Skip to content

Commit 96decc7

Browse files
HomeLabJunkieHomeLabJunkie
committed
chore: initial commit 🚀
1 parent 334dc7e commit 96decc7

File tree

91 files changed

+2258
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+2258
-0
lines changed

‎.sops.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
creation_rules:
3+
- path_regex: talos/.*\.sops\.ya?ml
4+
mac_only_encrypted: true
5+
age: "age1w58lmpj3jjxewn5w4hu6u44zyg4hstq3vhwmlkmt0nkp3h2rm3ls0pyng5"
6+
- path_regex: (bootstrap|kubernetes)/.*\.sops\.ya?ml
7+
encrypted_regex: "^(data|stringData)$"
8+
mac_only_encrypted: true
9+
age: "age1w58lmpj3jjxewn5w4hu6u44zyg4hstq3vhwmlkmt0nkp3h2rm3ls0pyng5"
10+
stores:
11+
yaml:
12+
indent: 2

‎bootstrap/helmfile.yaml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/helmfile
3+
4+
helmDefaults:
5+
cleanupOnFail: true
6+
wait: true
7+
waitForJobs: true
8+
# waitRetries: 3 # Not supported by Helm yet
9+
10+
repositories:
11+
- name: controlplaneio
12+
url: ghcr.io/controlplaneio-fluxcd/charts
13+
oci: true
14+
15+
- name: coredns
16+
url: ghcr.io/coredns/charts
17+
oci: true
18+
19+
- name: cilium
20+
url: https://helm.cilium.io
21+
22+
- name: jetstack
23+
url: https://charts.jetstack.io
24+
25+
- name: spegel
26+
url: ghcr.io/spegel-org/helm-charts
27+
oci: true
28+
29+
releases:
30+
- name: cilium
31+
namespace: kube-system
32+
atomic: true
33+
chart: cilium/cilium
34+
version: 1.17.1
35+
values: ['{{ requiredEnv "ROOT_DIR" }}/kubernetes/apps/kube-system/cilium/app/helm/values.yaml']
36+
37+
- name: coredns
38+
namespace: kube-system
39+
atomic: true
40+
chart: coredns/coredns
41+
version: 1.39.1
42+
values: ['{{ requiredEnv "ROOT_DIR" }}/kubernetes/apps/kube-system/coredns/app/helm/values.yaml']
43+
needs: ['kube-system/cilium']
44+
45+
- name: spegel
46+
namespace: kube-system
47+
atomic: true
48+
chart: spegel/spegel
49+
version: v0.0.30
50+
values: ['{{ requiredEnv "ROOT_DIR" }}/kubernetes/apps/kube-system/spegel/app/helm/values.yaml']
51+
needs: ['kube-system/coredns']
52+
53+
- name: cert-manager
54+
namespace: cert-manager
55+
atomic: true
56+
chart: jetstack/cert-manager
57+
version: v1.17.1
58+
values: ['{{ requiredEnv "ROOT_DIR" }}/kubernetes/apps/cert-manager/cert-manager/app/helm/values.yaml']
59+
needs: ['kube-system/spegel']
60+
61+
- name: flux-operator
62+
namespace: flux-system
63+
atomic: true
64+
chart: controlplaneio/flux-operator
65+
version: 0.17.0
66+
values: ['{{ requiredEnv "ROOT_DIR" }}/kubernetes/apps/flux-system/flux-operator/app/helm/values.yaml']
67+
needs: ['cert-manager/cert-manager']
68+
69+
- name: flux-instance
70+
namespace: flux-system
71+
atomic: true
72+
chart: controlplaneio/flux-instance
73+
version: 0.17.0
74+
values: ['{{ requiredEnv "ROOT_DIR" }}/kubernetes/apps/flux-system/flux-instance/app/helm/values.yaml']
75+
needs: ['flux-system/flux-operator']

‎kubernetes/apps/cert-manager/cert-manager/app/clusterissuer.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/cert-manager.io/clusterissuer_v1.json
3+
apiVersion: cert-manager.io/v1
4+
kind: ClusterIssuer
5+
metadata:
6+
name: letsencrypt-production
7+
spec:
8+
acme:
9+
server: https://acme-v02.api.letsencrypt.org/directory
10+
privateKeySecretRef:
11+
name: letsencrypt-production
12+
solvers:
13+
- dns01:
14+
cloudflare:
15+
apiTokenSecretRef:
16+
name: cert-manager-secret
17+
key: api-token
18+
selector:
19+
dnsZones: ["${SECRET_DOMAIN}"]

‎kubernetes/apps/cert-manager/cert-manager/app/helm/kustomizeconfig.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
nameReference:
3+
- kind: ConfigMap
4+
version: v1
5+
fieldSpecs:
6+
- path: spec/valuesFrom/name
7+
kind: HelmRelease

‎kubernetes/apps/cert-manager/cert-manager/app/helm/values.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
crds:
3+
enabled: true
4+
replicaCount: 1
5+
dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query
6+
dns01RecursiveNameserversOnly: true
7+
prometheus:
8+
enabled: true
9+
servicemonitor:
10+
enabled: true

‎kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrepository-source-v1.json
3+
apiVersion: source.toolkit.fluxcd.io/v1
4+
kind: HelmRepository
5+
metadata:
6+
name: jetstack
7+
namespace: cert-manager # Required for Renovate lookups
8+
spec:
9+
interval: 1h
10+
url: https://charts.jetstack.io
11+
---
12+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
13+
apiVersion: helm.toolkit.fluxcd.io/v2
14+
kind: HelmRelease
15+
metadata:
16+
name: cert-manager
17+
spec:
18+
interval: 1h
19+
chart:
20+
spec:
21+
chart: cert-manager
22+
version: v1.17.1
23+
sourceRef:
24+
kind: HelmRepository
25+
name: jetstack
26+
namespace: cert-manager
27+
install:
28+
remediation:
29+
retries: 3
30+
upgrade:
31+
cleanupOnFail: true
32+
remediation:
33+
retries: 3
34+
valuesFrom:
35+
- kind: ConfigMap
36+
name: cert-manager-values

‎kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ./clusterissuer.yaml
7+
- ./helmrelease.yaml
8+
- ./secret.sops.yaml
9+
configMapGenerator:
10+
- name: cert-manager-values
11+
files:
12+
- values.yaml=./helm/values.yaml
13+
configurations:
14+
- ./helm/kustomizeconfig.yaml

‎kubernetes/apps/cert-manager/cert-manager/app/secret.sops.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/secret-v1.json
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: cert-manager-secret
6+
stringData:
7+
api-token: ENC[AES256_GCM,data:mNXkYKAcDwWoRzRPtDqJYfMfk/Zf5PSGgbtYpsZUNj64kZASwUkBJQ==,iv:HKsspFAcOgPWPZ9mfoZZm5bP2YCpKQOotTLt0Ey/v3Y=,tag:V7loNsr9TiPAxLvw5lAYgw==,type:str]
8+
sops:
9+
kms: []
10+
gcp_kms: []
11+
azure_kv: []
12+
hc_vault: []
13+
age:
14+
- recipient: age1w58lmpj3jjxewn5w4hu6u44zyg4hstq3vhwmlkmt0nkp3h2rm3ls0pyng5
15+
enc: |
16+
-----BEGIN AGE ENCRYPTED FILE-----
17+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrc0ptZDJwcEhLSk90enFG
18+
ckxDOWNTcU41ZHA1ZEoyWWFyOUpEM0MwQWxVCkxweG9ZN1ZHeklDTGRYeFhTdEtq
19+
V3h3ejhKS0VHVFlGaGFuN3NXeWY0cGcKLS0tIFZyQkhSTGNmSkxmWWcrb2NGQndR
20+
cnV2aGQyZC9vOUZDSlpESmhJdzJJT1kKjoanZw0ORsiv8zhmQVA2hY2u2Hy6/UJR
21+
3/7tm68C3smADsd9y8PucW0ynB5mH+Bn58Ipv+fUNfaI0ASW99HJsg==
22+
-----END AGE ENCRYPTED FILE-----
23+
lastmodified: "2025-03-14T16:27:40Z"
24+
mac: ENC[AES256_GCM,data:XhY/TOui51uJC7F6ZlbkJv+JMVrxC9sAxJ+uNKtmhrVanE3h/RJp0MdYt4ksobIZTatD/82Dx2WX01uG5XwazfEpzvcavDl81pl6o8iYAQE94bm6kB5+eSLmuDxaxrcfokLCnD7dvLzXfcoMLGeeGO7aUhS7cDgGGxZ7Pv3VYrg=,iv:62YwtN6I/rJWrs8X1j1moJw1TJX5e2f4c1Q8u7Gkdbk=,tag:A+U9bLDx6uKbi7RmiRvt9Q==,type:str]
25+
pgp: []
26+
encrypted_regex: ^(data|stringData)$
27+
mac_only_encrypted: true
28+
version: 3.9.4

‎kubernetes/apps/cert-manager/cert-manager/ks.yaml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
3+
apiVersion: kustomize.toolkit.fluxcd.io/v1
4+
kind: Kustomization
5+
metadata:
6+
name: &app cert-manager
7+
namespace: &namespace cert-manager
8+
spec:
9+
commonMetadata:
10+
labels:
11+
app.kubernetes.io/name: *app
12+
healthCheckExprs:
13+
- apiVersion: cert-manager.io/v1
14+
kind: ClusterIssuer
15+
failed: status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'False')
16+
current: status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'True')
17+
interval: 1h
18+
path: ./kubernetes/apps/cert-manager/cert-manager/app
19+
prune: true
20+
retryInterval: 2m
21+
sourceRef:
22+
kind: GitRepository
23+
name: flux-system
24+
namespace: flux-system
25+
targetNamespace: *namespace
26+
timeout: 15m
27+
wait: true
28+
---
29+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
30+
apiVersion: kustomize.toolkit.fluxcd.io/v1
31+
kind: Kustomization
32+
metadata:
33+
name: &app cert-manager-tls
34+
namespace: &namespace cert-manager
35+
spec:
36+
commonMetadata:
37+
labels:
38+
app.kubernetes.io/name: *app
39+
dependsOn:
40+
- name: cert-manager
41+
namespace: cert-manager
42+
healthCheckExprs:
43+
- apiVersion: cert-manager.io/v1
44+
kind: Certificate
45+
failed: status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'False')
46+
current: status.conditions.filter(e, e.type == 'Ready').all(e, e.status == 'True')
47+
interval: 1h
48+
path: ./kubernetes/apps/cert-manager/cert-manager/tls
49+
prune: true
50+
retryInterval: 2m
51+
sourceRef:
52+
kind: GitRepository
53+
name: flux-system
54+
namespace: flux-system
55+
targetNamespace: *namespace
56+
timeout: 15m
57+
wait: true

‎kubernetes/apps/cert-manager/cert-manager/tls/certificate.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/cert-manager.io/certificate_v1.json
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: "${SECRET_DOMAIN/./-}-production"
7+
spec:
8+
secretName: "${SECRET_DOMAIN/./-}-production-tls"
9+
issuerRef:
10+
name: letsencrypt-production
11+
kind: ClusterIssuer
12+
commonName: "${SECRET_DOMAIN}"
13+
dnsNames: ["${SECRET_DOMAIN}", "*.${SECRET_DOMAIN}"]

‎kubernetes/apps/cert-manager/cert-manager/tls/kustomization.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ./certificate.yaml

‎kubernetes/apps/cert-manager/kustomization.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
namespace: cert-manager
6+
components:
7+
- ../../components/common
8+
resources:
9+
- ./cert-manager/ks.yaml

‎kubernetes/apps/default/echo/app/helmrelease.yaml

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
3+
apiVersion: helm.toolkit.fluxcd.io/v2
4+
kind: HelmRelease
5+
metadata:
6+
name: echo
7+
spec:
8+
interval: 1h
9+
chartRef:
10+
kind: OCIRepository
11+
name: app-template
12+
install:
13+
remediation:
14+
retries: 3
15+
upgrade:
16+
cleanupOnFail: true
17+
remediation:
18+
retries: 3
19+
dependsOn:
20+
- name: cloudflared
21+
namespace: network
22+
values:
23+
controllers:
24+
echo:
25+
strategy: RollingUpdate
26+
containers:
27+
app:
28+
image:
29+
repository: ghcr.io/mendhak/http-https-echo
30+
tag: 35
31+
env:
32+
HTTP_PORT: &port 80
33+
LOG_WITHOUT_NEWLINE: true
34+
LOG_IGNORE_PATH: /healthz
35+
PROMETHEUS_ENABLED: true
36+
probes:
37+
liveness: &probes
38+
enabled: true
39+
custom: true
40+
spec:
41+
httpGet:
42+
path: /healthz
43+
port: *port
44+
initialDelaySeconds: 0
45+
periodSeconds: 10
46+
timeoutSeconds: 1
47+
failureThreshold: 3
48+
readiness: *probes
49+
securityContext:
50+
allowPrivilegeEscalation: false
51+
readOnlyRootFilesystem: true
52+
capabilities: { drop: ["ALL"] }
53+
resources:
54+
requests:
55+
cpu: 10m
56+
limits:
57+
memory: 64Mi
58+
defaultPodOptions:
59+
securityContext:
60+
runAsNonRoot: true
61+
runAsUser: 65534
62+
runAsGroup: 65534
63+
seccompProfile: { type: RuntimeDefault }
64+
service:
65+
app:
66+
controller: echo
67+
ports:
68+
http:
69+
port: *port
70+
serviceMonitor:
71+
app:
72+
serviceName: echo
73+
endpoints:
74+
- port: http
75+
scheme: http
76+
path: /metrics
77+
interval: 1m
78+
scrapeTimeout: 10s
79+
ingress:
80+
app:
81+
className: external
82+
annotations:
83+
external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
84+
hosts:
85+
- host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
86+
paths:
87+
- path: /
88+
service:
89+
identifier: app
90+
port: http

‎kubernetes/apps/default/echo/app/kustomization.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ./helmrelease.yaml

0 commit comments

Comments
 (0)