From a13e7f7df65f0c4d2ce66d32ca2da7969072172f Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Mon, 9 Jan 2023 21:29:19 +0100 Subject: [PATCH] feat(traefik): Using Kustomize with Helm to deploy Traefik using ArgoCD --- helm/traefik-values.yaml | 34 ----------- infra/argocd/kustomization.yaml | 2 +- infra/traefik/kustomization.yaml | 5 ++ infra/traefik/persistentVolume.yaml | 31 ++++++++++ infra/traefik/storageClass.yaml | 7 +++ infra/traefikApp.yaml | 40 ++----------- main.tf | 91 ----------------------------- 7 files changed, 50 insertions(+), 160 deletions(-) delete mode 100644 helm/traefik-values.yaml create mode 100644 infra/traefik/persistentVolume.yaml create mode 100644 infra/traefik/storageClass.yaml delete mode 100644 main.tf diff --git a/helm/traefik-values.yaml b/helm/traefik-values.yaml deleted file mode 100644 index 05e6445..0000000 --- a/helm/traefik-values.yaml +++ /dev/null @@ -1,34 +0,0 @@ -deployment: - initContainers: - # The "volume-permissions" init container is required if you run into permission issues. - # Related issue: https://github.com/traefik/traefik/issues/6972 - - name: volume-permissions - image: busybox:1.31.1 - command: [ "sh", "-c", "chmod -Rv 600 /data/*" ] - volumeMounts: - - name: data - mountPath: /data - -providers: - kubernetesCRD: - allowCrossNamespace: true - -additionalArguments: - - "--log.level=ERROR" - - "--api.insecure" - -persistence: - enabled: true - name: data - accessMode: ReadWriteOnce - size: 128Mi - storageClass: cert-storage - path: /data - -certResolvers: - letsencrypt: - email: veghag@gmail.com - tlsChallenge: true - storage: /data/acme.json - # Remove staging server when it's working - #caServer: https://acme-staging-v02.api.letsencrypt.org/directory \ No newline at end of file diff --git a/infra/argocd/kustomization.yaml b/infra/argocd/kustomization.yaml index 4c91324..95f5505 100644 --- a/infra/argocd/kustomization.yaml +++ b/infra/argocd/kustomization.yaml @@ -11,7 +11,7 @@ resources: - applications.yaml patchesStrategicMerge: - # Kustomize Helm plugin + # Kustomize --enable-helm plugin for Helm charts - config/argocd-cm-kustomize-helm-patch.yaml # Let Traefik manage TLS-termination - config/argocd-cmd-params-cm-server-insecrure-patch.yaml diff --git a/infra/traefik/kustomization.yaml b/infra/traefik/kustomization.yaml index 8e95416..d403a93 100644 --- a/infra/traefik/kustomization.yaml +++ b/infra/traefik/kustomization.yaml @@ -2,8 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: traefik-system +resources: + - storageClass.yaml + - persistentVolume.yaml + helmCharts: - name: traefik repo: https://helm.traefik.io/traefik version: 20.8.0 + releaseName: "traefik" valuesFile: values.yaml diff --git a/infra/traefik/persistentVolume.yaml b/infra/traefik/persistentVolume.yaml new file mode 100644 index 0000000..cd71565 --- /dev/null +++ b/infra/traefik/persistentVolume.yaml @@ -0,0 +1,31 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + finalizers: + - kubernetes.io/pv-protection + name: traefik-cert-pv +spec: + capacity: + storage: 128Mi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: traefik +# namespace: traefik-system +# resourceVersion: "5491071" +# uid: 60ee134d-dcba-4615-a218-7f06a523fb46 + volumeMode: Filesystem + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Retain + storageClassName: cert-storage + local: + path: /disk/etc/traefik/certs + nodeAffinity: + required: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: In + values: + - gauss \ No newline at end of file diff --git a/infra/traefik/storageClass.yaml b/infra/traefik/storageClass.yaml new file mode 100644 index 0000000..0ec3075 --- /dev/null +++ b/infra/traefik/storageClass.yaml @@ -0,0 +1,7 @@ +allowVolumeExpansion: true +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: cert-storage +provisioner: kubernetes.io/no-provisioner +volumeBindingMode: WaitForFirstConsumer diff --git a/infra/traefikApp.yaml b/infra/traefikApp.yaml index 784e41d..ba0036c 100644 --- a/infra/traefikApp.yaml +++ b/infra/traefikApp.yaml @@ -8,45 +8,17 @@ metadata: spec: project: infrastructure source: - chart: traefik - repoURL: https://helm.traefik.io/traefik - targetRevision: 20.8.0 -# path: infra/traefik -# repoURL: https://github.com/vehagn/homelab -# targetRevision: HEAD - helm: - values: | - deployment: - initContainers: - - name: volume-permissions - image: busybox:1.31.1 - command: [ "sh", "-c", "chmod -Rv 600 /data/*" ] - volumeMounts: - - name: data - mountPath: /data - providers: - kubernetesCRD: - allowCrossNamespace: true - additionalArguments: - - "--log.level=ERROR" - - "--api.insecure" - persistence: - enabled: true - name: data - accessMode: ReadWriteOnce - size: 128Mi - storageClass: cert-storage - path: /data - certResolvers: - letsencrypt: - email: veghag@gmail.com - tlsChallenge: true - storage: /data/acme.json + plugin: + name: kustomize-build-with-helm + path: infra/traefik + repoURL: https://github.com/vehagn/homelab + targetRevision: HEAD destination: namespace: traefik-system name: in-cluster syncPolicy: automated: selfHeal: true + prune: true syncOptions: - CreateNamespace=true diff --git a/main.tf b/main.tf deleted file mode 100644 index 07cffff..0000000 --- a/main.tf +++ /dev/null @@ -1,91 +0,0 @@ -terraform { - required_providers { - kubernetes = { - source = "hashicorp/kubernetes" - version = ">= 2.0.0" - } - helm = { - source = "hashicorp/helm" - version = ">= 2.5.0" - } - } -} - -provider "kubernetes" { - config_path = "~/.kube/config" -} - -provider "helm" { - kubernetes { - config_path = "~/.kube/config" - } -} - -#resource "helm_release" "cilium" { -# name = "cilium" -# -# repository = "https://helm.cilium.io" -# chart = "cilium" -# namespace = "kube-system" -# version = "1.11.5" -#} - -### Create namespace for Traefik -#resource "kubernetes_namespace" "traefik" { -# metadata { -# name = "traefik-system" -# } -#} - -## Create StorageClass for local volumes -resource "kubernetes_storage_class" "cert-storage" { - metadata { - name = "cert-storage" - } - storage_provisioner = "kubernetes.io/no-provisioner" - volume_binding_mode = "WaitForFirstConsumer" -} - -## Create PersistentVolume for Traefik certs -resource "kubernetes_persistent_volume" "traefik-cert-pv" { - metadata { - name = "traefik-cert-pv" - } - spec { - capacity = { - storage = "128Mi" - } - volume_mode = "Filesystem" - access_modes = ["ReadWriteOnce"] - persistent_volume_reclaim_policy = "Retain" - storage_class_name = "cert-storage" - persistent_volume_source { - local { - path = "/disk/etc/traefik/certs" - } - } - node_affinity { - required { - node_selector_term { - match_expressions { - key = "kubernetes.io/hostname" - operator = "In" - values = ["gauss"] - } - } - } - } - } -} - -### Install Traefik -#resource "helm_release" "traefik" { -# name = "traefik" -# -# repository = "https://helm.traefik.io/traefik" -# chart = "traefik" -# namespace = kubernetes_namespace.traefik.metadata.0.name -# #version = "10.30.1" -# -# values = [file("helm/traefik-values.yaml")] -#} \ No newline at end of file