Skip to content

Commit 6d42e45

Browse files
brettinternetbrettinternet
committed
update repo from new cluster-template
1 parent bf62322 commit 6d42e45

File tree

290 files changed

+1769
-5289
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

290 files changed

+1769
-5289
lines changed

‎.editorconfig

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# editorconfig.org
2+
root = true
3+
4+
[*]
5+
indent_style = space
6+
indent_size = 2
7+
end_of_line = lf
8+
charset = utf-8
9+
trim_trailing_whitespace = true
10+
insert_final_newline = true
11+
12+
[*.py]
13+
indent_style = space
14+
indent_size = 4

‎.gitattributes

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1-
*.sops.yaml diff=sopsdiffer
2-
*.sops.toml linguist-language=JSON
1+
* text=auto eol=lf
2+
*.yaml.j2 linguist-language=YAML
3+
*.sops.* diff=sopsdiffer

‎.github/workflows/flux-diff.yaml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: "Flux Diff"
4+
5+
on:
6+
pull_request:
7+
branches: ["main"]
8+
paths: ["kubernetes/**"]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
flux-diff:
16+
name: Flux Diff
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
pull-requests: write
21+
strategy:
22+
matrix:
23+
paths: ["kubernetes"]
24+
resources: ["helmrelease", "kustomization"]
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v4
28+
with:
29+
path: pull
30+
31+
- name: Checkout Default Branch
32+
uses: actions/checkout@v4
33+
with:
34+
ref: "${{ github.event.repository.default_branch }}"
35+
path: default
36+
37+
- name: Diff Resources
38+
uses: docker://ghcr.io/allenporter/flux-local:main
39+
with:
40+
args: >-
41+
diff ${{ matrix.resources }}
42+
--unified 6
43+
--path /github/workspace/pull/${{ matrix.paths }}/flux
44+
--path-orig /github/workspace/default/${{ matrix.paths }}/flux
45+
--strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
46+
--limit-bytes 10000
47+
--all-namespaces
48+
--sources "home-kubernetes"
49+
--output-file diff.patch
50+
51+
- name: Generate Diff
52+
id: diff
53+
run: |
54+
cat diff.patch
55+
echo "diff<<EOF" >> $GITHUB_OUTPUT
56+
cat diff.patch >> $GITHUB_OUTPUT
57+
echo "EOF" >> $GITHUB_OUTPUT
58+
59+
- if: ${{ steps.diff.outputs.diff != '' }}
60+
name: Add comment
61+
uses: mshick/add-pr-comment@v2
62+
with:
63+
message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
64+
message-failure: Diff was not successful
65+
message: |
66+
```diff
67+
${{ steps.diff.outputs.diff }}
68+
```

‎.github/workflows/gitleaks.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
13
name: gitleaks
24

35
on: # yamllint disable-line rule:truthy

‎.github/workflows/kubeconform.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: "Kubeconform"
4+
5+
on:
6+
pull_request:
7+
branches: ["main"]
8+
paths: ["kubernetes/**"]
9+
10+
env:
11+
KUBERNETES_DIR: ./kubernetes
12+
13+
jobs:
14+
kubeconform:
15+
name: Kubeconform
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
21+
- name: Setup Homebrew
22+
uses: Homebrew/actions/setup-homebrew@master
23+
24+
- name: Setup Workflow Tools
25+
run: brew install fluxcd/tap/flux kubeconform kustomize
26+
27+
- name: Run kubeconform
28+
shell: bash
29+
run: bash ./scripts/kubeconform.sh ${{ env.KUBERNETES_DIR }}

‎.github/workflows/lint.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
23
name: Lint
34

45
on: # yamllint disable-line rule:truthy

‎.gitignore

-2
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ talosconfig
1010
*.agekey
1111
*.pub
1212
*.key
13-
# Ansible
14-
xanmanning.k3s*
1513
# Taskfile
1614
.task
1715
Brewfile.lock.json

‎.taskfiles/Brewfile

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
brew "age"
2+
brew "cloudflared"
3+
brew "direnv"
4+
brew "fluxcd/tap/flux"
5+
brew "go-task"
6+
brew "kubescape"
7+
brew "helm"
8+
brew "helmfile"
9+
brew "jq"
10+
brew "kubeconform"
11+
brew "kubernetes-cli"
12+
brew "kustomize"
13+
brew "pre-commit"
14+
brew "prettier"
15+
brew "sops"
16+
brew "talhelper"
17+
brew "siderolabs/tap/talosctl"
18+
brew "yamllint"

‎.taskfiles/flux.yaml

+23-22
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33
version: "3"
44

55
vars:
6-
# renovate: datasource=github-releases depName=prometheus-operator/prometheus-operator
7-
PROMETHEUS_OPERATOR_VERSION: v0.73.2
86
CLUSTER_SECRET_SOPS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml"
97
CLUSTER_SETTINGS_FILE: "{{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml"
108
GITHUB_DEPLOY_KEY_FILE: "{{.KUBERNETES_DIR}}/bootstrap/flux/github-deploy-key.sops.yaml"
@@ -14,22 +12,19 @@ tasks:
1412
desc: Verify flux meets the prerequisites
1513
cmd: flux check --pre
1614

17-
install:
15+
bootstrap:
1816
desc: Bootstrap Flux into a Kubernetes cluster
1917
cmds:
20-
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml
21-
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml
22-
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_scrapeconfigs.yaml
23-
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/{{.PROMETHEUS_OPERATOR_VERSION}}/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
2418
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --kustomize {{.KUBERNETES_DIR}}/bootstrap/flux
2519
- cat {{.AGE_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin
2620
- sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
2721
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename {{.CLUSTER_SETTINGS_FILE}}
2822
- kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --kustomize {{.KUBERNETES_DIR}}/flux/config
29-
- task: github-deploy-key
3023
preconditions:
31-
- { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" }
32-
- { msg: "Missing Sops Age key file", sh: "test -f {{.AGE_FILE}}" }
24+
- msg: Missing kubeconfig
25+
sh: test -f {{.KUBECONFIG_FILE}}
26+
- msg: Missing Sops Age key file
27+
sh: test -f {{.AGE_FILE}}
3328

3429
apply:
3530
desc: Apply a Flux Kustomization resource for a cluster
@@ -53,14 +48,29 @@ tasks:
5348
ks:
5449
sh: flux --kubeconfig {{.KUBECONFIG_FILE}} --namespace {{.ns}} get kustomizations $(basename {{.path}}) 2>&1
5550
preconditions:
56-
- { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" }
57-
- { msg: "Missing Flux Kustomization for app {{.path}}", sh: "test -f {{.KUBERNETES_DIR}}/apps/{{.path}}/ks.yaml" }
51+
- msg: Missing kubeconfig
52+
sh: test -f {{.KUBECONFIG_FILE}}
53+
- msg: Missing Flux Kustomization for app {{.path}}
54+
sh: test -f {{.KUBERNETES_DIR}}/apps/{{.path}}/ks.yaml
5855

5956
reconcile:
6057
desc: Force update Flux to pull in changes from your Git repository
6158
cmd: flux --kubeconfig {{.KUBECONFIG_FILE}} reconcile --namespace flux-system kustomization cluster --with-source
6259
preconditions:
63-
- { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" }
60+
- msg: Missing kubeconfig
61+
sh: test -f {{.KUBECONFIG_FILE}}
62+
63+
github-deploy-key:
64+
cmds:
65+
- kubectl create namespace flux-system --dry-run=client -o yaml | kubectl --kubeconfig {{.KUBECONFIG_FILE}} apply --filename -
66+
- sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
67+
preconditions:
68+
- msg: Missing kubeconfig
69+
sh: test -f {{.KUBECONFIG_FILE}}
70+
- msg: Missing Sops Age key file
71+
sh: test -f {{.AGE_FILE}}
72+
- msg: Missing Github deploy key file
73+
sh: test -f {{.GITHUB_DEPLOY_KEY_FILE}}
6474

6575
redo:
6676
desc: Force reset drift in HelmRelease
@@ -75,15 +85,6 @@ tasks:
7585
- kubectl get hr --all-namespaces | grep False | awk '{print $2, $1}' | gxargs -l bash -c 'flux suspend hr $0 -n $1'
7686
- kubectl get hr --all-namespaces | grep False | awk '{print $2, $1}' | gxargs -l bash -c 'flux resume hr $0 -n $1'
7787

78-
github-deploy-key:
79-
cmds:
80-
- kubectl create namespace flux-system --dry-run=client -o yaml | kubectl --kubeconfig {{.KUBECONFIG_FILE}} apply --filename -
81-
- sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --kubeconfig {{.KUBECONFIG_FILE}} --server-side --filename -
82-
preconditions:
83-
- { msg: "Missing kubeconfig", sh: "test -f {{.KUBECONFIG_FILE}}" }
84-
- { msg: "Missing Sops Age key file", sh: "test -f {{.AGE_FILE}}" }
85-
- { msg: "Missing Github deploy key file", sh: "test -f {{.GITHUB_DEPLOY_KEY_FILE}}" }
86-
8788
delete-tunnel:
8889
desc: |
8990
Force delete cloudflared tunnel release to stop external ingress

‎.taskfiles/kubernetes.yaml

+9-18
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,11 @@
11
---
2+
# yaml-language-server: $schema=https://taskfile.dev/schema.json
23
version: "3"
34

45
vars:
56
KUBECONFORM_SCRIPT: "{{.SCRIPTS_DIR}}/kubeconform.sh"
67

78
tasks:
8-
kubeconfig:
9-
desc: Remotely fetch kubeconfig from Kubernetes
10-
cmds:
11-
- rsync --verbose --progress --partial --rsync-path="sudo rsync" {{.K3S_PRIMARY_CONTROLLER_NODE_USERNAME}}@{{.K3S_PRIMARY_CONTROLLER_NODE_ADDR}}:/etc/rancher/k3s/k3s.yaml "{{.KUBERNETES_DIR}}/kubeconfig"
12-
- sed -i '' 's/127.0.0.1/{{.K3S_LB_ADDR}}/g' "{{.KUBERNETES_DIR}}/kubeconfig"
13-
- chmod go-r "{{.KUBERNETES_DIR}}/kubeconfig"
14-
vars:
15-
K3S_PRIMARY_CONTROLLER_NODE_USERNAME: "brett"
16-
K3S_PRIMARY_CONTROLLER_NODE_ADDR: "10.1.2.30"
17-
K3S_LB_ADDR: "10.1.2.200"
18-
19-
top:
20-
desc: List top metrics
21-
cmds:
22-
- kubectl top node
23-
- kubectl top pod -A
24-
259
resources:
2610
desc: Gather common resources in your cluster, useful when asking for support
2711
cmds:
@@ -43,4 +27,11 @@ tasks:
4327
desc: Validate Kubernetes manifests with kubeconform
4428
cmd: bash {{.KUBECONFORM_SCRIPT}} {{.KUBERNETES_DIR}}
4529
preconditions:
46-
- { msg: "Missing kubeconform script", sh: "test -f {{.KUBECONFORM_SCRIPT}}" }
30+
- msg: Missing kubeconform script
31+
sh: test -f {{.KUBECONFORM_SCRIPT}}
32+
33+
top:
34+
desc: List top metrics
35+
cmds:
36+
- kubectl top node
37+
- kubectl top pod -A

‎.taskfiles/lint.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
# yaml-language-server: $schema=https://taskfile.dev/schema.json
23
version: "3"
34

45
vars:

‎.taskfiles/precommit.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
# yaml-language-server: $schema=https://taskfile.dev/schema.json
23
version: "3"
34

45
tasks:

‎.taskfiles/setup_darwin.yaml

+14-39
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,24 @@
11
---
2+
# yaml-language-server: $schema=https://taskfile.dev/schema.json
23
version: "3"
34

45
vars:
5-
PYTHON_BIN: python3
6+
BREWFILE: "{{.ROOT_DIR}}/.taskfiles/Brewfile"
67

78
tasks:
89
init:
910
desc: Darwin setup
1011
cmds:
12+
- task: direnv
1113
- task: brew
1214
- task: python
1315

1416
brew:
15-
desc: Install homebrew dependencies
16-
cmds:
17-
- brew install -q {{.DEPS}} {{.CLI_ARGS}}
17+
desc: Install workstation dependencies with Brew
18+
cmd: brew bundle --file {{.BREWFILE}}
1819
preconditions:
19-
- sh: command -v brew
20-
msg: Homebrew is not installed
21-
vars:
22-
DEPS: >-
23-
age
24-
ansible
25-
cloudflared
26-
direnv
27-
fluxcd/tap/flux
28-
go-task
29-
kubescape
30-
helm
31-
helmfile
32-
jq
33-
kubeconform
34-
kubernetes-cli
35-
kustomize
36-
pre-commit
37-
prettier
38-
sops
39-
yamllint
40-
41-
# age: SOP dependency
42-
# ansible: homelab provisioning
43-
# cloudflare/cloudflare/cloudflared: Cloudflared tunnel credentials
44-
# fluxcd/tap/flux: cluster reconciliation
45-
# go-task/tap/go-task: Task runner
46-
# kubescape https://github.com/kubescape/kubescape
47-
# helm: Deployment charts
48-
# kubernetes-cli
49-
# kustomize: Define k8s manifests
50-
# pre-commit: Repo helper
51-
# prettier: Repo helper
52-
# sops: Secrets encryption
53-
# yamllint: Yaml linting
20+
- { msg: "Missing Homebrew", sh: "command -v brew" }
21+
- { msg: "Missing Brewfile", sh: "test -f {{.BREWFILE}}" }
5422

5523
python:
5624
desc: Set up virtual environment
@@ -65,3 +33,10 @@ tasks:
6533
preconditions:
6634
- msg: "Missing Pip requirements file"
6735
sh: "test -f {{.PIP_REQUIREMENTS_FILE}}"
36+
37+
direnv:
38+
desc: Run direnv hooks
39+
cmd: direnv allow .
40+
status:
41+
- "[[ $(direnv status --json | jq '.state.foundRC.allowed') == 0 ]]"
42+
- "[[ $(direnv status --json | jq '.state.loadedRC.allowed') == 0 ]]"

‎.taskfiles/sops.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
---
2+
# yaml-language-server: $schema=https://taskfile.dev/schema.json
23
version: "3"
34

45
tasks:

0 commit comments

Comments
 (0)