feat(traefik): Using Kustomize with Helm to deploy Traefik using ArgoCD

helm/traefik-values.yaml

@@ -1,34 +0,0 @@
-deployment:
-  initContainers:
-    # The "volume-permissions" init container is required if you run into permission issues.
-    # Related issue: https://github.com/traefik/traefik/issues/6972
-    - name: volume-permissions
-      image: busybox:1.31.1
-      command: [ "sh", "-c", "chmod -Rv 600 /data/*" ]
-      volumeMounts:
-        - name: data
-          mountPath: /data
-
-providers:
-  kubernetesCRD:
-    allowCrossNamespace: true
-
-additionalArguments:
-  - "--log.level=ERROR"
-  - "--api.insecure"
-
-persistence:
-  enabled: true
-  name: data
-  accessMode: ReadWriteOnce
-  size: 128Mi
-  storageClass: cert-storage
-  path: /data
-
-certResolvers:
-  letsencrypt:
-    email: [email protected]
-    tlsChallenge: true
-    storage: /data/acme.json
-    # Remove staging server when it's working
-    #caServer: https://acme-staging-v02.api.letsencrypt.org/directory

infra/argocd/kustomization.yaml

@@ -11,7 +11,7 @@ resources:
   - applications.yaml
 
 patchesStrategicMerge:
-  # Kustomize Helm plugin
+  # Kustomize --enable-helm plugin for Helm charts
   - config/argocd-cm-kustomize-helm-patch.yaml
   # Let Traefik manage TLS-termination
   - config/argocd-cmd-params-cm-server-insecrure-patch.yaml

infra/traefik/kustomization.yaml

@@ -2,8 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: traefik-system
 
+resources:
+  - storageClass.yaml
+  - persistentVolume.yaml
+
 helmCharts:
   - name: traefik
     repo: https://helm.traefik.io/traefik
     version: 20.8.0
+    releaseName: "traefik"
     valuesFile: values.yaml

infra/traefik/persistentVolume.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  finalizers:
+    - kubernetes.io/pv-protection
+  name: traefik-cert-pv
+spec:
+  capacity:
+    storage: 128Mi
+#  claimRef:
+#    apiVersion: v1
+#    kind: PersistentVolumeClaim
+#    name: traefik
+#    namespace: traefik-system
+#    resourceVersion: "5491071"
+#    uid: 60ee134d-dcba-4615-a218-7f06a523fb46
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: cert-storage
+  local:
+    path: /disk/etc/traefik/certs
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - gauss

infra/traefik/storageClass.yaml

@@ -0,0 +1,7 @@
+allowVolumeExpansion: true
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: cert-storage
+provisioner: kubernetes.io/no-provisioner
+volumeBindingMode: WaitForFirstConsumer

infra/traefikApp.yaml

@@ -8,45 +8,17 @@ metadata:
 spec:
   project: infrastructure
   source:
-    chart: traefik
-    repoURL: https://helm.traefik.io/traefik
-    targetRevision: 20.8.0
-#    path: infra/traefik
-#    repoURL: https://github.com/vehagn/homelab
-#    targetRevision: HEAD
-    helm:
-      values: |
-        deployment:
-          initContainers:
-            - name: volume-permissions
-              image: busybox:1.31.1
-              command: [ "sh", "-c", "chmod -Rv 600 /data/*" ]
-              volumeMounts:
-                - name: data
-                  mountPath: /data
-        providers:
-          kubernetesCRD:
-            allowCrossNamespace: true
-        additionalArguments:
-          - "--log.level=ERROR"
-          - "--api.insecure"
-        persistence:
-          enabled: true
-          name: data
-          accessMode: ReadWriteOnce
-          size: 128Mi
-          storageClass: cert-storage
-          path: /data
-        certResolvers:
-          letsencrypt:
-            email: [email protected]
-            tlsChallenge: true
-            storage: /data/acme.json
+    plugin:
+      name: kustomize-build-with-helm
+    path: infra/traefik
+    repoURL: https://github.com/vehagn/homelab
+    targetRevision: HEAD
   destination:
     namespace: traefik-system
     name: in-cluster
   syncPolicy:
     automated:
       selfHeal: true
+      prune: true
     syncOptions:
       - CreateNamespace=true

main.tf

@@ -1,91 +0,0 @@
-terraform {
-  required_providers {
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = ">= 2.0.0"
-    }
-    helm       = {
-      source  = "hashicorp/helm"
-      version = ">= 2.5.0"
-    }
-  }
-}
-
-provider "kubernetes" {
-  config_path = "~/.kube/config"
-}
-
-provider "helm" {
-  kubernetes {
-    config_path = "~/.kube/config"
-  }
-}
-
-#resource "helm_release" "cilium" {
-#  name = "cilium"
-#
-#  repository = "https://helm.cilium.io"
-#  chart      = "cilium"
-#  namespace  = "kube-system"
-#  version    = "1.11.5"
-#}
-
-### Create namespace for Traefik
-#resource "kubernetes_namespace" "traefik" {
-#  metadata {
-#    name = "traefik-system"
-#  }
-#}
-
-## Create StorageClass for local volumes
-resource "kubernetes_storage_class" "cert-storage" {
-  metadata {
-    name = "cert-storage"
-  }
-  storage_provisioner = "kubernetes.io/no-provisioner"
-  volume_binding_mode = "WaitForFirstConsumer"
-}
-
-## Create PersistentVolume for Traefik certs
-resource "kubernetes_persistent_volume" "traefik-cert-pv" {
-  metadata {
-    name = "traefik-cert-pv"
-  }
-  spec {
-    capacity                         = {
-      storage = "128Mi"
-    }
-    volume_mode                      = "Filesystem"
-    access_modes                     = ["ReadWriteOnce"]
-    persistent_volume_reclaim_policy = "Retain"
-    storage_class_name               = "cert-storage"
-    persistent_volume_source {
-      local {
-        path = "/disk/etc/traefik/certs"
-      }
-    }
-    node_affinity {
-      required {
-        node_selector_term {
-          match_expressions {
-            key      = "kubernetes.io/hostname"
-            operator = "In"
-            values   = ["gauss"]
-          }
-        }
-      }
-    }
-  }
-}
-
-### Install Traefik
-#resource "helm_release" "traefik" {
-#  name = "traefik"
-#
-#  repository = "https://helm.traefik.io/traefik"
-#  chart      = "traefik"
-#  namespace  = kubernetes_namespace.traefik.metadata.0.name
-#  #version    = "10.30.1"
-#
-#  values = [file("helm/traefik-values.yaml")]
-#}