feat: better?
This commit is contained in:
parent
c47b3c222a
commit
dd21e589d6
SSH key fingerprint:
SHA256:MNtTsLbihYaWF8j1fkOHfkKNlnN1JQfxEU/rBU8nCGw
4 changed files with 86 additions and 97 deletions
|
|
@ -4,7 +4,7 @@ clusters:
|
||||||
- name: tjo-cloud
|
- name: tjo-cloud
|
||||||
cluster:
|
cluster:
|
||||||
server: https://api.k8s.tjo.cloud:6443
|
server: https://api.k8s.tjo.cloud:6443
|
||||||
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQU5MekZhUjV4SENpZHFZQjB5K0Z2ZVF3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOREEzTWpBeE56STNNRFZhRncwek5EQTNNVGd4TnpJMwpNRFZhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVN3T2xEMnBYeXRyQjdFUkFNZFQ5VVkwaDZNN1BtU1k1SjVBa2F4bk8vYm1FOW84bjNMTU9JbVZFaFYKdEdScFhvNTl6MHQ5dnJJRkd3VGNLeGlpaG5STW8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGRHg1bDd1aDdtNUlvNWc5b285NUwvOGpVVXZJTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUhOblhLV2cKcUZPbkQvbXVyU0Y4S3BlNHJyN3FkSzFLWGQ2dm03aXN2ZThOQWlFQW5TTHM3dy9ySUFQM09GWTJmTnJsbFd2cgpJZlRpRG1IV3AzWVU5UDFVM2ljPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVMrZ0F3SUJBZ0lRZXNQaHZSS20xbHlhdTU2RndIbDZMekFLQmdncWhrak9QUVFEQWpBVk1STXcKRVFZRFZRUUtFd3ByZFdKbGNtNWxkR1Z6TUI0WERUSTBNRGN5TWpJd01UVXhOMW9YRFRNME1EY3lNREl3TVRVeApOMW93RlRFVE1CRUdBMVVFQ2hNS2EzVmlaWEp1WlhSbGN6QlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VICkEwSUFCTnVNUnl0K1lQUncxN094TFNRUDlJdngzZVk1am1pS1FSL2tEeTFENFI2ZVI4WUpqTlVDOXZGNmxzZFcKaWV3M09wekZybFl4eHl3Ym9vZVdDN3R1dlkyallUQmZNQTRHQTFVZER3RUIvd1FFQXdJQ2hEQWRCZ05WSFNVRQpGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFCkZnUVU2TUhBdEhTZEJuUTZBbTRjeFVMOVc3b1Y2UFl3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUpobVdzRXgKVjVnRW5na25uMURndjBBaVNjZTBHVUtrZWdBNStDK1VyOXlWQWlFQTVzQituQmFGVUl3R2JsYkcrSWEvOXFsZApFZEh0dXNkbDRRaHVmT0R5K1d3PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
contexts:
|
contexts:
|
||||||
- name: oidc@tjo-cloud
|
- name: oidc@tjo-cloud
|
||||||
context:
|
context:
|
||||||
|
|
|
||||||
|
|
@ -9,72 +9,67 @@ data "helm_template" "cilium" {
|
||||||
|
|
||||||
kube_version = var.talos.kubernetes
|
kube_version = var.talos.kubernetes
|
||||||
|
|
||||||
values = [yamlencode({
|
values = [<<-EOF
|
||||||
ipam : {
|
ipam:
|
||||||
mode : "kubernetes"
|
mode: "kubernetes"
|
||||||
},
|
|
||||||
nodeIPAM : {
|
#routingMode: native
|
||||||
enabled : true
|
#ipv4NativeRoutingCIDR: pod and service cidrs?
|
||||||
},
|
enableIPv4Masquerade: true
|
||||||
kubeProxyReplacement : "true"
|
ipv4:
|
||||||
securityContext : {
|
enabled: true
|
||||||
capabilities : {
|
|
||||||
ciliumAgent : [
|
#enableIPv6Masquerade: true
|
||||||
"CHOWN",
|
ipv6:
|
||||||
"KILL",
|
enabled: false
|
||||||
"NET_ADMIN",
|
|
||||||
"NET_RAW",
|
nodeIPAM:
|
||||||
"IPC_LOCK",
|
enabled: true
|
||||||
"SYS_ADMIN",
|
|
||||||
"SYS_RESOURCE",
|
|
||||||
"DAC_OVERRIDE",
|
kubeProxyReplacement: "true"
|
||||||
"FOWNER",
|
securityContext:
|
||||||
"SETGID",
|
capabilities:
|
||||||
"SETUID"
|
ciliumAgent:
|
||||||
],
|
- "CHOWN"
|
||||||
cleanCiliumState : [
|
- "KILL"
|
||||||
"NET_ADMIN",
|
- "NET_ADMIN"
|
||||||
"SYS_ADMIN",
|
- "NET_RAW"
|
||||||
"SYS_RESOURCE"
|
- "IPC_LOCK"
|
||||||
]
|
- "SYS_ADMIN"
|
||||||
}
|
- "SYS_RESOURCE"
|
||||||
},
|
- "DAC_OVERRIDE"
|
||||||
cgroup : {
|
- "FOWNER"
|
||||||
autoMount : {
|
- "SETGID"
|
||||||
enabled : false
|
- "SETUID"
|
||||||
},
|
cleanCiliumState:
|
||||||
hostRoot : "/sys/fs/cgroup"
|
- "NET_ADMIN"
|
||||||
},
|
- "SYS_ADMIN"
|
||||||
k8sServiceHost : local.cluster_api_domain
|
- "SYS_RESOURCE"
|
||||||
k8sServicePort : var.cluster.api.port
|
cgroup:
|
||||||
ipv4 : {
|
hostRoot: "/sys/fs/cgroup"
|
||||||
enabled : true
|
autoMount:
|
||||||
},
|
enabled: false
|
||||||
#ipv6 : {
|
|
||||||
# enabled : true
|
k8sServiceHost: ${local.cluster_api_domain}
|
||||||
#},
|
k8sServicePort: ${var.cluster.api.port}
|
||||||
hubble : {
|
|
||||||
tls : {
|
hubble:
|
||||||
auto : {
|
ui:
|
||||||
enabled : true
|
enabled: true
|
||||||
method : "cronJob"
|
relay:
|
||||||
schedule : "0 0 1 */4 *"
|
enabled: true
|
||||||
}
|
tls:
|
||||||
}
|
auto:
|
||||||
ui : {
|
enabled: true
|
||||||
enabled : true
|
method: "cronJob"
|
||||||
}
|
schedule: "0 0 1 */4 *"
|
||||||
relay : {
|
gatewayAPI:
|
||||||
enabled : true
|
enabled: false
|
||||||
}
|
envoy:
|
||||||
},
|
enabled: false
|
||||||
gatewayAPI : {
|
EOF
|
||||||
enabled : false
|
]
|
||||||
}
|
|
||||||
envoy : {
|
|
||||||
enabled : false
|
|
||||||
}
|
|
||||||
})]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
data "helm_template" "proxmox-csi" {
|
data "helm_template" "proxmox-csi" {
|
||||||
|
|
@ -173,15 +168,14 @@ data "helm_template" "cert-manager" {
|
||||||
|
|
||||||
include_crds = true
|
include_crds = true
|
||||||
|
|
||||||
set {
|
values = [<<-EOF
|
||||||
name = "crds.enabled"
|
crds:
|
||||||
value = true
|
enabled: true
|
||||||
}
|
|
||||||
|
|
||||||
set_list {
|
extraArgs:
|
||||||
name = "extraArgs"
|
- --enable-gateway-api
|
||||||
value = ["--enable-gateway-api"]
|
EOF
|
||||||
}
|
]
|
||||||
}
|
}
|
||||||
|
|
||||||
data "helm_template" "envoy" {
|
data "helm_template" "envoy" {
|
||||||
|
|
|
||||||
|
|
@ -4,11 +4,11 @@ locals {
|
||||||
|
|
||||||
podSubnets = [
|
podSubnets = [
|
||||||
"10.200.0.0/16",
|
"10.200.0.0/16",
|
||||||
#"fd9b:5314:fc70::/48",
|
#"fd9b:5314:fc70::/64",
|
||||||
]
|
]
|
||||||
serviceSubnets = [
|
serviceSubnets = [
|
||||||
"10.201.0.0/16",
|
"10.201.0.0/16",
|
||||||
#"fd9b:5314:fc71::/48",
|
#"fd9b:5314:fc71::/108",
|
||||||
]
|
]
|
||||||
|
|
||||||
# Nodes will use IPs from this subnets
|
# Nodes will use IPs from this subnets
|
||||||
|
|
@ -75,14 +75,14 @@ locals {
|
||||||
name : "cilium"
|
name : "cilium"
|
||||||
contents : data.helm_template.cilium.manifest
|
contents : data.helm_template.cilium.manifest
|
||||||
},
|
},
|
||||||
{
|
#{
|
||||||
name : "envoy"
|
# name : "envoy"
|
||||||
contents : data.helm_template.envoy.manifest
|
# contents : data.helm_template.envoy.manifest
|
||||||
},
|
#},
|
||||||
{
|
#{
|
||||||
name : "cert-manager"
|
# name : "cert-manager"
|
||||||
contents : data.helm_template.cert-manager.manifest
|
# contents : data.helm_template.cert-manager.manifest
|
||||||
},
|
#},
|
||||||
{
|
{
|
||||||
name : "oidc-admins"
|
name : "oidc-admins"
|
||||||
contents : <<-EOF
|
contents : <<-EOF
|
||||||
|
|
@ -149,17 +149,10 @@ locals {
|
||||||
hostname = node.name
|
hostname = node.name
|
||||||
}
|
}
|
||||||
nodeLabels = {
|
nodeLabels = {
|
||||||
"k8s.tjo.cloud/public" = node.public ? "true" : "false"
|
"k8s.tjo.cloud/public" = node.public ? "true" : "false"
|
||||||
#"k8s.tjo.cloud/ipv4" = node.ipv4
|
|
||||||
#"k8s.tjo.cloud/ipv6" = node.ipv6
|
|
||||||
"k8s.tjo.cloud/host" = node.host
|
"k8s.tjo.cloud/host" = node.host
|
||||||
"k8s.tjo.cloud/proxmox" = var.proxmox.name
|
"k8s.tjo.cloud/proxmox" = var.proxmox.name
|
||||||
}
|
}
|
||||||
kubelet = {
|
|
||||||
extraConfig = {
|
|
||||||
podCIDR = ""
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}),
|
}),
|
||||||
yamlencode(
|
yamlencode(
|
||||||
|
|
@ -170,6 +163,8 @@ locals {
|
||||||
environment : [
|
environment : [
|
||||||
"TS_AUTHKEY=${var.tailscale_authkey}",
|
"TS_AUTHKEY=${var.tailscale_authkey}",
|
||||||
"TS_HOSTNAME=${node.name}",
|
"TS_HOSTNAME=${node.name}",
|
||||||
|
# IPV6: https://github.com/siderolabs/extensions/issues/432
|
||||||
|
"TS_ROUTES=${local.podSubnets[0]},${local.serviceSubnets[0]}"
|
||||||
]
|
]
|
||||||
})
|
})
|
||||||
]
|
]
|
||||||
|
|
|
||||||
|
|
@ -126,10 +126,10 @@ resource "proxmox_virtual_environment_vm" "nodes" {
|
||||||
iothread = true
|
iothread = true
|
||||||
}
|
}
|
||||||
|
|
||||||
#initialization {
|
initialization {
|
||||||
# datastore_id = each.value.storage
|
datastore_id = each.value.storage
|
||||||
# meta_data_file_id = proxmox_virtual_environment_file.metadata[each.key].id
|
meta_data_file_id = proxmox_virtual_environment_file.metadata[each.key].id
|
||||||
#}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "proxmox_virtual_environment_role" "csi" {
|
resource "proxmox_virtual_environment_role" "csi" {
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue