From b066e543046ffa383cf6d534421306a1435e5c45 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Thu, 21 Dec 2023 19:16:23 +0100 Subject: [PATCH] feat(gateway): Enabled and configured Cilium as a GatewayClass Hooked up Cert-manager to Gateway for TLS certificatesk --- apps/media/jellyfin/http-route.yaml | 18 ++++++++++ apps/media/jellyfin/kustomization.yaml | 1 + apps/media/plex/http-route.yaml | 18 ++++++++++ apps/media/plex/kustomization.yaml | 1 + apps/test/whoami/http-route.yaml | 19 +++++++++++ apps/test/whoami/ingress-route.yaml | 4 +-- apps/test/whoami/ingress.yaml | 8 +---- apps/test/whoami/issuer.yaml | 17 --------- apps/test/whoami/kustomization.yaml | 3 +- infra/cert-manager/kustomization.yaml | 5 ++- infra/cilium/kustomization.yaml | 2 +- infra/cilium/values.yaml | 36 +++++++++----------- infra/gateway/cloudflare-api-token.yaml | 13 +++++++ infra/gateway/cloudflare-issuer.yaml | 17 +++++++++ infra/gateway/gateway-class.yaml | 6 ++++ infra/gateway/gateway.yaml | 29 ++++++++++++++++ infra/gateway/kustomization.yaml | 10 ++++++ infra/gateway/ns.yaml | 4 +++ infra/net-aux/config/cloudflared/config.yaml | 6 +++- infra/net-aux/config/pi-hole/02-custom.conf | 3 ++ infra/pi-hole/config/02-custom.conf | 3 ++ infra/project.yaml | 4 +++ 22 files changed, 176 insertions(+), 51 deletions(-) create mode 100644 apps/media/jellyfin/http-route.yaml create mode 100644 apps/media/plex/http-route.yaml create mode 100644 apps/test/whoami/http-route.yaml delete mode 100644 apps/test/whoami/issuer.yaml create mode 100644 infra/gateway/cloudflare-api-token.yaml create mode 100644 infra/gateway/cloudflare-issuer.yaml create mode 100644 infra/gateway/gateway-class.yaml create mode 100644 infra/gateway/gateway.yaml create mode 100644 infra/gateway/kustomization.yaml create mode 100644 infra/gateway/ns.yaml diff --git a/apps/media/jellyfin/http-route.yaml b/apps/media/jellyfin/http-route.yaml new file mode 100644 index 0000000..02e41b5 --- /dev/null +++ b/apps/media/jellyfin/http-route.yaml @@ -0,0 +1,18 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: jellyfin-http-route +spec: + parentRefs: + - name: cilium-gateway + namespace: gateway + hostnames: + - "jellyfin.stonegarden.dev" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: jellyfin-svc + port: 8096 \ No newline at end of file diff --git a/apps/media/jellyfin/kustomization.yaml b/apps/media/jellyfin/kustomization.yaml index 501687a..6b827fc 100644 --- a/apps/media/jellyfin/kustomization.yaml +++ b/apps/media/jellyfin/kustomization.yaml @@ -20,3 +20,4 @@ resources: - service.yaml - deployment.yaml - ingress.yaml + - http-route.yaml diff --git a/apps/media/plex/http-route.yaml b/apps/media/plex/http-route.yaml new file mode 100644 index 0000000..7eb97ed --- /dev/null +++ b/apps/media/plex/http-route.yaml @@ -0,0 +1,18 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: plex-http-route +spec: + parentRefs: + - name: cilium-gateway + namespace: gateway + hostnames: + - "plex.stonegarden.dev" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: plex + port: 32400 \ No newline at end of file diff --git a/apps/media/plex/kustomization.yaml b/apps/media/plex/kustomization.yaml index bd347de..826c539 100644 --- a/apps/media/plex/kustomization.yaml +++ b/apps/media/plex/kustomization.yaml @@ -20,3 +20,4 @@ resources: - service.yaml - deployment.yaml - ingress.yaml + - http-route.yaml diff --git a/apps/test/whoami/http-route.yaml b/apps/test/whoami/http-route.yaml new file mode 100644 index 0000000..acafc0a --- /dev/null +++ b/apps/test/whoami/http-route.yaml @@ -0,0 +1,19 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: whoami-http-route +spec: + parentRefs: + - name: cilium-gateway + namespace: gateway + hostnames: + - "gateway.stonegarden.dev" + - "gateway-direct.stonegarden.dev" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: whoami + port: 80 \ No newline at end of file diff --git a/apps/test/whoami/ingress-route.yaml b/apps/test/whoami/ingress-route.yaml index 2cb335a..3538dc2 100644 --- a/apps/test/whoami/ingress-route.yaml +++ b/apps/test/whoami/ingress-route.yaml @@ -1,7 +1,7 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: whoami + name: whoami-ingress-route labels: app: traefik spec: @@ -22,7 +22,7 @@ spec: port: 80 middlewares: - name: traefik-forward-auth - - match: Host(`whoami-open.stonegarden.dev`) + - match: Host(`whoami-ingress-route.stonegarden.dev`) kind: Rule services: - name: whoami diff --git a/apps/test/whoami/ingress.yaml b/apps/test/whoami/ingress.yaml index 1917ff3..7baec63 100644 --- a/apps/test/whoami/ingress.yaml +++ b/apps/test/whoami/ingress.yaml @@ -3,15 +3,9 @@ kind: Ingress metadata: name: whoami-ingress namespace: whoami - annotations: - cert-manager.io/issuer: "cloudflare-issuer" spec: -# tls: -# - hosts: -# - issuer.stonegarden.dev -# secretName: tls-ingress-https rules: - - host: issuer.stonegarden.dev + - host: whoami-ingress.stonegarden.dev http: paths: - path: / diff --git a/apps/test/whoami/issuer.yaml b/apps/test/whoami/issuer.yaml deleted file mode 100644 index 4b19692..0000000 --- a/apps/test/whoami/issuer.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: le-whoami-http - namespace: whoami -spec: - acme: - email: veghag@gmail.com - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - # if not existing, register a new account and stores it - name: whoami-issuer-account-key - solvers: - - http01: - # The ingressClass used to create the necessary ingress routes - ingress: - class: traefik \ No newline at end of file diff --git a/apps/test/whoami/kustomization.yaml b/apps/test/whoami/kustomization.yaml index d588bac..dcef2c6 100644 --- a/apps/test/whoami/kustomization.yaml +++ b/apps/test/whoami/kustomization.yaml @@ -4,7 +4,8 @@ namespace: whoami resources: # - issuer.yaml - - ingress.yaml +# - ingress.yaml - ingress-route.yaml + - http-route.yaml - traefik-forward-auth - whoami \ No newline at end of file diff --git a/infra/cert-manager/kustomization.yaml b/infra/cert-manager/kustomization.yaml index df6e3ae..9453057 100644 --- a/infra/cert-manager/kustomization.yaml +++ b/infra/cert-manager/kustomization.yaml @@ -12,6 +12,5 @@ helmCharts: namespace: cert-manager valuesInline: installCRDs: true -# config: -# featureGates: -# experimentalGatewayAPISupport: true \ No newline at end of file + extraArgs: + - "--feature-gates=ExperimentalGatewayAPISupport=true" diff --git a/infra/cilium/kustomization.yaml b/infra/cilium/kustomization.yaml index 00d0bb1..8a7adca 100644 --- a/infra/cilium/kustomization.yaml +++ b/infra/cilium/kustomization.yaml @@ -11,7 +11,7 @@ resources: helmCharts: - name: cilium repo: https://helm.cilium.io - version: 1.14.4 + version: 1.14.5 releaseName: "cilium" namespace: kube-system valuesFile: values.yaml \ No newline at end of file diff --git a/infra/cilium/values.yaml b/infra/cilium/values.yaml index 48adf0d..883baae 100644 --- a/infra/cilium/values.yaml +++ b/infra/cilium/values.yaml @@ -2,21 +2,29 @@ cluster: name: gauss id: 0 -#debug: -# enabled: true - k8sServiceHost: "192.168.1.12" k8sServicePort: "6443" +kubeProxyReplacement: true + +operator: + # Can't have more replicas than nodes + replicas: 1 + rollOutPods: true + # Roll out cilium agent pods automatically when ConfigMap is updated. rollOutCiliumPods: true +#debug: +# enabled: true + +image: + tag: "v1.15.0-rc.0" + # Increase rate limit when doing L2 announcements k8sClientRateLimit: - qps: 50 - burst: 100 - -kubeProxyReplacement: true + qps: 100 + burst: 200 l2announcements: enabled: true @@ -26,9 +34,8 @@ externalIPs: enableCiliumEndpointSlice: true -operator: - # Can't have more replicas than nodes - replicas: 1 +gatewayAPI: + enabled: true hubble: enabled: true @@ -38,15 +45,6 @@ hubble: ui: enabled: true rollOutPods: true - frontend: - server: - ipv6: - enabled: false - tls: - auto: - enabled: true - method: helm - certValidityDuration: 1095 # mTLS authentication: diff --git a/infra/gateway/cloudflare-api-token.yaml b/infra/gateway/cloudflare-api-token.yaml new file mode 100644 index 0000000..94c1b9e --- /dev/null +++ b/infra/gateway/cloudflare-api-token.yaml @@ -0,0 +1,13 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: cloudflare-api-token + namespace: gateway +spec: + encryptedData: + api-token: AgB5clzsduCRhJYbeHhAc9azBeucWvZUAwFmZTgLayqwQ2iJKWtj4aBwbS/uhkKRLnT2Gb8+Tp43Za3B2wjq7beFzdg/o3icrtzOe0YFnS4ph1OZQgW5v9c+0FtdtbRMYuB3QDz8EuPpv13QkGw9JvaHtDMHWSDzIyV81cyYu8LRKvnU9oZBG7DJxsoRDaKMEpUdHKb5cBid7a+keTW8CAr50noN8pZd9qIXYIrnvCpap+vz7hasJz4VMajvZx7G4z2N+b/TS0+6jLW3MaDr13Etf9h2gUEwdrWiGghwNJ3T+lcYBdn0kgkWYK5X2Cvia/ca2bSCfOFrPW2hTaIa2WiiWm49ji4Q3QZdLAZCXeVAvErATPwui1Gqx0O7EEl6oAt/e9obf7DH7P5DgWjMCb6YE+5X0JT2C8fW2BNd7PgMkYrzgbthFwT4Tnmo1aApafr0YzUGdNnseVQtBWXcjeBRqcKZuEWmK15qIirFs9wUTWD2HwIt+KcVcF5ZUh0Lmw7a3ueXU88Ufebg/HJS3Qgrv390cHzhGFxl4/5mCHUjPHDt6Ox7mDNtwG9vQqUJsIpKb7huepiVjL59p2NF0dqxH77NAm5sN5vVqQhL1dFakCr3uJi0SFWESXrOTEpy+SvU+HCHSl7cXAWmCdNikvH/NS3icOMv4zl8gZ6UKP7V1SgpWGS9xBhVxtBbbDaoJwmPQAENP2VKZk955LVL5ajNyza7F6eFUpaXgOoaambuc0PTmRnFjZnz + template: + metadata: + name: cloudflare-api-token + namespace: gateway + type: Opaque diff --git a/infra/gateway/cloudflare-issuer.yaml b/infra/gateway/cloudflare-issuer.yaml new file mode 100644 index 0000000..a173780 --- /dev/null +++ b/infra/gateway/cloudflare-issuer.yaml @@ -0,0 +1,17 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: cloudflare-issuer + namespace: gateway +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: veghag@gmail.com + privateKeySecretRef: + name: cloudflare-key + solvers: + - dns01: + cloudflare: + apiTokenSecretRef: + name: cloudflare-api-token + key: api-token \ No newline at end of file diff --git a/infra/gateway/gateway-class.yaml b/infra/gateway/gateway-class.yaml new file mode 100644 index 0000000..fdae768 --- /dev/null +++ b/infra/gateway/gateway-class.yaml @@ -0,0 +1,6 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: GatewayClass +metadata: + name: cilium +spec: + controllerName: io.cilium/gateway-controller \ No newline at end of file diff --git a/infra/gateway/gateway.yaml b/infra/gateway/gateway.yaml new file mode 100644 index 0000000..96e9694 --- /dev/null +++ b/infra/gateway/gateway.yaml @@ -0,0 +1,29 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: cilium-gateway + namespace: gateway + annotations: + cert-manager.io/issuer: cloudflare-issuer + io.cilium/lb-ipam-ips: 192.168.1.172 +spec: + gatewayClassName: cilium + infrastructure: + labels: + test-label: test-label + annotations: + io.cilium/lb-ipam-ips: 192.168.1.172 + addresses: + - value: 192.168.1.172 + listeners: + - protocol: HTTPS + port: 443 + name: https-gateway + hostname: "*.stonegarden.dev" + tls: + certificateRefs: + - kind: Secret + name: cloudflare-cert + allowedRoutes: + namespaces: + from: All \ No newline at end of file diff --git a/infra/gateway/kustomization.yaml b/infra/gateway/kustomization.yaml new file mode 100644 index 0000000..1779f0c --- /dev/null +++ b/infra/gateway/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/experimental-install.yaml + - gateway-class.yaml + - ns.yaml + - cloudflare-api-token.yaml + - cloudflare-issuer.yaml + - gateway.yaml \ No newline at end of file diff --git a/infra/gateway/ns.yaml b/infra/gateway/ns.yaml new file mode 100644 index 0000000..6b6903e --- /dev/null +++ b/infra/gateway/ns.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: gateway \ No newline at end of file diff --git a/infra/net-aux/config/cloudflared/config.yaml b/infra/net-aux/config/cloudflared/config.yaml index bea5d07..9dd3b83 100644 --- a/infra/net-aux/config/cloudflared/config.yaml +++ b/infra/net-aux/config/cloudflared/config.yaml @@ -19,10 +19,14 @@ ingress: - aud1 d34ec64c62e56195ac6158dbfbeae62155d110f5c3a3b7e949572916dc57a6f3 - hostname: ssh.stonegarden.dev service: ssh://192.168.1.12:22 + - hostname: gateway.stonegarden.dev + service: https://cilium-gateway-cilium-gateway.gateway.svc.cluster.local:443 + originRequest: + originServerName: "*.stonegarden.dev" - hostname: stonegarden.dev service: https://traefik.traefik.svc.cluster.local:443 originRequest: - originServerName: stonegarden.dev + originServerName: "*.stonegarden.dev" - hostname: "*.stonegarden.dev" service: https://traefik.traefik.svc.cluster.local:443 originRequest: diff --git a/infra/net-aux/config/pi-hole/02-custom.conf b/infra/net-aux/config/pi-hole/02-custom.conf index c1f1be2..6afe3f5 100644 --- a/infra/net-aux/config/pi-hole/02-custom.conf +++ b/infra/net-aux/config/pi-hole/02-custom.conf @@ -1,2 +1,5 @@ address=/stonegarden.dev/192.168.1.142 +address=/gateway.stonegarden.dev/192.168.1.219 +address=/jellyfin.stonegarden.dev/192.168.1.219 +address=/plex.stonegarden.dev/192.168.1.219 edns-packet-max=1232 diff --git a/infra/pi-hole/config/02-custom.conf b/infra/pi-hole/config/02-custom.conf index c1f1be2..6afe3f5 100644 --- a/infra/pi-hole/config/02-custom.conf +++ b/infra/pi-hole/config/02-custom.conf @@ -1,2 +1,5 @@ address=/stonegarden.dev/192.168.1.142 +address=/gateway.stonegarden.dev/192.168.1.219 +address=/jellyfin.stonegarden.dev/192.168.1.219 +address=/plex.stonegarden.dev/192.168.1.219 edns-packet-max=1232 diff --git a/infra/project.yaml b/infra/project.yaml index 2e6eac2..b768e37 100644 --- a/infra/project.yaml +++ b/infra/project.yaml @@ -16,8 +16,12 @@ spec: server: '*' - namespace: 'cloudflared' server: '*' + - namespace: 'cilium-secrets' + server: '*' - namespace: 'cilium-spire' server: '*' + - namespace: 'gateway' + server: '*' - namespace: 'gpu-operator' server: '*' - namespace: 'kubernetes-dashboard'