-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat!: Flux localhost bootstrap from 1P, add Sinon cluster
- installs Flux in hostNetwork mode binded to localhost to new clusters - rework Taskfiles for new bootstrap flow, including loading secrets direct from 1Password with no SOPS for secret zero - use 1Password for both talsecret and talenv for talhelper genconfig - remove SOPS secrets - add Sinon cluster, used as NAS - cleanup ExternalSecret and 1P Connect's Flux ks for smoother bootstrap - try out 1Password Connect as extraContainer in external-secrets deployment to avoid secrets going over network - general cleanup
- Loading branch information
Showing
56 changed files
with
1,818 additions
and
1,087 deletions.
There are no files selected for viewing
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,23 +1,25 @@ | ||
| [env] | ||
| KUBECTL_INTERACTIVE_DELETE = "true" | ||
| KUBECTL_COMMAND_HEADERS = "true" | ||
| #SSH_AUTH_SOCK = $(gpgconf --list-dirs agent-ssh-socket) | ||
|
|
||
| [tools] | ||
| # kubectl = [""] | ||
| # krew = [""] | ||
| # kubectx = [""] | ||
| kubectl = ["1.29.2"] | ||
| krew = ["0.4.4"] | ||
| kubectx = ["0.9.5"] | ||
| fzf = ["0.52.1"] # used by kubectx interactive mode | ||
| kustomize = ["5.3.0"] | ||
| # kubecolor = [""] | ||
| flux2 = ["2.2.3"] | ||
| talosctl = ["1.5.4", "1.3.6"] | ||
| flux2 = "2.2.3" | ||
| talosctl = ["1.6.7", "1.5.4", "1.3.6"] | ||
| talhelper = ["1.16.2"] | ||
| cilium-cli= ["0.15.14"] | ||
| 1password-cli = ["2.24.0"] | ||
| restic = ["0.16.4"] | ||
| k9s = ["0.32.4"] | ||
|
|
||
| soft-serve = ["0.7.4"] | ||
| #pulumi = ["3.95.0"] | ||
| python = ["3.11"] | ||
|
|
||
| [env] | ||
| KUBECTL_INTERACTIVE_DELETE = "true" | ||
| KUBECTL_COMMAND_HEADERS = "true" | ||
| #SSH_AUTH_SOCK = $(gpgconf --list-dirs agent-ssh-socket) | ||
| _.python.venv = { path = ".venv", create = true } # create the venv if it doesn't exist | ||
|
|
||
| [plugins] | ||
| talhelper = "https://github.com/bjw-s/asdf-talhelper.git" |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| --- | ||
| # Tasks related to multi-cluster or cluster-level management, e.g. bootstrap | ||
| version: "3" | ||
|
|
||
| includes: | ||
| flux: | ||
| internal: true | ||
| taskfile: ../flux | ||
|
|
||
| vars: | ||
| C: '{{.C | default "biohazard"}}' | ||
| # APPLY: '{{.APPLY | default "0"}}' | ||
|
|
||
| tasks: | ||
| 1p-vars-env-yq: | ||
| vars: | ||
| C: &c '{{ or .C (fail "Missing C environment variable for cluster!") }}' | ||
| OUT: &out '{{ .OUT | default "yaml" }}' | ||
| cmds: | ||
| - op item get --vault {{.C}} ".{{.C}}-vars" --format=json | yq --input-format json --output-format {{ .OUT | default "yaml" }} '.fields | with(.[]; (.label | key) = "key") | (.[] | select(has("value") | not) | .value) |= "" | from_entries' | ||
|
|
||
| 1p-vars-env-shell: | ||
| aliases: [1penv, openv] | ||
| vars: | ||
| C: *c | ||
| # OUT: *out | ||
| PRE_ARGS: '{{.PRE_ARGS}}' | ||
| POST_ARGS: '{{.POST_ARGS}}' | ||
| cmds: | ||
| - | | ||
| {{.PRE_ARGS}}op item get --vault {{.C}} ".{{.C}}-vars" --format=json | yq --input-format json '.fields | with(.[]; (.label | key) = "key") | (.[] | select(has("value") | not) | .value) |= "" | map(.key + "=" + (.value | @sh)) | .[]'{{.POST_ARGS}} {{.CLI_ARGS}} | ||
| 1p-vars-env-run: | ||
| dir: '{{.USER_WORKING_DIR}}' | ||
| vars: | ||
| C: &c '{{ or .C (fail "Missing C environment variable for cluster!") }}' | ||
| # OUT: *out | ||
| cmds: | ||
| - export $(task --taskfile /{{.ROOT_DIR}}/Taskfile.dist.yaml 1p-vars-env-shell C={{.C}}); {{.CLI_ARGS}} | ||
|
|
||
| k8s-1p-connect-load-credentials: | ||
| vars: | ||
| C: *c | ||
| cmds: | ||
| - kubectl get namespace external-secrets || kubectl create namespace external-secrets | ||
| - kubectl get namespace onepassword-connect || kubectl create namespace onepassword-connect | ||
| # - kubectl delete secret -n onepassword-connect onepassword-connect-secrets || true | ||
| - op read "op://{{.C}}/$(op item get --vault {{.C}} '{{.C}} Credentials File' --format=json | yq '.id')/1password-credentials.json" | kubectl create secret -n external-secrets generic onepassword-connect-secrets --from-file=1password-credentials.json=/dev/stdin | ||
| - op read "op://{{.C}}/$(op item get --vault {{.C}} '{{.C}} Credentials File' --format=json | yq '.id')/1password-credentials.json" | kubectl create secret -n onepassword-connect generic onepassword-connect-secrets --from-file=1password-credentials.json=/dev/stdin | ||
| # - kubectl rollout restart -n onepassword-connect deploy/onepassword-connect || true | ||
|
|
||
| bootstrap: | ||
| aliases: [bs] | ||
| desc: Bootstrap Kubernetes to a GitOps managed stage after OS install. | ||
| vars: | ||
| C: *c | ||
| cmds: | ||
| - | | ||
| kubectx || kubectl config current-context; read -p "BOOTSTRAP | ||
| Press ENTER to confirm the Kubernetes context to bootstrap, or Control+C to exit. | ||
| > "; read -p "RECONFIRM: Press ENTER again to really confirm. | ||
| > " | ||
| - task: flux:install | ||
| - task: k8s-1p-connect-load-credentials | ||
| vars: | ||
| C: *c | ||
| - task: 1p-vars-env-shell | ||
| vars: | ||
| C: *c | ||
| POST_ARGS: " | kubectl create secret generic -n flux-system sinon-vars --from-env-file=/dev/stdin" | ||
| - kubectl create secret generic -n flux-system sinon-secrets # currently nothing hopefully maybe? | ||
| - op read "op://{{.C}}/Flux/agekey" | kubectl create secret generic -n flux-system agekey --from-file=age.agekey=/dev/stdin |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.