diff --git a/.gitignore b/.gitignore index b1dd102..abf0bc1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ .idea charts/example -**/infra/*/charts +**/infra/**/charts *secret*.yaml .terraform @@ -20,4 +20,7 @@ override.tf.json *_override.tf.json *.qcow2 -*.raw \ No newline at end of file +*.raw + +*.cert +*.key \ No newline at end of file diff --git a/README.md b/README.md index b73a85d..b027b80 100644 --- a/README.md +++ b/README.md @@ -64,16 +64,16 @@ over at GitLab. - [ ] Clean up DNS config - [ ] Renovate for automatic updates -- [ ] Build a NAS for storage +- [x] Build a NAS for storage - [ ] Template Gauss - [ ] Replace Pi Hole with AdGuard Home -- [ ] Use iGPU on Euclid for video transcoding -- [ ] Replace Traefik with Cilium Ingress Controller +- [x] Use iGPU on Euclid for video transcoding +- [x] Replace Traefik with Cilium Ingress Controller - [ ] Cilium mTLS & SPIFFE/SPIRE ## 👷‍ Future Projects -- [ ] Use Talos instead of Debian for Kubernetes +- [x] Use Talos instead of Debian for Kubernetes - [ ] Keycloak for auth - [ ] Dynamic Resource Allocation for GPU - [ ] Local LLM diff --git a/remodel/k8s/README.md b/remodel/k8s/README.md new file mode 100644 index 0000000..3e941b3 --- /dev/null +++ b/remodel/k8s/README.md @@ -0,0 +1,37 @@ +# Manual bootstrap + +## Cilium + +```shell +kubectl kustomize --enable-helm infra/network/cilium | kubectl apply -f - +``` + +## Sealed-secrets + +```shell +kubectl kustomize --enable-helm infra/controllers/sealed-secrets | kubectl apply -f - +``` + +## Proxmox CSI Plugin + +```shell +kubectl kustomize --enable-helm infra/storage/proxmox-csi | kubectl apply -f - +``` + +```shell +kubectl get csistoragecapacities -ocustom-columns=CLASS:.storageClassName,AVAIL:.capacity,ZONE:.nodeTopology.matchLabels -A +``` + +## Argo CD + +```shell +kubectl kustomize --enable-helm infra/controllers/argocd | kubectl apply -f - +``` + +```shell +kubectl -n argocd get secret argocd-initial-admin-secret -ojson | jq -r ' .data.password | @base64d' +``` + +```shell +kubectl kustomize --enable-helm infra/storage | kubectl apply -f - +``` \ No newline at end of file diff --git a/remodel/k8s/infra/application-set.yaml b/remodel/k8s/infra/application-set.yaml new file mode 100644 index 0000000..82f833a --- /dev/null +++ b/remodel/k8s/infra/application-set.yaml @@ -0,0 +1,32 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: infrastructure + namespace: argocd + labels: + dev.stonegarden: infrastructure +spec: + generators: + - git: + repoURL: https://github.com/vehagn/homelab + revision: HEAD + directories: + - path: remodel/infra/* + template: + metadata: + name: '{{ path.basename }}' + labels: + dev.stonegarden: infrastructure + spec: + project: infrastructure + source: + repoURL: https://github.com/vehagn/homelab + targetRevision: HEAD + path: '{{ path }}' + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + selfHeal: true + prune: true \ No newline at end of file diff --git a/remodel/k8s/infra/argocd/http-route.yaml b/remodel/k8s/infra/argocd/http-route.yaml new file mode 100644 index 0000000..4fe9523 --- /dev/null +++ b/remodel/k8s/infra/argocd/http-route.yaml @@ -0,0 +1,19 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: http-route-euclid + namespace: argocd +spec: + parentRefs: + - name: euclid + namespace: gateway + hostnames: + - "argocd.euclid.stonegarden.dev" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: argocd-server + port: 80 \ No newline at end of file diff --git a/remodel/k8s/infra/argocd/kustomization.yaml b/remodel/k8s/infra/argocd/kustomization.yaml new file mode 100644 index 0000000..017b201 --- /dev/null +++ b/remodel/k8s/infra/argocd/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ns.yaml +# - http-route.yaml + +helmCharts: + - name: argo-cd + repo: https://argoproj.github.io/argo-helm + version: 7.3.3 + releaseName: "argocd" + namespace: argocd + valuesFile: values.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/argocd/ns.yaml b/remodel/k8s/infra/argocd/ns.yaml new file mode 100644 index 0000000..96e84ab --- /dev/null +++ b/remodel/k8s/infra/argocd/ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: argocd \ No newline at end of file diff --git a/remodel/k8s/infra/argocd/values.yaml b/remodel/k8s/infra/argocd/values.yaml new file mode 100644 index 0000000..d75aa9b --- /dev/null +++ b/remodel/k8s/infra/argocd/values.yaml @@ -0,0 +1,49 @@ +configs: + cm: + create: true + application.resourceTrackingMethod: "annotation+label" + cmp: + create: true + plugins: + kustomize-build-with-helm: + generate: + command: [ "sh", "-c" ] + args: [ "kustomize build --enable-helm" ] + params: + server.insecure: true + +crds: + install: true + # -- Keep CRDs on chart uninstall + keep: false + +repoServer: + extraContainers: + - name: kustomize-build-with-helm + command: + - argocd-cmp-server + image: '{{ default .Values.global.image.repository .Values.repoServer.image.repository }}:{{ default (include "argo-cd.defaultTag" .) .Values.repoServer.image.tag }}' + securityContext: + runAsNonRoot: true + runAsUser: 999 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + capabilities: + drop: [ "ALL" ] + volumeMounts: + - name: plugins + mountPath: /home/argocd/cmp-server/plugins + - name: cmp-kustomize-build-with-helm + mountPath: /home/argocd/cmp-server/config/plugin.yaml + subPath: kustomize-build-with-helm.yaml + - mountPath: /tmp + name: cmp-tmp + volumes: + - name: cmp-kustomize-build-with-helm + configMap: + name: argocd-cmp-cm + - name: cmp-tmp + emptyDir: { } + diff --git a/remodel/k8s/infra/controllers/application-set.yaml b/remodel/k8s/infra/controllers/application-set.yaml new file mode 100644 index 0000000..f3c2b2f --- /dev/null +++ b/remodel/k8s/infra/controllers/application-set.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: controllers + namespace: argocd + labels: + dev.stonegarden: controllers +spec: + generators: + - git: + repoURL: https://github.com/vehagn/homelab + revision: remodel + directories: + - path: remodel/k8s/infra/controllers/* + template: + metadata: + name: '{{ path.basename }}' + labels: + dev.stonegarden: controllers + spec: + project: controllers + source: + plugin: + name: kustomize-build-with-helm + repoURL: https://github.com/vehagn/homelab + targetRevision: remodel + path: '{{ path }}' + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + selfHeal: true + prune: true \ No newline at end of file diff --git a/remodel/k8s/infra/controllers/kustomization.yaml b/remodel/k8s/infra/controllers/kustomization.yaml new file mode 100644 index 0000000..bb49b96 --- /dev/null +++ b/remodel/k8s/infra/controllers/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + dev.stonegarden: controllers + app.kubernetes.io/managed-by: argocd + +resources: + - project.yaml + - application-set.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/controllers/project.yaml b/remodel/k8s/infra/controllers/project.yaml new file mode 100644 index 0000000..986434f --- /dev/null +++ b/remodel/k8s/infra/controllers/project.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: controllers + namespace: argocd +spec: + sourceRepos: + - 'https://github.com/vehagn/homelab' + destinations: + - namespace: 'argocd' + server: '*' + - namespace: 'cert-manager' + server: '*' + - namespace: 'node-feature-discovery' + server: '*' + - namespace: 'intel-device-plugins' + server: '*' + - namespace: 'kube-system' + server: '*' + - namespace: 'sealed-secrets' + server: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' diff --git a/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml b/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml new file mode 100644 index 0000000..13f6955 --- /dev/null +++ b/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +helmCharts: + - name: sealed-secrets +# repo: https://bitnami-labs.github.io/sealed-secrets +# version: 2.16.0 + repo: oci://registry-1.docker.io/bitnamicharts/sealed-secrets + version: 2.3.6 + releaseName: sealed-secrets-controller + namespace: sealed-secrets + includeCRDs: true + valuesFile: values.yaml diff --git a/remodel/k8s/infra/controllers/sealed-secrets/values.yaml b/remodel/k8s/infra/controllers/sealed-secrets/values.yaml new file mode 100644 index 0000000..68df4e6 --- /dev/null +++ b/remodel/k8s/infra/controllers/sealed-secrets/values.yaml @@ -0,0 +1,10 @@ +namespace: sealed-secrets +keyrenewperiod: 8766h # ~ 1 year + +resources: + limits: + cpu: 100m + memory: 64Mi + requests: + cpu: 10m + memory: 32Mi diff --git a/remodel/k8s/infra/kustomization.yaml b/remodel/k8s/infra/kustomization.yaml new file mode 100644 index 0000000..b1fa224 --- /dev/null +++ b/remodel/k8s/infra/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + dev.stonegarden: infrastructure + app.kubernetes.io/managed-by: argocd + +resources: + - project.yaml + - application-set.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/network/application-set.yaml b/remodel/k8s/infra/network/application-set.yaml new file mode 100644 index 0000000..15c00a6 --- /dev/null +++ b/remodel/k8s/infra/network/application-set.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: network + namespace: argocd + labels: + dev.stonegarden: network +spec: + generators: + - git: + repoURL: https://github.com/vehagn/homelab + revision: HEAD + directories: + - path: remodel/infra/network/* + template: + metadata: + name: '{{ path.basename }}' + labels: + dev.stonegarden: network + spec: + project: network + source: + plugin: + name: kustomize-build-with-helm + repoURL: https://github.com/vehagn/homelab + targetRevision: HEAD + path: '{{ path }}' + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + selfHeal: true + prune: true \ No newline at end of file diff --git a/remodel/k8s/infra/network/cilium/announce.yaml b/remodel/k8s/infra/network/cilium/announce.yaml new file mode 100644 index 0000000..14f52b2 --- /dev/null +++ b/remodel/k8s/infra/network/cilium/announce.yaml @@ -0,0 +1,8 @@ +apiVersion: cilium.io/v2alpha1 +kind: CiliumL2AnnouncementPolicy +metadata: + name: default-l2-announcement-policy + namespace: kube-system +spec: + externalIPs: true + loadBalancerIPs: true diff --git a/remodel/k8s/infra/network/cilium/ip-pool.yaml b/remodel/k8s/infra/network/cilium/ip-pool.yaml new file mode 100644 index 0000000..df1e9ba --- /dev/null +++ b/remodel/k8s/infra/network/cilium/ip-pool.yaml @@ -0,0 +1,8 @@ +apiVersion: cilium.io/v2alpha1 +kind: CiliumLoadBalancerIPPool +metadata: + name: first-pool +spec: + blocks: + - start: 192.168.1.220 + stop: 192.168.1.229 \ No newline at end of file diff --git a/remodel/k8s/infra/network/cilium/kustomization.yaml b/remodel/k8s/infra/network/cilium/kustomization.yaml new file mode 100644 index 0000000..bd2c6df --- /dev/null +++ b/remodel/k8s/infra/network/cilium/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - announce.yaml + - ip-pool.yaml + +helmCharts: + - name: cilium + repo: https://helm.cilium.io + version: 1.15.5 + releaseName: "cilium" + includeCRDs: true + namespace: kube-system + valuesFile: values.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/network/cilium/values.yaml b/remodel/k8s/infra/network/cilium/values.yaml new file mode 100644 index 0000000..2197ca9 --- /dev/null +++ b/remodel/k8s/infra/network/cilium/values.yaml @@ -0,0 +1,81 @@ +cluster: + name: talos + id: 1 + +kubeProxyReplacement: true + + # Talos specific +k8sServiceHost: localhost +k8sServicePort: 7445 +securityContext: + capabilities: + ciliumAgent: [ CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID ] + cleanCiliumState: [ NET_ADMIN,SYS_ADMIN,SYS_RESOURCE ] + +cgroup: + autoMount: + enabled: false + hostRoot: /sys/fs/cgroup + +# https://docs.cilium.io/en/stable/network/concepts/ipam/ +ipam: + mode: kubernetes + +operator: + rollOutPods: true + resources: + limits: + cpu: 500m + memory: 256Mi + requests: + cpu: 50m + memory: 128Mi + +# Roll out cilium agent pods automatically when ConfigMap is updated. +rollOutCiliumPods: true +resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 200m + memory: 512Mi + +#debug: +# enabled: true + +# Increase rate limit when doing L2 announcements +k8sClientRateLimit: + qps: 20 + burst: 100 + +l2announcements: + enabled: true + +externalIPs: + enabled: true + +enableCiliumEndpointSlice: true + +gatewayAPI: + enabled: true + +hubble: + enabled: false + relay: + enabled: false + rollOutPods: true + ui: + enabled: false + rollOutPods: true + +ingressController: + enabled: true + default: true + loadbalancerMode: shared + service: + annotations: + io.cilium/lb-ipam-ips: 192.168.1.223 + # Random values so Argo CD doesn't complain about the service being out of sync + insecureNodePort: 32434 + secureNodePort: 31247 diff --git a/remodel/k8s/infra/network/kustomization.yaml b/remodel/k8s/infra/network/kustomization.yaml new file mode 100644 index 0000000..775a272 --- /dev/null +++ b/remodel/k8s/infra/network/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + dev.stonegarden: network + app.kubernetes.io/managed-by: argocd + +resources: + - project.yaml + - application-set.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/network/project.yaml b/remodel/k8s/infra/network/project.yaml new file mode 100644 index 0000000..2cbb312 --- /dev/null +++ b/remodel/k8s/infra/network/project.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: network + namespace: argocd +spec: + sourceRepos: + - 'https://gitlab.com/vehagn/mini-homelab.git' + - 'https://prometheus-community.github.io/helm-charts' + - 'https://argoproj.github.io/argo-helm' + destinations: + - namespace: 'adguard' + server: '*' + - namespace: 'argocd' + server: '*' + - namespace: 'cloudflared' + server: '*' + - namespace: 'gateway' + server: '*' + - namespace: 'kube-system' + server: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' diff --git a/remodel/k8s/infra/project.yaml b/remodel/k8s/infra/project.yaml new file mode 100644 index 0000000..ced634f --- /dev/null +++ b/remodel/k8s/infra/project.yaml @@ -0,0 +1,14 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: infrastructure + namespace: argocd +spec: + sourceRepos: + - 'https://github.com/vehagn/homelab' + destinations: + - namespace: 'argocd' + server: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' diff --git a/remodel/k8s/infra/storage/application-set.yaml b/remodel/k8s/infra/storage/application-set.yaml new file mode 100644 index 0000000..25d10ef --- /dev/null +++ b/remodel/k8s/infra/storage/application-set.yaml @@ -0,0 +1,36 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: storage + namespace: argocd + labels: + dev.stonegarden: storage +spec: + generators: + - git: + repoURL: https://github.com/vehagn/homelab + #revision: HEAD + revision: remodel + directories: + - path: remodel/k8s/infra/storage/* + template: + metadata: + name: '{{ path.basename }}' + labels: + dev.stonegarden: storage + spec: + project: storage + source: + plugin: + name: kustomize-build-with-helm + repoURL: https://github.com/vehagn/homelab + #targetRevision: HEAD + targetRevision: remodel + path: '{{ path }}' + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + selfHeal: true + prune: true \ No newline at end of file diff --git a/remodel/k8s/infra/storage/kustomization.yaml b/remodel/k8s/infra/storage/kustomization.yaml new file mode 100644 index 0000000..24e3929 --- /dev/null +++ b/remodel/k8s/infra/storage/kustomization.yaml @@ -0,0 +1,9 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +commonLabels: + dev.stonegarden: storage + app.kubernetes.io/managed-by: argocd + +resources: + - project.yaml + - application-set.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/storage/project.yaml b/remodel/k8s/infra/storage/project.yaml new file mode 100644 index 0000000..f8b87b0 --- /dev/null +++ b/remodel/k8s/infra/storage/project.yaml @@ -0,0 +1,16 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: storage + namespace: argocd +spec: + sourceRepos: + - 'https://github.com/vehagn/homelab' + destinations: + - namespace: 'argocd' + server: '*' + - namespace: 'csi-proxmox' + server: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' diff --git a/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml b/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml new file mode 100644 index 0000000..a924ce0 --- /dev/null +++ b/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml @@ -0,0 +1,20 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: +# - https://raw.githubusercontent.com/sergelogvinov/proxmox-csi-plugin/v0.7.0/docs/deploy/proxmox-csi-plugin-release.yml + - storage-class.yaml + +#images: +# - name: ghcr.io/sergelogvinov/proxmox-csi-node +# newTag: edge +# - name: ghcr.io/sergelogvinov/proxmox-csi-controller +# newTag: edge + +helmCharts: + - name: proxmox-csi-plugin + repo: oci://ghcr.io/sergelogvinov/charts/proxmox-csi-plugin + version: 0.7.0 + releaseName: proxmox-csi-plugin + includeCRDs: true + namespace: csi-proxmox diff --git a/remodel/k8s/infra/storage/proxmox-csi/storage-class.yaml b/remodel/k8s/infra/storage/proxmox-csi/storage-class.yaml new file mode 100644 index 0000000..9bfd12d --- /dev/null +++ b/remodel/k8s/infra/storage/proxmox-csi/storage-class.yaml @@ -0,0 +1,15 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: proxmox-csi +allowVolumeExpansion: true +parameters: + csi.storage.k8s.io/fstype: ext4 + storage: local-zfs + cache: writethrough + ssd: "true" +mountOptions: + - noatime +provisioner: csi.proxmox.sinextra.dev +reclaimPolicy: Retain +volumeBindingMode: WaitForFirstConsumer \ No newline at end of file diff --git a/remodel/tofu/home-assistant/image.tf b/remodel/tofu/home-assistant/image.tf index 6586332..ff8591b 100644 --- a/remodel/tofu/home-assistant/image.tf +++ b/remodel/tofu/home-assistant/image.tf @@ -1,16 +1,17 @@ resource "null_resource" "haos_image" { triggers = { on_version_change = var.haos_version + filename = var.local_file } provisioner "local-exec" { command = "curl -s -L ${var.haos_download_url}/${var.haos_version}/haos_ova-${var.haos_version}.qcow2.xz | xz -d > ${var.local_file}" } - # provisioner "local-exec" { - # when = destroy - # command = "rm ${local.haos.local_file}" - # } + provisioner "local-exec" { + when = destroy + command = "rm ${self.triggers.filename}" + } } resource "proxmox_virtual_environment_file" "haos_generic_image" { diff --git a/remodel/tofu/talos-k8s/bootstrap/cilium-install.yaml b/remodel/tofu/kubernetes/bootstrap/cilium/install.yaml similarity index 79% rename from remodel/tofu/talos-k8s/bootstrap/cilium-install.yaml rename to remodel/tofu/kubernetes/bootstrap/cilium/install.yaml index 29618a3..66709be 100644 --- a/remodel/tofu/talos-k8s/bootstrap/cilium-install.yaml +++ b/remodel/tofu/kubernetes/bootstrap/cilium/install.yaml @@ -68,16 +68,19 @@ spec: fieldPath: status.podIP - name: KUBERNETES_SERVICE_PORT value: "6443" + volumeMounts: + - name: values + mountPath: /root/app/values.yaml + subPath: values.yaml command: - cilium - install - --version=v1.15.5 # renovate: github-releases=cilium/cilium - - --helm-set=ipam.mode=kubernetes - --set - kubeProxyReplacement=true - - --helm-set=securityContext.capabilities.ciliumAgent={CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID} - - --helm-set=securityContext.capabilities.cleanCiliumState={NET_ADMIN,SYS_ADMIN,SYS_RESOURCE} - - --helm-set=cgroup.autoMount.enabled=false - - --helm-set=cgroup.hostRoot=/sys/fs/cgroup - - --helm-set=k8sServiceHost=localhost - - --helm-set=k8sServicePort=7445 + - --values + - values.yaml + volumes: + - name: values + configMap: + name: cilium-values \ No newline at end of file diff --git a/remodel/tofu/kubernetes/bootstrap/proxmox-csi-plugin/config.tf b/remodel/tofu/kubernetes/bootstrap/proxmox-csi-plugin/config.tf new file mode 100644 index 0000000..0c37f0f --- /dev/null +++ b/remodel/tofu/kubernetes/bootstrap/proxmox-csi-plugin/config.tf @@ -0,0 +1,56 @@ +resource "proxmox_virtual_environment_role" "csi" { + role_id = "CSI" + privileges = [ + "VM.Audit", + "VM.Config.Disk", + "Datastore.Allocate", + "Datastore.AllocateSpace", + "Datastore.Audit" + ] +} + +resource "proxmox_virtual_environment_user" "kubernetes-csi" { + user_id = "kubernetes-csi@pve" + comment = "User for Proxmox CSI Plugin" + acl { + path = "/" + propagate = true + role_id = proxmox_virtual_environment_role.csi.role_id + } +} + +resource "proxmox_virtual_environment_user_token" "kubernetes-csi-token" { + comment = "Token for Proxmox CSI Plugin" + token_name = "csi" + user_id = proxmox_virtual_environment_user.kubernetes-csi.user_id + privileges_separation = false +} + +resource "kubernetes_namespace" "csi-proxmox" { + metadata { + name = "csi-proxmox" + labels = { + "pod-security.kubernetes.io/enforce" = "privileged" + "pod-security.kubernetes.io/audit" = "baseline" + "pod-security.kubernetes.io/warn" = "baseline" + } + } +} + +resource "kubernetes_secret" "proxmox-csi-plugin" { + metadata { + name = "proxmox-csi-plugin" + namespace = kubernetes_namespace.csi-proxmox.id + } + + data = { + "config.yaml" = <