/root/DOTREPLACEgitignore
+10
View File
@@ -0,0 +1,10 @@
age.agekey
^clustertool.exe
^clustertool*
^clustertool
*clustertool.exe
clustertool.exe
clustertool
sopssecret.yaml
sopssecret*
*sopssecret*
clustertool/embed/generic/root/DOTREPLACEsops.yaml
+15
View File
@@ -0,0 +1,15 @@
## Do not edit between this and DO NOT REMOVE
creation_rules:
- path_regex: ^clusters.*kubernetes.*values.ya?ml$
age: REPLACEME
encrypted_regex: "((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))"
- path_regex: ^clusters.*kubernetes.*\.secret.ya?ml
age: REPLACEME
encrypted_regex: "((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))"
- path_regex: talenv.yaml
age: REPLACEME
- path_regex: clusterenv.yaml
age: REPLACEME
- path_regex: talsecret.yaml
age: REPLACEME
## DO NOT REMOVE: Personal setting go under this line
clustertool/embed/generic/root/README.md
+1
View File
@@ -0,0 +1 @@
This is a kubernetes cluster Powered by TrueCharts ClusterTool
clustertool/embed/generic/root/repositories/entries/kustomization.yaml
+5
View File
@@ -0,0 +1,5 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources: []
clustertool/embed/generic/root/repositories/flux-entry.yaml
+41
View File
@@ -0,0 +1,41 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-entry-repos
namespace: flux-system
spec:
interval: 10m
path: ./repositories
prune: true
sourceRef:
kind: GitRepository
name: cluster
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-config
patches:
- patch: |-
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: not-used
spec:
decryption:
provider: sops
secretRef:
name: sops-age
postBuild:
substituteFrom:
- kind: ConfigMap
name: cluster-config
target:
group: kustomize.toolkit.fluxcd.io
kind: Kustomization
labelSelector: substitution.flux.home.arpa/disabled notin (true)
clustertool/embed/generic/root/repositories/git/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- this-repo.yaml
- truecharts.yaml
clustertool/embed/generic/root/repositories/git/this-repo.yaml
+20
View File
@@ -0,0 +1,20 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/gitrepository_v1.json
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: cluster
namespace: flux-system
spec:
interval: 30m
url: ssh://REPLACEWITHGITREPO
ref:
branch: main
secretRef:
name: deploy-key
ignore: |
# exclude all
/*
# include flux directories
!/clusters
!/repositories
clustertool/embed/generic/root/repositories/git/truecharts.yaml
+19
View File
@@ -0,0 +1,19 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/gitrepository_v1.json
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: truecharts
namespace: flux-system
spec:
interval: 30m
url: https://github.com/truecharts/public/
ref:
branch: master
secretRef:
name: deploy-key
ignore: |
# exclude all
/*
# include flux directories
!/repositories
clustertool/embed/generic/root/repositories/kustomization.yaml
+9
View File
@@ -0,0 +1,9 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./git
- ./helm
- ./oci
- ./entries
clustertool/embed/generic/root/repositories/oci/flux-manifests.yaml
+12
View File
@@ -0,0 +1,12 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: OCIRepository
metadata:
name: flux-manifests
namespace: flux-system
spec:
interval: 10m
url: oci://ghcr.io/fluxcd/flux-manifests
ref:
tag: v2.4.0
clustertool/embed/generic/root/repositories/oci/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- flux-manifests.yaml
clustertool/embed/generic/root/truenas_exports/.gitkeep
View File