Migrate k8s config from Terraform to Argo CD + ESO
Phase 1: Install External Secrets Operator via Argo CD app - apps/external-secrets.yaml — ESO Helm chart install - apps/external-secrets-config.yaml — ClusterSecretStore deployment - k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret Phase 2: Create k8s manifests for all services - k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress - k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress - k8s/github-runner/ — ExternalSecret (github-runner-secret) - k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret) - k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress - k8s/postgres/ — ExternalSecret (postgres-passwords) - k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault) - k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret - k8s/ollama/ — PVC, Ingress - k8s/headscale/ — PVC - k8s/packages/ — PVCs, ConfigMap, Ingresses - k8s/registry/ — PVC, Ingresses - k8s/backup/ — CronJob, ExternalSecret (backup-credentials) New Argo CD apps for Helm releases: - apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml - apps/postgres.yaml, redis.yaml, vault.yaml New Argo CD apps for k8s config paths: - apps/neuron-config, gitea-config, ci-config, gitea-runner-config - apps/monitoring-config, adguard-config, ollama-config, headscale-config - apps/packages-config, registry-config, postgres-config, vault-config, backup Phase 3: Strip Terraform to infrastructure-only - All kubernetes_* and helm_release resources removed from service .tf files - Each service .tf now contains only kubernetes_namespace (bootstrap dependency) - variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token - namespaces.tf gains external-secrets namespace - ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/) - cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
This commit is contained in:
Will Anderson
@@ -0,0 +1,15 @@
|
||||
---
|
||||
# TLS certificate for DoT (DNS-over-TLS) on dot.nook.family:853
|
||||
# Issued via cert-manager DNS-01 challenge (Cloudflare)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: adguard-dot-tls
|
||||
namespace: dns
|
||||
spec:
|
||||
secretName: adguard-dot-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- dot.nook.family
|
||||
@@ -0,0 +1,59 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: adguard-defaults
|
||||
namespace: dns
|
||||
data:
|
||||
AdGuardHome.yaml: |
|
||||
dns:
|
||||
bind_hosts:
|
||||
- 0.0.0.0
|
||||
port: 53
|
||||
upstream_dns:
|
||||
- https://dns.cloudflare.com/dns-query
|
||||
- https://dns.google/dns-query
|
||||
bootstrap_dns:
|
||||
- 1.1.1.1
|
||||
- 8.8.8.8
|
||||
- 9.9.9.10
|
||||
- 149.112.112.10
|
||||
upstream_mode: load_balance
|
||||
cache_enabled: true
|
||||
cache_size: 4194304
|
||||
filters:
|
||||
- enabled: true
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
|
||||
name: AdGuard DNS filter
|
||||
id: 1
|
||||
- enabled: true
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
|
||||
name: AdAway Default Blocklist
|
||||
id: 2
|
||||
- enabled: true
|
||||
url: https://big.oisd.nl/domainswild
|
||||
name: OISD Big
|
||||
id: 3
|
||||
- enabled: true
|
||||
url: https://easylist.to/easylist/easylist.txt
|
||||
name: EasyList
|
||||
id: 4
|
||||
- enabled: true
|
||||
url: https://easylist.to/easylist/easyprivacy.txt
|
||||
name: EasyPrivacy
|
||||
id: 5
|
||||
tls:
|
||||
enabled: true
|
||||
server_name: dot.nook.family
|
||||
port_dns_over_tls: 853
|
||||
certificate_path: /etc/adguard/tls/tls.crt
|
||||
private_key_path: /etc/adguard/tls/tls.key
|
||||
allow_unencrypted_doh: true
|
||||
filtering:
|
||||
filtering_enabled: true
|
||||
rewrites:
|
||||
- domain: '*.nook.family'
|
||||
answer: 192.168.68.77
|
||||
enabled: true
|
||||
- domain: '*.neuralplatform.ai'
|
||||
answer: 192.168.68.77
|
||||
enabled: true
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# ddclient — dynamic DNS daemon keeping dot.nook.family pointed at home public IP
|
||||
# Updates Cloudflare A record every 5 minutes (required for DoT port 853, no CF proxy)
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ddclient
|
||||
namespace: dns
|
||||
labels:
|
||||
app: ddclient
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ddclient
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ddclient
|
||||
spec:
|
||||
containers:
|
||||
- name: ddclient
|
||||
image: ghcr.io/ddclient/ddclient:latest
|
||||
command: ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/ddclient/ddclient.conf
|
||||
subPath: ddclient.conf
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
volumes:
|
||||
- name: config
|
||||
secret:
|
||||
secretName: ddclient-config
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# ddclient-config — Cloudflare credentials for dynamic DNS updates
|
||||
# cloudflare_api_key and cloudflare_email stored in Vault at secret/cloudflare
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: ddclient-config
|
||||
namespace: dns
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: ddclient-config
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
data:
|
||||
ddclient.conf: |
|
||||
daemon=300
|
||||
syslog=yes
|
||||
pid=/var/run/ddclient/ddclient.pid
|
||||
use=web, web=https://api.ipify.org
|
||||
|
||||
protocol=cloudflare
|
||||
zone=nook.family
|
||||
ttl=120
|
||||
login={{ .cloudflare_email }}
|
||||
password={{ .cloudflare_api_key }}
|
||||
dot.nook.family
|
||||
data:
|
||||
- secretKey: cloudflare_api_key
|
||||
remoteRef:
|
||||
key: secret/data/cloudflare
|
||||
property: api_key
|
||||
- secretKey: cloudflare_email
|
||||
remoteRef:
|
||||
key: secret/data/cloudflare
|
||||
property: email
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: adguard
|
||||
namespace: dns
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- dns.nook.family
|
||||
secretName: adguard-tls
|
||||
rules:
|
||||
- host: dns.nook.family
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: adguard-ui
|
||||
port:
|
||||
number: 3000
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: adguard-config
|
||||
namespace: dns
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: adguard-data
|
||||
namespace: dns
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
Reference in New Issue
Block a user