From aa6af35f48ca9b9c797cf688c3d673edb2796382 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Fri, 19 Jul 2024 15:56:13 +0200 Subject: [PATCH] feat: routes to cluster external services Routes to Home Assistant, Proxmox and TrueNAS --- .../k8s/apps/external/application-set.yaml | 34 ++++++++++++ .../apps/external/haos/endpoint-slice.yaml | 17 ++++++ .../k8s/apps/external/haos/http-route.yaml | 15 ++++++ .../k8s/apps/external/haos/kustomization.yaml | 8 +++ remodel/k8s/apps/external/haos/ns.yaml | 4 ++ remodel/k8s/apps/external/haos/svc.yaml | 10 ++++ remodel/k8s/apps/external/kustomization.yaml | 10 ++++ remodel/k8s/apps/external/project.yaml | 20 +++++++ .../apps/external/proxmox/endpoint-slice.yaml | 19 +++++++ .../apps/external/proxmox/kustomization.yaml | 8 +++ remodel/k8s/apps/external/proxmox/ns.yaml | 4 ++ remodel/k8s/apps/external/proxmox/svc.yaml | 11 ++++ .../k8s/apps/external/proxmox/tls-route.yaml | 15 ++++++ .../apps/external/truenas/endpoint-slice.yaml | 17 ++++++ .../apps/external/truenas/kustomization.yaml | 8 +++ remodel/k8s/apps/external/truenas/ns.yaml | 4 ++ remodel/k8s/apps/external/truenas/svc.yaml | 10 ++++ .../k8s/apps/external/truenas/tls-route.yaml | 15 ++++++ .../k8s/infra/controllers/argocd/values.yaml | 52 +++++++++---------- .../cloudflared/cloudflared-config.yaml | 13 +++-- ...w-proxmox.yaml => gw-tls-passthrough.yaml} | 17 ++++-- .../infra/network/gateway/kustomization.yaml | 2 +- 22 files changed, 279 insertions(+), 34 deletions(-) create mode 100644 remodel/k8s/apps/external/application-set.yaml create mode 100644 remodel/k8s/apps/external/haos/endpoint-slice.yaml create mode 100644 remodel/k8s/apps/external/haos/http-route.yaml create mode 100644 remodel/k8s/apps/external/haos/kustomization.yaml create mode 100644 remodel/k8s/apps/external/haos/ns.yaml create mode 100644 remodel/k8s/apps/external/haos/svc.yaml create mode 100644 remodel/k8s/apps/external/kustomization.yaml create mode 100644 remodel/k8s/apps/external/project.yaml create mode 100644 remodel/k8s/apps/external/proxmox/endpoint-slice.yaml create mode 100644 remodel/k8s/apps/external/proxmox/kustomization.yaml create mode 100644 remodel/k8s/apps/external/proxmox/ns.yaml create mode 100644 remodel/k8s/apps/external/proxmox/svc.yaml create mode 100644 remodel/k8s/apps/external/proxmox/tls-route.yaml create mode 100644 remodel/k8s/apps/external/truenas/endpoint-slice.yaml create mode 100644 remodel/k8s/apps/external/truenas/kustomization.yaml create mode 100644 remodel/k8s/apps/external/truenas/ns.yaml create mode 100644 remodel/k8s/apps/external/truenas/svc.yaml create mode 100644 remodel/k8s/apps/external/truenas/tls-route.yaml rename remodel/k8s/infra/network/gateway/{gw-proxmox.yaml => gw-tls-passthrough.yaml} (51%) diff --git a/remodel/k8s/apps/external/application-set.yaml b/remodel/k8s/apps/external/application-set.yaml new file mode 100644 index 0000000..03ccbb0 --- /dev/null +++ b/remodel/k8s/apps/external/application-set.yaml @@ -0,0 +1,34 @@ +apiVersion: argoproj.io/v1alpha1 +kind: ApplicationSet +metadata: + name: external + namespace: argocd + labels: + dev.stonegarden: external +spec: + generators: + - git: + repoURL: https://github.com/vehagn/homelab + revision: remodel + directories: + - path: remodel/k8s/apps/external/* + template: + metadata: + name: '{{ path.basename }}' + labels: + dev.stonegarden: application + finalizers: + - resources-finalizer.argocd.argoproj.io + spec: + project: external + source: + repoURL: https://github.com/vehagn/homelab + targetRevision: remodel + path: '{{ path }}' + destination: + name: in-cluster + namespace: argocd + syncPolicy: + automated: + selfHeal: true + prune: true \ No newline at end of file diff --git a/remodel/k8s/apps/external/haos/endpoint-slice.yaml b/remodel/k8s/apps/external/haos/endpoint-slice.yaml new file mode 100644 index 0000000..6ffbda2 --- /dev/null +++ b/remodel/k8s/apps/external/haos/endpoint-slice.yaml @@ -0,0 +1,17 @@ +apiVersion: discovery.k8s.io/v1 +kind: EndpointSlice +metadata: + name: home-assistant + namespace: haos + labels: + kubernetes.io/service-name: home-assistant + endpointslice.kubernetes.io/managed-by: cluster-admins +addressType: IPv4 +ports: + - name: http + protocol: TCP + port: 8123 +endpoints: + - addresses: + - 192.168.1.27 + conditions: { } # https://github.com/argoproj/argo-cd/issues/15554 diff --git a/remodel/k8s/apps/external/haos/http-route.yaml b/remodel/k8s/apps/external/haos/http-route.yaml new file mode 100644 index 0000000..30ba833 --- /dev/null +++ b/remodel/k8s/apps/external/haos/http-route.yaml @@ -0,0 +1,15 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: home-assistant + namespace: haos +spec: + parentRefs: + - name: stonegarden + namespace: gateway + hostnames: + - "haos.stonegarden.dev" + rules: + - backendRefs: + - name: home-assistant + port: 8123 \ No newline at end of file diff --git a/remodel/k8s/apps/external/haos/kustomization.yaml b/remodel/k8s/apps/external/haos/kustomization.yaml new file mode 100644 index 0000000..ea2cdd2 --- /dev/null +++ b/remodel/k8s/apps/external/haos/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ns.yaml + - svc.yaml + - endpoint-slice.yaml + - http-route.yaml \ No newline at end of file diff --git a/remodel/k8s/apps/external/haos/ns.yaml b/remodel/k8s/apps/external/haos/ns.yaml new file mode 100644 index 0000000..5e74a7e --- /dev/null +++ b/remodel/k8s/apps/external/haos/ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: haos \ No newline at end of file diff --git a/remodel/k8s/apps/external/haos/svc.yaml b/remodel/k8s/apps/external/haos/svc.yaml new file mode 100644 index 0000000..b36eaf0 --- /dev/null +++ b/remodel/k8s/apps/external/haos/svc.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Service +metadata: + name: home-assistant + namespace: haos +spec: + ports: + - name: http + protocol: TCP + port: 8123 \ No newline at end of file diff --git a/remodel/k8s/apps/external/kustomization.yaml b/remodel/k8s/apps/external/kustomization.yaml new file mode 100644 index 0000000..7d5929f --- /dev/null +++ b/remodel/k8s/apps/external/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: argocd +commonLabels: + dev.stonegarden: app-management + app.kubernetes.io/managed-by: argocd + +resources: + - project.yaml + - application-set.yaml diff --git a/remodel/k8s/apps/external/project.yaml b/remodel/k8s/apps/external/project.yaml new file mode 100644 index 0000000..3523b11 --- /dev/null +++ b/remodel/k8s/apps/external/project.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: external + namespace: argocd +spec: + sourceRepos: + - 'https://github.com/vehagn/homelab' + destinations: + - namespace: 'argocd' + server: '*' + - namespace: 'haos' + server: '*' + - namespace: 'proxmox' + server: '*' + - namespace: 'truenas' + server: '*' + clusterResourceWhitelist: + - group: '*' + kind: '*' \ No newline at end of file diff --git a/remodel/k8s/apps/external/proxmox/endpoint-slice.yaml b/remodel/k8s/apps/external/proxmox/endpoint-slice.yaml new file mode 100644 index 0000000..a539e42 --- /dev/null +++ b/remodel/k8s/apps/external/proxmox/endpoint-slice.yaml @@ -0,0 +1,19 @@ +apiVersion: discovery.k8s.io/v1 +kind: EndpointSlice +metadata: + name: proxmox + namespace: proxmox + labels: + kubernetes.io/service-name: proxmox + endpointslice.kubernetes.io/managed-by: cluster-admins +addressType: IPv4 +ports: + - name: https + protocol: TCP + port: 8006 +endpoints: + - addresses: + - 192.168.1.42 + - 192.168.1.52 + - 192.168.1.62 + conditions: { } # https://github.com/argoproj/argo-cd/issues/15554 diff --git a/remodel/k8s/apps/external/proxmox/kustomization.yaml b/remodel/k8s/apps/external/proxmox/kustomization.yaml new file mode 100644 index 0000000..f1ae4c2 --- /dev/null +++ b/remodel/k8s/apps/external/proxmox/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ns.yaml + - svc.yaml + - endpoint-slice.yaml + - tls-route.yaml diff --git a/remodel/k8s/apps/external/proxmox/ns.yaml b/remodel/k8s/apps/external/proxmox/ns.yaml new file mode 100644 index 0000000..88ea715 --- /dev/null +++ b/remodel/k8s/apps/external/proxmox/ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: proxmox diff --git a/remodel/k8s/apps/external/proxmox/svc.yaml b/remodel/k8s/apps/external/proxmox/svc.yaml new file mode 100644 index 0000000..688be4e --- /dev/null +++ b/remodel/k8s/apps/external/proxmox/svc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: proxmox + namespace: proxmox +spec: + ports: + - name: https + protocol: TCP + port: 443 + targetPort: 8006 diff --git a/remodel/k8s/apps/external/proxmox/tls-route.yaml b/remodel/k8s/apps/external/proxmox/tls-route.yaml new file mode 100644 index 0000000..a617f9a --- /dev/null +++ b/remodel/k8s/apps/external/proxmox/tls-route.yaml @@ -0,0 +1,15 @@ +apiVersion: gateway.networking.k8s.io/v1alpha2 +kind: TLSRoute +metadata: + name: proxmox-tls + namespace: proxmox +spec: + parentRefs: + - name: tls-passthrough + namespace: gateway + hostnames: + - "proxmox.stonegarden.dev" + rules: + - backendRefs: + - name: proxmox + port: 443 diff --git a/remodel/k8s/apps/external/truenas/endpoint-slice.yaml b/remodel/k8s/apps/external/truenas/endpoint-slice.yaml new file mode 100644 index 0000000..996b9a0 --- /dev/null +++ b/remodel/k8s/apps/external/truenas/endpoint-slice.yaml @@ -0,0 +1,17 @@ +apiVersion: discovery.k8s.io/v1 +kind: EndpointSlice +metadata: + name: truenas + namespace: truenas + labels: + kubernetes.io/service-name: truenas + endpointslice.kubernetes.io/managed-by: cluster-admins +addressType: IPv4 +ports: + - name: https + protocol: TCP + port: 443 +endpoints: + - addresses: + - 192.168.1.55 + conditions: { } # https://github.com/argoproj/argo-cd/issues/15554 diff --git a/remodel/k8s/apps/external/truenas/kustomization.yaml b/remodel/k8s/apps/external/truenas/kustomization.yaml new file mode 100644 index 0000000..f1ae4c2 --- /dev/null +++ b/remodel/k8s/apps/external/truenas/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ns.yaml + - svc.yaml + - endpoint-slice.yaml + - tls-route.yaml diff --git a/remodel/k8s/apps/external/truenas/ns.yaml b/remodel/k8s/apps/external/truenas/ns.yaml new file mode 100644 index 0000000..156b59d --- /dev/null +++ b/remodel/k8s/apps/external/truenas/ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: truenas diff --git a/remodel/k8s/apps/external/truenas/svc.yaml b/remodel/k8s/apps/external/truenas/svc.yaml new file mode 100644 index 0000000..92a9cc5 --- /dev/null +++ b/remodel/k8s/apps/external/truenas/svc.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Service +metadata: + name: truenas + namespace: truenas +spec: + ports: + - name: https + protocol: TCP + port: 443 diff --git a/remodel/k8s/apps/external/truenas/tls-route.yaml b/remodel/k8s/apps/external/truenas/tls-route.yaml new file mode 100644 index 0000000..a96b6eb --- /dev/null +++ b/remodel/k8s/apps/external/truenas/tls-route.yaml @@ -0,0 +1,15 @@ +apiVersion: gateway.networking.k8s.io/v1alpha2 +kind: TLSRoute +metadata: + name: truenas + namespace: truenas +spec: + parentRefs: + - name: tls-passthrough + namespace: gateway + hostnames: + - "truenas.stonegarden.dev" + rules: + - backendRefs: + - name: truenas + port: 443 \ No newline at end of file diff --git a/remodel/k8s/infra/controllers/argocd/values.yaml b/remodel/k8s/infra/controllers/argocd/values.yaml index 70932c5..4461451 100644 --- a/remodel/k8s/infra/controllers/argocd/values.yaml +++ b/remodel/k8s/infra/controllers/argocd/values.yaml @@ -19,39 +19,39 @@ crds: controller: resources: - limits: - cpu: 1000m - memory: 2Gi requests: cpu: 100m memory: 700Mi + limits: + cpu: 4000m + memory: 2Gi dex: resources: - limits: - cpu: 50m - memory: 64Mi requests: cpu: 10m memory: 32Mi + limits: + cpu: 1000m + memory: 64Mi redis: resources: - limits: - cpu: 200m - memory: 128Mi requests: cpu: 100m memory: 64Mi + limits: + cpu: 2000m + memory: 128Mi server: resources: - limits: - cpu: 100m - memory: 128Mi requests: cpu: 50m memory: 64Mi + limits: + cpu: 4000m + memory: 128Mi repoServer: containerSecurityContext: @@ -63,12 +63,12 @@ repoServer: - name: cmp-tmp emptyDir: { } resources: - limits: - cpu: 50m - memory: 512Mi requests: - cpu: 10m + cpu: 100m memory: 256Mi + limits: + cpu: 4000m + memory: 512Mi extraContainers: - name: kustomize-build-with-helm command: @@ -94,19 +94,19 @@ repoServer: applicationSet: resources: - limits: - cpu: 50m - memory: 256Mi - requests: - cpu: 10m - memory: 64Mi + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 1000m + memory: 256Mi notifications: enabled: false resources: - limits: - cpu: 50m - memory: 128Mi requests: - cpu: 10m + cpu: 100m memory: 64Mi + limits: + cpu: 1000m + memory: 128Mi diff --git a/remodel/k8s/infra/network/cloudflared/cloudflared-config.yaml b/remodel/k8s/infra/network/cloudflared/cloudflared-config.yaml index 9030758..4e0a9ca 100644 --- a/remodel/k8s/infra/network/cloudflared/cloudflared-config.yaml +++ b/remodel/k8s/infra/network/cloudflared/cloudflared-config.yaml @@ -9,10 +9,17 @@ warp-routing: ingress: - hostname: hello.euclid.stonegarden.dev service: hello_world - - hostname: haos.stonegarden.dev - service: https://cilium-gateway-stonegarden.gateway.svc.cluster.local:443 + - hostname: proxmox.stonegarden.dev + service: https://proxmox.proxmox.svc.cluster.local:443 + #service: https://cilium-gateway-tls-passthrough.gateway.svc.cluster.local:443 originRequest: - originServerName: "*.stonegarden.dev" + originServerName: proxmox.stonegarden.dev + - hostname: truenas.stonegarden.dev + service: https://192.168.1.55:443 + #service: https://truenas.truenas.svc.cluster.local:443 + #service: https://cilium-gateway-tls-passthrough.gateway.svc.cluster.local:443 + originRequest: + originServerName: truenas.stonegarden.dev - hostname: "*.euclid.stonegarden.dev" service: https://cilium-gateway-euclid.gateway.svc.cluster.local:443 originRequest: diff --git a/remodel/k8s/infra/network/gateway/gw-proxmox.yaml b/remodel/k8s/infra/network/gateway/gw-tls-passthrough.yaml similarity index 51% rename from remodel/k8s/infra/network/gateway/gw-proxmox.yaml rename to remodel/k8s/infra/network/gateway/gw-tls-passthrough.yaml index 243616a..5be73be 100644 --- a/remodel/k8s/infra/network/gateway/gw-proxmox.yaml +++ b/remodel/k8s/infra/network/gateway/gw-tls-passthrough.yaml @@ -1,7 +1,7 @@ apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: - name: proxmox + name: tls-passthrough namespace: gateway spec: gatewayClassName: cilium @@ -11,10 +11,19 @@ spec: listeners: - protocol: TLS port: 443 - name: proxmox-tls-passthrough - hostname: "proxmox.euclid.stonegarden.dev" + name: proxmox + hostname: "proxmox.stonegarden.dev" tls: mode: Passthrough allowedRoutes: namespaces: - from: All \ No newline at end of file + from: All + - protocol: TLS + port: 443 + name: truenas + hostname: "truenas.stonegarden.dev" + tls: + mode: Passthrough + allowedRoutes: + namespaces: + from: All diff --git a/remodel/k8s/infra/network/gateway/kustomization.yaml b/remodel/k8s/infra/network/gateway/kustomization.yaml index b7af4a7..35490c5 100644 --- a/remodel/k8s/infra/network/gateway/kustomization.yaml +++ b/remodel/k8s/infra/network/gateway/kustomization.yaml @@ -7,5 +7,5 @@ resources: - cloudflare-api-token.yaml - cloudflare-issuer.yaml - gw-euclid.yaml -# - gw-proxmox.yaml - gw-stonegarden.yaml + - gw-tls-passthrough.yaml