Erste Implementierung
This commit was merged in pull request #1.
This commit is contained in:
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: fluxcd-edit
|
||||||
|
labels:
|
||||||
|
# Add these permissions to "edit" default role.
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["helm.toolkit.fluxcd.io","kustomize.toolkit.fluxcd.io","notification.toolkit.fluxcd.io","source.toolkit.fluxcd.io"]
|
||||||
|
resources: ["*"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- fluxcd-user.yaml
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: kustomization
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
decryption:
|
||||||
|
provider: sops
|
||||||
|
interval: 5m0s
|
||||||
|
path: ./flux/clusters/eks-cluster-name
|
||||||
|
prune: true
|
||||||
|
serviceAccountName: deploy
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: source
|
||||||
|
validation: client
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: LimitRange
|
||||||
|
metadata:
|
||||||
|
name: default-memory-limit
|
||||||
|
spec:
|
||||||
|
limits:
|
||||||
|
- default:
|
||||||
|
memory: 256Mi
|
||||||
|
defaultRequest:
|
||||||
|
memory: 256Mi
|
||||||
|
type: Container
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1beta1
|
||||||
|
kind: GitRepository
|
||||||
|
metadata:
|
||||||
|
name: source
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
interval: 1m0s
|
||||||
|
ref:
|
||||||
|
branch: main
|
||||||
|
url: ssh://git@github.com/sueddeutsche/demo-flux-echoserver.git
|
||||||
|
secretRef:
|
||||||
|
name: GITHUB-SSH-TOKEN
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: deploy-rolebinding
|
||||||
|
namespace: default
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: edit
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: deploy
|
||||||
|
namespace: default
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: deploy
|
||||||
|
namespace: default
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- default-kustomization.yaml
|
||||||
|
- default-memory-limit.yaml
|
||||||
|
- default-source.yaml
|
||||||
|
- deploy-serviceaccount.yaml
|
||||||
|
- deploy-rolebinding.yaml
|
||||||
|
- namespace.yaml
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
export KUBECONFIG=$(cd ../../../kubeconfigs; pwd -P)/k3d-develop.yaml
|
||||||
|
export SOPS_AGE_KEY_FILE=$(pwd)/../../../local-k8s/keys/age.agekey
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,31 @@
|
|||||||
|
---
|
||||||
|
apiVersion: source.toolkit.fluxcd.io/v1beta1
|
||||||
|
kind: GitRepository
|
||||||
|
metadata:
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 1m0s
|
||||||
|
ref:
|
||||||
|
branch: main
|
||||||
|
secretRef:
|
||||||
|
name: local-git-secret
|
||||||
|
timeout: 20s
|
||||||
|
url: ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/flux.git
|
||||||
|
---
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: flux-system
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
decryption:
|
||||||
|
provider: sops
|
||||||
|
secretRef:
|
||||||
|
name: age-key-secret
|
||||||
|
interval: 1m0s
|
||||||
|
path: ./flux/clusters/k3d-develop
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: flux-system
|
||||||
+15
@@ -0,0 +1,15 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
export WORKDIR=$(dirname $0)
|
||||||
|
|
||||||
|
cd $WORKDIR
|
||||||
|
|
||||||
|
kubectl apply -n flux-system -f flux-components.yaml
|
||||||
|
sops exec-file local-git-secret.yaml "kubectl apply -n flux-system -f {}"
|
||||||
|
|
||||||
|
kubectl create secret -n flux-system generic age-key-secret --from-file age.agekey=../../../../local-k8s/keys/age.agekey --dry-run=client -o yaml | kubectl apply -f-
|
||||||
|
|
||||||
|
kubectl apply -n flux-system -f flux-sync.yaml
|
||||||
|
|
||||||
|
flux reconcile source git -n flux-system flux-system
|
||||||
|
|
||||||
|
cd -
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
|
||||||
|
resources:
|
||||||
|
# we need dedicated 'flux-components.yaml' in each cluster - otherwise a flux-system update in one cluster
|
||||||
|
# would be populated to all clusters
|
||||||
|
- flux-components.yaml
|
||||||
|
- flux-sync.yaml
|
||||||
|
- local-git-secret.yaml
|
||||||
|
- ../../../base/clusterroles
|
||||||
|
|
||||||
|
namespace: flux-system
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
clusters:
|
||||||
|
- cluster:
|
||||||
|
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUyTkRVeE16VTFOREV3SGhjTk1qSXdNakUzTWpJd05UUXhXaGNOTXpJd01qRTFNakl3TlRReApXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUyTkRVeE16VTFOREV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUdldzbjlFU0VtUC9IU1daamp0UXA3R25GWDlqMVNCMHBhZkx0dHBZSG0KTjhZbEpIU1ViMGJicmZqUzd0am5HWTF4RHV1aVlMQm9keDZtY1ZHM0pqZWlvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVW9XdmJEVTcrUjF1UlVqWW1EOWU1Cis4cllPOVV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnQ3paelVBRGFjSVFnVmZFV2Ywc3Foc29xc25sRzE4bVEKRGxGSS85VThVOXdDSVFEMnFGVk1mQUdWeEZQVEdNaFZEYzJtVjExbHJqMFQ2SStKVCtETnVmelVlQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||||
|
server: https://0.0.0.0:57999
|
||||||
|
name: k3d-develop
|
||||||
|
contexts:
|
||||||
|
- context:
|
||||||
|
cluster: k3d-develop
|
||||||
|
user: admin@k3d-develop
|
||||||
|
name: k3d-develop
|
||||||
|
current-context: k3d-develop
|
||||||
|
kind: Config
|
||||||
|
preferences: {}
|
||||||
|
users:
|
||||||
|
- name: admin@k3d-develop
|
||||||
|
user:
|
||||||
|
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRlZ0F3SUJBZ0lJQjlDWkxvMGhGRWN3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOalExTVRNMU5UUXhNQjRYRFRJeU1ESXhOekl5TURVME1Wb1hEVEl6TURJeApOekl5TURVME1Wb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGbEpvaDUyalR3SzlnbGsKeW0zdldOdHpnU0lGem1IaFRuYmxycWFmaTh0dWYySzVkSnpSYnRmNTJXU1h4am00VlBIeVBDUEFIZjF5U3NmcwpXcWRmMGZ1alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCU0JmQnpJNVRxWWYrUTRuS0xoN2dCMEVoZkl4VEFLQmdncWhrak9QUVFEQWdOSkFEQkcKQWlFQXNjeVIvVTlCSHBWOU0zRFRoR3RSZlcxSjBFSHZ1K09Td1VYYnpvSVNKQ0lDSVFDU0RXZ0c2Mjc4WlFmVgpvbVZWc25lU2hSbERQa3dtRFo4RXhoSmJaVUhNSlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSMmdBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwClpXNTBMV05oUURFMk5EVXhNelUxTkRFd0hoY05Nakl3TWpFM01qSXdOVFF4V2hjTk16SXdNakUxTWpJd05UUXgKV2pBak1TRXdId1lEVlFRRERCaHJNM010WTJ4cFpXNTBMV05oUURFMk5EVXhNelUxTkRFd1dUQVRCZ2NxaGtqTwpQUUlCQmdncWhrak9QUU1CQndOQ0FBUVY3dm54Y09YVGNTbTA5UW5NOWpuTmNuRkFWdk4rb25xOWkyMFF4UFdhCndHSkhKSmJickVrYTRvKzVERmFUbXhydGgxeE1Ob08wK0FMWHlKclg1WDM2bzBJd1FEQU9CZ05WSFE4QkFmOEUKQkFNQ0FxUXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVnWHdjeU9VNm1IL2tPSnlpNGU0QQpkQklYeU1Vd0NnWUlLb1pJemowRUF3SURTUUF3UmdJaEFOc2pDWWVrYURzWSs1QmpDZ08rUUVCa21GRWJIY1RGCkdScHAxcitSaWl0RUFpRUFyZnp0alM4MU9RWC8rZHhDcGVYaFkzUk5POHlSRmVaa2NETUZxdEVhWmMwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||||
|
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9lV1hSZmlucVFuNVFGUHk1ajEvYTlZMVhIWnpOaDgvZUdsZEh4VDBkQTJvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFV1VtaUhuYU5QQXIyQ1dUS2JlOVkyM09CSWdYT1llRk9kdVd1cHArTHkyNS9Zcmwwbk5GdQoxL25aWkpmR09iaFU4Zkk4SThBZC9YSkt4K3hhcDEvUit3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
apiVersion: k3d.io/v1alpha3
|
||||||
|
kind: Simple
|
||||||
|
name: develop
|
||||||
|
ports:
|
||||||
|
- port: 8080:80
|
||||||
|
nodeFilters:
|
||||||
|
- loadbalancer
|
||||||
|
- port: 2222:2222
|
||||||
|
nodeFilters:
|
||||||
|
- loadbalancer
|
||||||
|
options:
|
||||||
|
k3s:
|
||||||
|
extraArgs:
|
||||||
|
- arg: --no-deploy=traefik
|
||||||
|
nodeFilters:
|
||||||
|
- server:*
|
||||||
+14
@@ -0,0 +1,14 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
GITREPOS=("flux")
|
||||||
|
|
||||||
|
apk update
|
||||||
|
apk add git
|
||||||
|
rm /etc/motd
|
||||||
|
mkdir -p /srv/git
|
||||||
|
for repo in ${GITREPOS[@]}; do
|
||||||
|
mkdir -p /srv/git/${repo}.git
|
||||||
|
cd /srv/git/${repo}.git
|
||||||
|
git init --bare
|
||||||
|
done
|
||||||
|
chown -R git:git /srv/git
|
||||||
@@ -0,0 +1,42 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: local-git
|
||||||
|
name: local-git
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: local-git
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: local-git
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- image: lscr.io/linuxserver/openssh-server:latest
|
||||||
|
name: local-git
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: ssh
|
||||||
|
ports:
|
||||||
|
- containerPort: 2222
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 100Mi
|
||||||
|
requests:
|
||||||
|
memory: 100Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: custom-cont-initd
|
||||||
|
mountPath: /config/custom-cont-init.d
|
||||||
|
- name: ssh-host-keys
|
||||||
|
mountPath: /config/ssh_host_keys
|
||||||
|
volumes:
|
||||||
|
- name: custom-cont-initd
|
||||||
|
configMap:
|
||||||
|
name: custom-cont-initd
|
||||||
|
- name: ssh-host-keys
|
||||||
|
configMap:
|
||||||
|
name: ssh-host-keys
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
|
||||||
|
namespace: local-git
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- deployment.yaml
|
||||||
|
- service.yaml
|
||||||
|
|
||||||
|
configMapGenerator:
|
||||||
|
- name: ssh-host-keys
|
||||||
|
files:
|
||||||
|
- ssh_host_keys/ssh_host_dsa_key
|
||||||
|
- ssh_host_keys/ssh_host_ecdsa_key
|
||||||
|
- ssh_host_keys/ssh_host_ed25519_key
|
||||||
|
- ssh_host_keys/ssh_host_rsa_key
|
||||||
|
- ssh_host_keys/sshd_config
|
||||||
|
- ssh_host_keys/ssh_host_dsa_key.pub
|
||||||
|
- ssh_host_keys/ssh_host_ecdsa_key.pub
|
||||||
|
- ssh_host_keys/ssh_host_ed25519_key.pub
|
||||||
|
- ssh_host_keys/ssh_host_rsa_key.pub
|
||||||
|
- name: custom-cont-initd
|
||||||
|
files:
|
||||||
|
- custom-cont-init.d/init-git.sh
|
||||||
|
- name: ssh
|
||||||
|
literals:
|
||||||
|
- USER_NAME=git
|
||||||
|
files:
|
||||||
|
- PUBLIC_KEY
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: default
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
kind: Service
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: local-git
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
app: local-git
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 2222
|
||||||
|
targetPort: 2222
|
||||||
|
type: LoadBalancer
|
||||||
@@ -0,0 +1,117 @@
|
|||||||
|
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||||
|
|
||||||
|
# This is the sshd server system-wide configuration file. See
|
||||||
|
# sshd_config(5) for more information.
|
||||||
|
|
||||||
|
# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
|
||||||
|
|
||||||
|
# The strategy used for options in the default sshd_config shipped with
|
||||||
|
# OpenSSH is to specify options with their default value where
|
||||||
|
# possible, but leave them commented. Uncommented options override the
|
||||||
|
# default value.
|
||||||
|
|
||||||
|
#Port 22
|
||||||
|
#AddressFamily any
|
||||||
|
#ListenAddress 0.0.0.0
|
||||||
|
#ListenAddress ::
|
||||||
|
|
||||||
|
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||||
|
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||||
|
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||||
|
|
||||||
|
# Ciphers and keying
|
||||||
|
#RekeyLimit default none
|
||||||
|
|
||||||
|
# Logging
|
||||||
|
#SyslogFacility AUTH
|
||||||
|
#LogLevel INFO
|
||||||
|
|
||||||
|
# Authentication:
|
||||||
|
|
||||||
|
#LoginGraceTime 2m
|
||||||
|
#PermitRootLogin prohibit-password
|
||||||
|
#StrictModes yes
|
||||||
|
#MaxAuthTries 6
|
||||||
|
#MaxSessions 10
|
||||||
|
|
||||||
|
#PubkeyAuthentication yes
|
||||||
|
|
||||||
|
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||||
|
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||||
|
AuthorizedKeysFile .ssh/authorized_keys
|
||||||
|
|
||||||
|
#AuthorizedPrincipalsFile none
|
||||||
|
|
||||||
|
#AuthorizedKeysCommand none
|
||||||
|
#AuthorizedKeysCommandUser nobody
|
||||||
|
|
||||||
|
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||||
|
#HostbasedAuthentication no
|
||||||
|
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||||
|
# HostbasedAuthentication
|
||||||
|
#IgnoreUserKnownHosts no
|
||||||
|
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||||
|
#IgnoreRhosts yes
|
||||||
|
|
||||||
|
# To disable tunneled clear text passwords, change to no here!
|
||||||
|
PasswordAuthentication no
|
||||||
|
#PermitEmptyPasswords no
|
||||||
|
|
||||||
|
# Change to no to disable s/key passwords
|
||||||
|
#ChallengeResponseAuthentication yes
|
||||||
|
|
||||||
|
# Kerberos options
|
||||||
|
#KerberosAuthentication no
|
||||||
|
#KerberosOrLocalPasswd yes
|
||||||
|
#KerberosTicketCleanup yes
|
||||||
|
#KerberosGetAFSToken no
|
||||||
|
|
||||||
|
# GSSAPI options
|
||||||
|
#GSSAPIAuthentication no
|
||||||
|
#GSSAPICleanupCredentials yes
|
||||||
|
|
||||||
|
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||||
|
# and session processing. If this is enabled, PAM authentication will
|
||||||
|
# be allowed through the ChallengeResponseAuthentication and
|
||||||
|
# PasswordAuthentication. Depending on your PAM configuration,
|
||||||
|
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||||
|
# the setting of "PermitRootLogin without-password".
|
||||||
|
# If you just want the PAM account and session checks to run without
|
||||||
|
# PAM authentication, then enable this but set PasswordAuthentication
|
||||||
|
# and ChallengeResponseAuthentication to 'no'.
|
||||||
|
#UsePAM no
|
||||||
|
|
||||||
|
#AllowAgentForwarding yes
|
||||||
|
# Feel free to re-enable these if your use case requires them.
|
||||||
|
AllowTcpForwarding no
|
||||||
|
GatewayPorts no
|
||||||
|
X11Forwarding no
|
||||||
|
#X11DisplayOffset 10
|
||||||
|
#X11UseLocalhost yes
|
||||||
|
#PermitTTY yes
|
||||||
|
#PrintMotd yes
|
||||||
|
#PrintLastLog yes
|
||||||
|
#TCPKeepAlive yes
|
||||||
|
#PermitUserEnvironment no
|
||||||
|
#Compression delayed
|
||||||
|
#ClientAliveInterval 0
|
||||||
|
#ClientAliveCountMax 3
|
||||||
|
#UseDNS no
|
||||||
|
PidFile /config/sshd.pid
|
||||||
|
#MaxStartups 10:30:100
|
||||||
|
#PermitTunnel no
|
||||||
|
#ChrootDirectory none
|
||||||
|
#VersionAddendum none
|
||||||
|
|
||||||
|
# no default banner path
|
||||||
|
#Banner none
|
||||||
|
|
||||||
|
# override default of no subsystems
|
||||||
|
Subsystem sftp /usr/lib/ssh/sftp-server -u 022
|
||||||
|
|
||||||
|
# Example of overriding settings on a per-user basis
|
||||||
|
#Match User anoncvs
|
||||||
|
# X11Forwarding no
|
||||||
|
# AllowTcpForwarding no
|
||||||
|
# PermitTTY no
|
||||||
|
# ForceCommand cvs server
|
||||||
Executable
+150
@@ -0,0 +1,150 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
get_workdir() {
|
||||||
|
DIRPATH=$1
|
||||||
|
cd $DIRPATH
|
||||||
|
pwd
|
||||||
|
cd - > /dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
export WORKDIR=$(get_workdir $(dirname $0))
|
||||||
|
|
||||||
|
wait_until_ready() {
|
||||||
|
NAMESPACE=$1
|
||||||
|
LABEL=$2
|
||||||
|
while [[ $(kubectl get pods -n ${NAMESPACE} -l app=${LABEL} -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do
|
||||||
|
echo "waiting for pod" && sleep 1
|
||||||
|
done
|
||||||
|
}
|
||||||
|
|
||||||
|
generate_host_keys() {
|
||||||
|
HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
|
||||||
|
if [ ! -e $HOSTKEYDIR/ssh_host_dsa_key ]; then
|
||||||
|
ssh-keygen -q -N "" -C "root@openssh-server" -t dsa -f $HOSTKEYDIR/ssh_host_dsa_key
|
||||||
|
fi
|
||||||
|
if [ ! -e $HOSTKEYDIR/ssh_host_rsa_key ]; then
|
||||||
|
ssh-keygen -q -N "" -C "root@openssh-server" -t rsa -b 2048 -f $HOSTKEYDIR/ssh_host_rsa_key
|
||||||
|
fi
|
||||||
|
if [ ! -e $HOSTKEYDIR/ssh_host_ecdsa_key ]; then
|
||||||
|
ssh-keygen -q -N "" -C "root@openssh-server" -t ecdsa -f $HOSTKEYDIR/ssh_host_ecdsa_key
|
||||||
|
fi
|
||||||
|
if [ ! -e $HOSTKEYDIR/ssh_host_ed25519_key ]; then
|
||||||
|
ssh-keygen -q -N "" -C "root@openssh-server" -t ed25519 -f $HOSTKEYDIR/ssh_host_ed25519_key
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
generate_keys() {
|
||||||
|
KEYDIR=$WORKDIR/keys
|
||||||
|
HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
|
||||||
|
HOSTKEYS=("ssh_host_dsa_key" "ssh_host_rsa_key" "ssh_host_ecdsa_key" "ssh_host_ed25519_key")
|
||||||
|
if [ ! -e $KEYDIR ]; then
|
||||||
|
mkdir -p $KEYDIR
|
||||||
|
fi
|
||||||
|
if [ ! -e $KEYDIR/known_hosts ]; then
|
||||||
|
for key in "${HOSTKEYS[@]}"; do
|
||||||
|
echo "[local-git.local-git.svc.cluster.local]:2222 $(cat $HOSTKEYDIR/$key.pub | awk '{print $1" "$2}')" >> $KEYDIR/known_hosts
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -e $KEYDIR/identity ]; then
|
||||||
|
ssh-keygen -q -N "" -C "development@key" -f $KEYDIR/identity
|
||||||
|
cp $KEYDIR/identity.pub $WORKDIR/local-git/PUBLIC_KEY
|
||||||
|
fi
|
||||||
|
kubectl create secret generic local-git-secret \
|
||||||
|
--from-file=$KEYDIR/identity \
|
||||||
|
--from-file=$KEYDIR/identity.pub \
|
||||||
|
--from-file=$KEYDIR/known_hosts --dry-run=client -o yaml | \
|
||||||
|
kubectl patch --local -f- --type=json \
|
||||||
|
-p='[{"op": "remove", "path": "/metadata/creationTimestamp"}]' -o yaml > $KEYDIR/local-git-secret.yaml
|
||||||
|
if [ ! -e $KEYDIR/age.agekey ];then
|
||||||
|
age-keygen -o $KEYDIR/age.agekey
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
prepare_flux_dir() {
|
||||||
|
KEYDIR=$WORKDIR/keys
|
||||||
|
FLUXDIR=$WORKDIR/../flux
|
||||||
|
CLUSTERDIR=$FLUXDIR/clusters/k3d-develop
|
||||||
|
|
||||||
|
PUBAGEKEY=$(cat $KEYDIR/age.agekey | grep public\ key | awk -F:\ '{print $2}')
|
||||||
|
if [ ! -e $FLUXDIR/.sops.yaml ]; then
|
||||||
|
cat > $FLUXDIR/.sops.yaml <<EOF
|
||||||
|
creation_rules:
|
||||||
|
- path_regex: .*\/k3d-develop\/.*.yaml
|
||||||
|
encrypted_regex: ^(data|stringData)$
|
||||||
|
age: ${PUBAGEKEY}
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
if [ ! -e $CLUSTERDIR/flux-system/local-git-secret.yaml ]; then
|
||||||
|
sops -e --age $PUBAGEKEY -encrypted-regex "^(data|stringData)$" $KEYDIR/local-git-secret.yaml > $CLUSTERDIR/flux-system/local-git-secret.yaml
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
clean() {
|
||||||
|
KEYDIR=$WORKDIR/keys
|
||||||
|
FLUXDIR=$WORKDIR/../flux
|
||||||
|
CLUSTERDIR=$FLUXDIR/clusters/k3d-develop
|
||||||
|
HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
|
||||||
|
|
||||||
|
rm $HOSTKEYDIR/ssh_host_*
|
||||||
|
rm $KEYDIR/*
|
||||||
|
rmdir $KEYDIR
|
||||||
|
rm $WORKDIR/local-git/PUBLIC_KEY
|
||||||
|
rm $FLUXDIR/.sops.yaml
|
||||||
|
rm $CLUSTERDIR/flux-system/local-git-secret.yaml
|
||||||
|
ssh-keygen -R "[localhost]:2222"
|
||||||
|
}
|
||||||
|
|
||||||
|
start() {
|
||||||
|
|
||||||
|
k3d cluster create -c $WORKDIR/k3d-develop-config.yaml
|
||||||
|
mkdir -p $WORKDIR/../kubeconfigs
|
||||||
|
k3d kubeconfig get develop > $WORKDIR/../kubeconfigs/k3d-develop.yaml
|
||||||
|
|
||||||
|
export KUBECONFIG="$WORKDIR/../kubeconfigs/k3d-develop.yaml"
|
||||||
|
|
||||||
|
kubectl apply -k $WORKDIR/local-git
|
||||||
|
|
||||||
|
git remote add develop ssh://git@localhost:2222/srv/git/flux.git 2>&1 >/dev/null || git remote set-url develop ssh://git@localhost:2222/srv/git/flux.git
|
||||||
|
|
||||||
|
git remote get-url develop
|
||||||
|
|
||||||
|
chmod 600 $WORKDIR/keys/identity
|
||||||
|
ssh-add $WORKDIR/keys/identity
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Wait until git server is ready"
|
||||||
|
echo
|
||||||
|
wait_until_ready local-git local-git
|
||||||
|
echo "Wait 15 sec"
|
||||||
|
sleep 15
|
||||||
|
echo
|
||||||
|
git push develop --all
|
||||||
|
}
|
||||||
|
|
||||||
|
delete() {
|
||||||
|
k3d cluster delete develop
|
||||||
|
}
|
||||||
|
|
||||||
|
case $1 in
|
||||||
|
start)
|
||||||
|
start
|
||||||
|
;;
|
||||||
|
delete)
|
||||||
|
delete
|
||||||
|
;;
|
||||||
|
generate)
|
||||||
|
generate_host_keys
|
||||||
|
generate_keys
|
||||||
|
prepare_flux_dir
|
||||||
|
;;
|
||||||
|
clean)
|
||||||
|
clean
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "$0 start | delete | generate | clean"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
@@ -0,0 +1,107 @@
|
|||||||
|
# Lokale Entwicklungsumgebung für fluxcd
|
||||||
|
|
||||||
|
Hier kann ein lokaler Kubernetes Cluster hochgefahren werden. Zudem wird ein schlanker git server (openssh-server) als Pod gestartet.
|
||||||
|
|
||||||
|
## Vorraussetzung
|
||||||
|
|
||||||
|
Docker wird als gegeben vorrausgesetzt.
|
||||||
|
|
||||||
|
* [k3d](https://k3d.io)
|
||||||
|
|
||||||
|
Mit Hilfe von k3d kann ein lokaler Kubernetes gestartet werden. Dies funktioniert sowohl unter MacOS als auch Linux (Windows mit WSL).
|
||||||
|
|
||||||
|
## Benutzung
|
||||||
|
|
||||||
|
Starten der Entwicklungsumgebung:
|
||||||
|
|
||||||
|
```
|
||||||
|
./local-k8s.sh start
|
||||||
|
```
|
||||||
|
|
||||||
|
Entfernen des Kubernetes Clusters:
|
||||||
|
|
||||||
|
```
|
||||||
|
./local-k8s.sh delete
|
||||||
|
```
|
||||||
|
|
||||||
|
## Git Server
|
||||||
|
|
||||||
|
Es wird ein Git Server (openssh server) als POD gestartet. Dieser ist dann unter ssh://git@localhost:2222/srv/git/local-git.git erreichbar.
|
||||||
|
|
||||||
|
Auf dem HOST System:
|
||||||
|
```
|
||||||
|
ssh://git@localhost:2222/srv/git/local-git.git
|
||||||
|
```
|
||||||
|
|
||||||
|
Von Kubernetes aus ist der Git Server unter folgender Adresse erreichbar:
|
||||||
|
```
|
||||||
|
ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/local-flux.git
|
||||||
|
```
|
||||||
|
|
||||||
|
### Hinzufügen von Code in Flux
|
||||||
|
|
||||||
|
Das `local-k8s.sh` Script fügt im Repo ein weiteres git-remote Target hinzu:
|
||||||
|
|
||||||
|
```
|
||||||
|
git remote add develop ssh://git@localhost:2222/srv/git/local-flux.git
|
||||||
|
```
|
||||||
|
|
||||||
|
Damit können nun Änderungen an dem k3d-develop cluster Teil (flux/cluster/k3d-develop) durchgeführt werden. Zudem muss in
|
||||||
|
`flux/cluster/k3d-develop/flux-sync.yaml` der Branch angepasst werden. Sobald dies erfolgt ist, können die Änderungen auf
|
||||||
|
den Git Server hinzugefügt werden:
|
||||||
|
|
||||||
|
```
|
||||||
|
git push develop
|
||||||
|
```
|
||||||
|
|
||||||
|
### Hinzufügen weiterer Repos
|
||||||
|
|
||||||
|
Die Repos werden über ein Init Script angelegt:
|
||||||
|
|
||||||
|
|
||||||
|
__/local-git/custom-cont-init.d/init-git.sh:__
|
||||||
|
|
||||||
|
```
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
GITREPOS=("local-flux" "test")
|
||||||
|
|
||||||
|
apk update
|
||||||
|
apk add git
|
||||||
|
rm /etc/motd
|
||||||
|
mkdir -p /srv/git
|
||||||
|
for repo in ${GITREPOS[@]}; do
|
||||||
|
mkdir -p /srv/git/${repo}.git
|
||||||
|
cd /srv/git/${repo}.git
|
||||||
|
git init --bare
|
||||||
|
done
|
||||||
|
chown -R git:git /srv/git
|
||||||
|
```
|
||||||
|
|
||||||
|
Das Array GITREPOS steuert die Anlage der Repos. Diese werden nur beim Aufsetzen der Umgebung angelegt. Im laufenden Betrieb ist das
|
||||||
|
nicht möglich.
|
||||||
|
|
||||||
|
## Test mit weiterer NodeGroup
|
||||||
|
|
||||||
|
Möchte man etwas mit einer weiteren NodeGroup testen (wie z.b. nginx Ingress oder varnish), so kann man tatsächlich mit k3d einen weiteren Node simulieren:
|
||||||
|
|
||||||
|
```
|
||||||
|
k3d node create -c develop --k3s-node-label node=ingress ingress
|
||||||
|
|
||||||
|
# -c develop - ist der Clustername, hier sollte develop schon richtig sein
|
||||||
|
# --k3s-node-label node=ingress - der node wird mit dem Label node=ingess makiert und kann später damit explzit gewählt werden
|
||||||
|
# ingress - so heißt diese Node Gruppe
|
||||||
|
```
|
||||||
|
|
||||||
|
Damit der Scheduler den neuen Node nicht verwendet, muss dieser noch getainted werden:
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl taint nodes k3d-ingress-0 node=ingress:NoSchedule
|
||||||
|
|
||||||
|
# Der interne Node Name wird anscheinend wie folgt zusammengebaut: k3d-NODEGROUPNAME-COUNTER
|
||||||
|
# node=ingress:NoSchedule ist der taint
|
||||||
|
```
|
||||||
|
|
||||||
|
Hier gibt es weiterführende Infos:
|
||||||
|
|
||||||
|
* [Taint and Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
# Lokale flux Entwicklungsumgebung
|
||||||
|
|
||||||
|
## Benötigte Tools
|
||||||
|
|
||||||
|
* Docker
|
||||||
|
* [k3d](https://k3d.io/)
|
||||||
|
* [sops](https://github.com/mozilla/sops)
|
||||||
|
* [flux](https://github.com/fluxcd/flux2)
|
||||||
|
|
||||||
|
## Lokaler K8S
|
||||||
|
|
||||||
|
### Starten
|
||||||
|
|
||||||
|
```
|
||||||
|
local-k8s/local-k8s.sh start
|
||||||
|
```
|
||||||
|
|
||||||
|
### Stoppen bzw. löschen
|
||||||
|
|
||||||
|
```
|
||||||
|
local-k8s/local-k8s.sh delete
|
||||||
|
```
|
||||||
|
|
||||||
|
### Generieren der benötigen Keys
|
||||||
|
|
||||||
|
```
|
||||||
|
local-k8s/local-k8s.sh generate
|
||||||
|
```
|
||||||
|
|
||||||
|
### Löschen der Keys
|
||||||
|
|
||||||
|
```
|
||||||
|
local-k8s/local-k8s.sh clean
|
||||||
|
```
|
||||||
Reference in New Issue
Block a user