feat(clustertool): add traefik, clusterissuer and blocky bare-bones

2024-11-05 21:50:13 +01:00
parent 948f586d43
commit 76b5d3925e
8 changed files with 213 additions and 1 deletions
@@ -8,8 +8,19 @@ MASTER1IP: 192.168.20.210
 GATEWAY: 192.168.20.1
 # Defines the ip range metallb is allowed to use
 METALLB_RANGE: 192.168.20.211-192.168.20.219
+# IP Traefik will use for externally exposing ingress-resources (NOT its dashboard)
+TRAEFIK_IP: 192.168.20.211
+# IP Blocky DNS will be exposed on
+BLOCKY_IP: 192.168.20.212
 # Sets the Kubernetes Dashboard IP. Has to be within METALLB_RANGE and not in use
-DASHBOARD_IP: 192.168.20.211
+DASHBOARD_IP: 192.168.20.213
+## Configures Traefik, ClusterIssuer and Blocky for said domain, using these credentials
+# domain is the base/highest level of your domain, so without subdomain, example: truecharts.org, not somesite.truecharts.org
+# To disable, please see the comments in their respective helm-values.yaml files!
+# When disabled, please use placeholder values instead.
+DOMAIN_0: ""
+DOMAIN_0_EMAIL: ""
+DOMAIN_0_CLOUDFLARE_TOKEN: ""
 # Used to automatically generate a sshkey-pair for FluxCD
 # Has to start with ssh://
 # Please make sure to NOT contain any special characters in the URL except "-"
@@ -0,0 +1,73 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: blocky
+  namespace: blocky
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: blocky
+      version: 16.6.2
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    ## set stopAll to "true" if you do not want to use blocky
+    # and/or disable its service
+    global:
+      stopAll: false
+    service:
+      dns:
+        externalTrafficPolicy: Local
+        loadBalancerIP: ${BLOCKY_IP}
+        type: LoadBalancer
+    k8sgateway:
+      # -- list of processed domains
+      domains:
+      - domain: "${DOMAIN_0}"
+        # -- Optional configuration option for DNS01 challenge that will redirect all acme
+        # challenge requests to external cloud domain (e.g. managed by cert-manager)
+        # See: https://cert-manager.io/docs/configuration/acme/dns01/
+        dnsChallenge:
+          enabled: false
+          domain: dns01.clouddns.com
+
+      forward:
+        enabled: false
+        primary: tls://1.1.1.1
+        secondary: tls://1.0.0.1
+        options:
+          - name: tls_servername
+            value: cloudflare-dns.com
+
+    # CANNOT be defined in above yaml section
+    queryLog:
+      # optional one of: mysql, postgresql, csv, csv-client. If empty, log to console only
+      type: ""
+
+    configmap:
+      dashboard:
+        enabled: false
+      datasource:
+        enabled: false
+
+    cnpg:
+      main:
+        enabled: false
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: blocky
+    labels:
+        topolvm.io/webhook: ignore
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: clusterissuer
+  namespace: clusterissuer
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: clusterissuer
+      version: 9.2.2
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+
+    clusterIssuer:
+      selfSigned:
+        enabled: true
+        name: "selfsigned"
+      ## Remove these if you do NOT want to use clusterissuer
+      ACME:
+        - name: domain-0-le-staging
+          # Used for both logging in to the DNS provider AND ACME registration
+          email: "${DOMAIN_0_EMAIL}"
+          server: 'https://acme-staging-v02.api.letsencrypt.org/directory'
+          # Options: HTTP01, cloudflare, route53, akamai, digitalocean, rfc2136, acmedns
+          type: "cloudflare"
+          # for cloudflare
+          cfapitoken: "${DOMAIN_0_CLOUDFLARE_TOKEN}"
+        - name: domain-0-le-prod
+          # Used for both logging in to the DNS provider AND ACME registration
+          email: "${DOMAIN_0_EMAIL}"
+          server: 'https://acme-v02.api.letsencrypt.org/directory'
+          # Options: HTTP01, cloudflare, route53, akamai, digitalocean, rfc2136, acmedns
+          type: "cloudflare"
+          # for cloudflare
+          cfapitoken: "${DOMAIN_0_CLOUDFLARE_TOKEN}"
+
+    ## Remove these if you do NOT want to use clusterissuer
+    clusterCertificates:
+      # Namespaces in which the certificates must be available
+      # Accepts comma-separated regex expressions
+      replicationNamespaces: '.*'
+      certificates:
+        - name: domain-0-wildcard
+          enabled: true
+          certificateIssuer: tc-le-prod
+          hosts:
+            - ${DOMAIN_0}
+            - '*.${DOMAIN_0}'
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: clusterissuer
+    labels:
+        topolvm.io/webhook: ignore
@@ -0,0 +1,40 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: traefik
+      version: 29.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: truecharts
+        namespace: flux-system
+      interval: 15m
+  timeout: 20m
+  maxHistory: 3
+  driftDetection:
+    mode: warn
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    ## set stopAll to "true" if you do not want to use traefik
+    # and/or disable its service
+    global:
+      stopAll: false
+    defaultCertificate: "domain-0-wildcard"
+    service:
+      tcp:
+        loadBalancerIP: ${TRAEFIK_IP}
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: traefik
+    labels:
+        topolvm.io/webhook: ignore
@@ -233,6 +233,9 @@ func CheckEnvVariables() {
        "METALLB_RANGE",
        "PODNET",
        "SVCNET",
+        "DOMAIN_0",
+        "DOMAIN_0_EMAIL",
+        "DOMAIN_0_CLOUDFLARE_TOKEN",
    }
    for _, key := range requiredKeys {
        if helper.TalEnv[key] == "" {