Erste Implementierung
This commit was merged in pull request #1.
This commit is contained in:
@@ -0,0 +1,11 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: fluxcd-edit
|
||||
labels:
|
||||
# Add these permissions to "edit" default role.
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rules:
|
||||
- apiGroups: ["helm.toolkit.fluxcd.io","kustomize.toolkit.fluxcd.io","notification.toolkit.fluxcd.io","source.toolkit.fluxcd.io"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- fluxcd-user.yaml
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: kustomization
|
||||
namespace: default
|
||||
spec:
|
||||
decryption:
|
||||
provider: sops
|
||||
interval: 5m0s
|
||||
path: ./flux/clusters/eks-cluster-name
|
||||
prune: true
|
||||
serviceAccountName: deploy
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: source
|
||||
validation: client
|
||||
@@ -0,0 +1,12 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: LimitRange
|
||||
metadata:
|
||||
name: default-memory-limit
|
||||
spec:
|
||||
limits:
|
||||
- default:
|
||||
memory: 256Mi
|
||||
defaultRequest:
|
||||
memory: 256Mi
|
||||
type: Container
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta1
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: source
|
||||
namespace: default
|
||||
spec:
|
||||
interval: 1m0s
|
||||
ref:
|
||||
branch: main
|
||||
url: ssh://git@github.com/sueddeutsche/demo-flux-echoserver.git
|
||||
secretRef:
|
||||
name: GITHUB-SSH-TOKEN
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: deploy-rolebinding
|
||||
namespace: default
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: edit
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: deploy
|
||||
namespace: default
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: deploy
|
||||
namespace: default
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- default-kustomization.yaml
|
||||
- default-memory-limit.yaml
|
||||
- default-source.yaml
|
||||
- deploy-serviceaccount.yaml
|
||||
- deploy-rolebinding.yaml
|
||||
- namespace.yaml
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: default
|
||||
@@ -0,0 +1,2 @@
|
||||
export KUBECONFIG=$(cd ../../../kubeconfigs; pwd -P)/k3d-develop.yaml
|
||||
export SOPS_AGE_KEY_FILE=$(pwd)/../../../local-k8s/keys/age.agekey
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,31 @@
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta1
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: flux-system
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
ref:
|
||||
branch: main
|
||||
secretRef:
|
||||
name: local-git-secret
|
||||
timeout: 20s
|
||||
url: ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/flux.git
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: flux-system
|
||||
namespace: flux-system
|
||||
spec:
|
||||
decryption:
|
||||
provider: sops
|
||||
secretRef:
|
||||
name: age-key-secret
|
||||
interval: 1m0s
|
||||
path: ./flux/clusters/k3d-develop
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
#!/bin/bash
|
||||
export WORKDIR=$(dirname $0)
|
||||
|
||||
cd $WORKDIR
|
||||
|
||||
kubectl apply -n flux-system -f flux-components.yaml
|
||||
sops exec-file local-git-secret.yaml "kubectl apply -n flux-system -f {}"
|
||||
|
||||
kubectl create secret -n flux-system generic age-key-secret --from-file age.agekey=../../../../local-k8s/keys/age.agekey --dry-run=client -o yaml | kubectl apply -f-
|
||||
|
||||
kubectl apply -n flux-system -f flux-sync.yaml
|
||||
|
||||
flux reconcile source git -n flux-system flux-system
|
||||
|
||||
cd -
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
# we need dedicated 'flux-components.yaml' in each cluster - otherwise a flux-system update in one cluster
|
||||
# would be populated to all clusters
|
||||
- flux-components.yaml
|
||||
- flux-sync.yaml
|
||||
- local-git-secret.yaml
|
||||
- ../../../base/clusterroles
|
||||
|
||||
namespace: flux-system
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
clusters:
|
||||
- cluster:
|
||||
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUyTkRVeE16VTFOREV3SGhjTk1qSXdNakUzTWpJd05UUXhXaGNOTXpJd01qRTFNakl3TlRReApXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUyTkRVeE16VTFOREV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUdldzbjlFU0VtUC9IU1daamp0UXA3R25GWDlqMVNCMHBhZkx0dHBZSG0KTjhZbEpIU1ViMGJicmZqUzd0am5HWTF4RHV1aVlMQm9keDZtY1ZHM0pqZWlvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVW9XdmJEVTcrUjF1UlVqWW1EOWU1Cis4cllPOVV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnQ3paelVBRGFjSVFnVmZFV2Ywc3Foc29xc25sRzE4bVEKRGxGSS85VThVOXdDSVFEMnFGVk1mQUdWeEZQVEdNaFZEYzJtVjExbHJqMFQ2SStKVCtETnVmelVlQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
|
||||
server: https://0.0.0.0:57999
|
||||
name: k3d-develop
|
||||
contexts:
|
||||
- context:
|
||||
cluster: k3d-develop
|
||||
user: admin@k3d-develop
|
||||
name: k3d-develop
|
||||
current-context: k3d-develop
|
||||
kind: Config
|
||||
preferences: {}
|
||||
users:
|
||||
- name: admin@k3d-develop
|
||||
user:
|
||||
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRlZ0F3SUJBZ0lJQjlDWkxvMGhGRWN3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOalExTVRNMU5UUXhNQjRYRFRJeU1ESXhOekl5TURVME1Wb1hEVEl6TURJeApOekl5TURVME1Wb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGbEpvaDUyalR3SzlnbGsKeW0zdldOdHpnU0lGem1IaFRuYmxycWFmaTh0dWYySzVkSnpSYnRmNTJXU1h4am00VlBIeVBDUEFIZjF5U3NmcwpXcWRmMGZ1alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCU0JmQnpJNVRxWWYrUTRuS0xoN2dCMEVoZkl4VEFLQmdncWhrak9QUVFEQWdOSkFEQkcKQWlFQXNjeVIvVTlCSHBWOU0zRFRoR3RSZlcxSjBFSHZ1K09Td1VYYnpvSVNKQ0lDSVFDU0RXZ0c2Mjc4WlFmVgpvbVZWc25lU2hSbERQa3dtRFo4RXhoSmJaVUhNSlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSMmdBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwClpXNTBMV05oUURFMk5EVXhNelUxTkRFd0hoY05Nakl3TWpFM01qSXdOVFF4V2hjTk16SXdNakUxTWpJd05UUXgKV2pBak1TRXdId1lEVlFRRERCaHJNM010WTJ4cFpXNTBMV05oUURFMk5EVXhNelUxTkRFd1dUQVRCZ2NxaGtqTwpQUUlCQmdncWhrak9QUU1CQndOQ0FBUVY3dm54Y09YVGNTbTA5UW5NOWpuTmNuRkFWdk4rb25xOWkyMFF4UFdhCndHSkhKSmJickVrYTRvKzVERmFUbXhydGgxeE1Ob08wK0FMWHlKclg1WDM2bzBJd1FEQU9CZ05WSFE4QkFmOEUKQkFNQ0FxUXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVnWHdjeU9VNm1IL2tPSnlpNGU0QQpkQklYeU1Vd0NnWUlLb1pJemowRUF3SURTUUF3UmdJaEFOc2pDWWVrYURzWSs1QmpDZ08rUUVCa21GRWJIY1RGCkdScHAxcitSaWl0RUFpRUFyZnp0alM4MU9RWC8rZHhDcGVYaFkzUk5POHlSRmVaa2NETUZxdEVhWmMwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
|
||||
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9lV1hSZmlucVFuNVFGUHk1ajEvYTlZMVhIWnpOaDgvZUdsZEh4VDBkQTJvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFV1VtaUhuYU5QQXIyQ1dUS2JlOVkyM09CSWdYT1llRk9kdVd1cHArTHkyNS9Zcmwwbk5GdQoxL25aWkpmR09iaFU4Zkk4SThBZC9YSkt4K3hhcDEvUit3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: k3d.io/v1alpha3
|
||||
kind: Simple
|
||||
name: develop
|
||||
ports:
|
||||
- port: 8080:80
|
||||
nodeFilters:
|
||||
- loadbalancer
|
||||
- port: 2222:2222
|
||||
nodeFilters:
|
||||
- loadbalancer
|
||||
options:
|
||||
k3s:
|
||||
extraArgs:
|
||||
- arg: --no-deploy=traefik
|
||||
nodeFilters:
|
||||
- server:*
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/bash
|
||||
|
||||
GITREPOS=("flux")
|
||||
|
||||
apk update
|
||||
apk add git
|
||||
rm /etc/motd
|
||||
mkdir -p /srv/git
|
||||
for repo in ${GITREPOS[@]}; do
|
||||
mkdir -p /srv/git/${repo}.git
|
||||
cd /srv/git/${repo}.git
|
||||
git init --bare
|
||||
done
|
||||
chown -R git:git /srv/git
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: local-git
|
||||
name: local-git
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: local-git
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: local-git
|
||||
spec:
|
||||
containers:
|
||||
- image: lscr.io/linuxserver/openssh-server:latest
|
||||
name: local-git
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: ssh
|
||||
ports:
|
||||
- containerPort: 2222
|
||||
resources:
|
||||
limits:
|
||||
memory: 100Mi
|
||||
requests:
|
||||
memory: 100Mi
|
||||
volumeMounts:
|
||||
- name: custom-cont-initd
|
||||
mountPath: /config/custom-cont-init.d
|
||||
- name: ssh-host-keys
|
||||
mountPath: /config/ssh_host_keys
|
||||
volumes:
|
||||
- name: custom-cont-initd
|
||||
configMap:
|
||||
name: custom-cont-initd
|
||||
- name: ssh-host-keys
|
||||
configMap:
|
||||
name: ssh-host-keys
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: local-git
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: ssh-host-keys
|
||||
files:
|
||||
- ssh_host_keys/ssh_host_dsa_key
|
||||
- ssh_host_keys/ssh_host_ecdsa_key
|
||||
- ssh_host_keys/ssh_host_ed25519_key
|
||||
- ssh_host_keys/ssh_host_rsa_key
|
||||
- ssh_host_keys/sshd_config
|
||||
- ssh_host_keys/ssh_host_dsa_key.pub
|
||||
- ssh_host_keys/ssh_host_ecdsa_key.pub
|
||||
- ssh_host_keys/ssh_host_ed25519_key.pub
|
||||
- ssh_host_keys/ssh_host_rsa_key.pub
|
||||
- name: custom-cont-initd
|
||||
files:
|
||||
- custom-cont-init.d/init-git.sh
|
||||
- name: ssh
|
||||
literals:
|
||||
- USER_NAME=git
|
||||
files:
|
||||
- PUBLIC_KEY
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: default
|
||||
@@ -0,0 +1,12 @@
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: local-git
|
||||
spec:
|
||||
selector:
|
||||
app: local-git
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 2222
|
||||
targetPort: 2222
|
||||
type: LoadBalancer
|
||||
@@ -0,0 +1,117 @@
|
||||
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
|
||||
|
||||
# This is the sshd server system-wide configuration file. See
|
||||
# sshd_config(5) for more information.
|
||||
|
||||
# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
|
||||
|
||||
# The strategy used for options in the default sshd_config shipped with
|
||||
# OpenSSH is to specify options with their default value where
|
||||
# possible, but leave them commented. Uncommented options override the
|
||||
# default value.
|
||||
|
||||
#Port 22
|
||||
#AddressFamily any
|
||||
#ListenAddress 0.0.0.0
|
||||
#ListenAddress ::
|
||||
|
||||
#HostKey /etc/ssh/ssh_host_rsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ecdsa_key
|
||||
#HostKey /etc/ssh/ssh_host_ed25519_key
|
||||
|
||||
# Ciphers and keying
|
||||
#RekeyLimit default none
|
||||
|
||||
# Logging
|
||||
#SyslogFacility AUTH
|
||||
#LogLevel INFO
|
||||
|
||||
# Authentication:
|
||||
|
||||
#LoginGraceTime 2m
|
||||
#PermitRootLogin prohibit-password
|
||||
#StrictModes yes
|
||||
#MaxAuthTries 6
|
||||
#MaxSessions 10
|
||||
|
||||
#PubkeyAuthentication yes
|
||||
|
||||
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
|
||||
# but this is overridden so installations will only check .ssh/authorized_keys
|
||||
AuthorizedKeysFile .ssh/authorized_keys
|
||||
|
||||
#AuthorizedPrincipalsFile none
|
||||
|
||||
#AuthorizedKeysCommand none
|
||||
#AuthorizedKeysCommandUser nobody
|
||||
|
||||
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
|
||||
#HostbasedAuthentication no
|
||||
# Change to yes if you don't trust ~/.ssh/known_hosts for
|
||||
# HostbasedAuthentication
|
||||
#IgnoreUserKnownHosts no
|
||||
# Don't read the user's ~/.rhosts and ~/.shosts files
|
||||
#IgnoreRhosts yes
|
||||
|
||||
# To disable tunneled clear text passwords, change to no here!
|
||||
PasswordAuthentication no
|
||||
#PermitEmptyPasswords no
|
||||
|
||||
# Change to no to disable s/key passwords
|
||||
#ChallengeResponseAuthentication yes
|
||||
|
||||
# Kerberos options
|
||||
#KerberosAuthentication no
|
||||
#KerberosOrLocalPasswd yes
|
||||
#KerberosTicketCleanup yes
|
||||
#KerberosGetAFSToken no
|
||||
|
||||
# GSSAPI options
|
||||
#GSSAPIAuthentication no
|
||||
#GSSAPICleanupCredentials yes
|
||||
|
||||
# Set this to 'yes' to enable PAM authentication, account processing,
|
||||
# and session processing. If this is enabled, PAM authentication will
|
||||
# be allowed through the ChallengeResponseAuthentication and
|
||||
# PasswordAuthentication. Depending on your PAM configuration,
|
||||
# PAM authentication via ChallengeResponseAuthentication may bypass
|
||||
# the setting of "PermitRootLogin without-password".
|
||||
# If you just want the PAM account and session checks to run without
|
||||
# PAM authentication, then enable this but set PasswordAuthentication
|
||||
# and ChallengeResponseAuthentication to 'no'.
|
||||
#UsePAM no
|
||||
|
||||
#AllowAgentForwarding yes
|
||||
# Feel free to re-enable these if your use case requires them.
|
||||
AllowTcpForwarding no
|
||||
GatewayPorts no
|
||||
X11Forwarding no
|
||||
#X11DisplayOffset 10
|
||||
#X11UseLocalhost yes
|
||||
#PermitTTY yes
|
||||
#PrintMotd yes
|
||||
#PrintLastLog yes
|
||||
#TCPKeepAlive yes
|
||||
#PermitUserEnvironment no
|
||||
#Compression delayed
|
||||
#ClientAliveInterval 0
|
||||
#ClientAliveCountMax 3
|
||||
#UseDNS no
|
||||
PidFile /config/sshd.pid
|
||||
#MaxStartups 10:30:100
|
||||
#PermitTunnel no
|
||||
#ChrootDirectory none
|
||||
#VersionAddendum none
|
||||
|
||||
# no default banner path
|
||||
#Banner none
|
||||
|
||||
# override default of no subsystems
|
||||
Subsystem sftp /usr/lib/ssh/sftp-server -u 022
|
||||
|
||||
# Example of overriding settings on a per-user basis
|
||||
#Match User anoncvs
|
||||
# X11Forwarding no
|
||||
# AllowTcpForwarding no
|
||||
# PermitTTY no
|
||||
# ForceCommand cvs server
|
||||
Executable
+150
@@ -0,0 +1,150 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
|
||||
get_workdir() {
|
||||
DIRPATH=$1
|
||||
cd $DIRPATH
|
||||
pwd
|
||||
cd - > /dev/null
|
||||
}
|
||||
|
||||
export WORKDIR=$(get_workdir $(dirname $0))
|
||||
|
||||
wait_until_ready() {
|
||||
NAMESPACE=$1
|
||||
LABEL=$2
|
||||
while [[ $(kubectl get pods -n ${NAMESPACE} -l app=${LABEL} -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do
|
||||
echo "waiting for pod" && sleep 1
|
||||
done
|
||||
}
|
||||
|
||||
generate_host_keys() {
|
||||
HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
|
||||
if [ ! -e $HOSTKEYDIR/ssh_host_dsa_key ]; then
|
||||
ssh-keygen -q -N "" -C "root@openssh-server" -t dsa -f $HOSTKEYDIR/ssh_host_dsa_key
|
||||
fi
|
||||
if [ ! -e $HOSTKEYDIR/ssh_host_rsa_key ]; then
|
||||
ssh-keygen -q -N "" -C "root@openssh-server" -t rsa -b 2048 -f $HOSTKEYDIR/ssh_host_rsa_key
|
||||
fi
|
||||
if [ ! -e $HOSTKEYDIR/ssh_host_ecdsa_key ]; then
|
||||
ssh-keygen -q -N "" -C "root@openssh-server" -t ecdsa -f $HOSTKEYDIR/ssh_host_ecdsa_key
|
||||
fi
|
||||
if [ ! -e $HOSTKEYDIR/ssh_host_ed25519_key ]; then
|
||||
ssh-keygen -q -N "" -C "root@openssh-server" -t ed25519 -f $HOSTKEYDIR/ssh_host_ed25519_key
|
||||
fi
|
||||
}
|
||||
|
||||
generate_keys() {
|
||||
KEYDIR=$WORKDIR/keys
|
||||
HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
|
||||
HOSTKEYS=("ssh_host_dsa_key" "ssh_host_rsa_key" "ssh_host_ecdsa_key" "ssh_host_ed25519_key")
|
||||
if [ ! -e $KEYDIR ]; then
|
||||
mkdir -p $KEYDIR
|
||||
fi
|
||||
if [ ! -e $KEYDIR/known_hosts ]; then
|
||||
for key in "${HOSTKEYS[@]}"; do
|
||||
echo "[local-git.local-git.svc.cluster.local]:2222 $(cat $HOSTKEYDIR/$key.pub | awk '{print $1" "$2}')" >> $KEYDIR/known_hosts
|
||||
done
|
||||
fi
|
||||
|
||||
if [ ! -e $KEYDIR/identity ]; then
|
||||
ssh-keygen -q -N "" -C "development@key" -f $KEYDIR/identity
|
||||
cp $KEYDIR/identity.pub $WORKDIR/local-git/PUBLIC_KEY
|
||||
fi
|
||||
kubectl create secret generic local-git-secret \
|
||||
--from-file=$KEYDIR/identity \
|
||||
--from-file=$KEYDIR/identity.pub \
|
||||
--from-file=$KEYDIR/known_hosts --dry-run=client -o yaml | \
|
||||
kubectl patch --local -f- --type=json \
|
||||
-p='[{"op": "remove", "path": "/metadata/creationTimestamp"}]' -o yaml > $KEYDIR/local-git-secret.yaml
|
||||
if [ ! -e $KEYDIR/age.agekey ];then
|
||||
age-keygen -o $KEYDIR/age.agekey
|
||||
fi
|
||||
}
|
||||
|
||||
prepare_flux_dir() {
|
||||
KEYDIR=$WORKDIR/keys
|
||||
FLUXDIR=$WORKDIR/../flux
|
||||
CLUSTERDIR=$FLUXDIR/clusters/k3d-develop
|
||||
|
||||
PUBAGEKEY=$(cat $KEYDIR/age.agekey | grep public\ key | awk -F:\ '{print $2}')
|
||||
if [ ! -e $FLUXDIR/.sops.yaml ]; then
|
||||
cat > $FLUXDIR/.sops.yaml <<EOF
|
||||
creation_rules:
|
||||
- path_regex: .*\/k3d-develop\/.*.yaml
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
age: ${PUBAGEKEY}
|
||||
EOF
|
||||
fi
|
||||
if [ ! -e $CLUSTERDIR/flux-system/local-git-secret.yaml ]; then
|
||||
sops -e --age $PUBAGEKEY -encrypted-regex "^(data|stringData)$" $KEYDIR/local-git-secret.yaml > $CLUSTERDIR/flux-system/local-git-secret.yaml
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
clean() {
|
||||
KEYDIR=$WORKDIR/keys
|
||||
FLUXDIR=$WORKDIR/../flux
|
||||
CLUSTERDIR=$FLUXDIR/clusters/k3d-develop
|
||||
HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
|
||||
|
||||
rm $HOSTKEYDIR/ssh_host_*
|
||||
rm $KEYDIR/*
|
||||
rmdir $KEYDIR
|
||||
rm $WORKDIR/local-git/PUBLIC_KEY
|
||||
rm $FLUXDIR/.sops.yaml
|
||||
rm $CLUSTERDIR/flux-system/local-git-secret.yaml
|
||||
ssh-keygen -R "[localhost]:2222"
|
||||
}
|
||||
|
||||
start() {
|
||||
|
||||
k3d cluster create -c $WORKDIR/k3d-develop-config.yaml
|
||||
mkdir -p $WORKDIR/../kubeconfigs
|
||||
k3d kubeconfig get develop > $WORKDIR/../kubeconfigs/k3d-develop.yaml
|
||||
|
||||
export KUBECONFIG="$WORKDIR/../kubeconfigs/k3d-develop.yaml"
|
||||
|
||||
kubectl apply -k $WORKDIR/local-git
|
||||
|
||||
git remote add develop ssh://git@localhost:2222/srv/git/flux.git 2>&1 >/dev/null || git remote set-url develop ssh://git@localhost:2222/srv/git/flux.git
|
||||
|
||||
git remote get-url develop
|
||||
|
||||
chmod 600 $WORKDIR/keys/identity
|
||||
ssh-add $WORKDIR/keys/identity
|
||||
|
||||
echo
|
||||
echo "Wait until git server is ready"
|
||||
echo
|
||||
wait_until_ready local-git local-git
|
||||
echo "Wait 15 sec"
|
||||
sleep 15
|
||||
echo
|
||||
git push develop --all
|
||||
}
|
||||
|
||||
delete() {
|
||||
k3d cluster delete develop
|
||||
}
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
delete)
|
||||
delete
|
||||
;;
|
||||
generate)
|
||||
generate_host_keys
|
||||
generate_keys
|
||||
prepare_flux_dir
|
||||
;;
|
||||
clean)
|
||||
clean
|
||||
;;
|
||||
*)
|
||||
echo "$0 start | delete | generate | clean"
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,107 @@
|
||||
# Lokale Entwicklungsumgebung für fluxcd
|
||||
|
||||
Hier kann ein lokaler Kubernetes Cluster hochgefahren werden. Zudem wird ein schlanker git server (openssh-server) als Pod gestartet.
|
||||
|
||||
## Vorraussetzung
|
||||
|
||||
Docker wird als gegeben vorrausgesetzt.
|
||||
|
||||
* [k3d](https://k3d.io)
|
||||
|
||||
Mit Hilfe von k3d kann ein lokaler Kubernetes gestartet werden. Dies funktioniert sowohl unter MacOS als auch Linux (Windows mit WSL).
|
||||
|
||||
## Benutzung
|
||||
|
||||
Starten der Entwicklungsumgebung:
|
||||
|
||||
```
|
||||
./local-k8s.sh start
|
||||
```
|
||||
|
||||
Entfernen des Kubernetes Clusters:
|
||||
|
||||
```
|
||||
./local-k8s.sh delete
|
||||
```
|
||||
|
||||
## Git Server
|
||||
|
||||
Es wird ein Git Server (openssh server) als POD gestartet. Dieser ist dann unter ssh://git@localhost:2222/srv/git/local-git.git erreichbar.
|
||||
|
||||
Auf dem HOST System:
|
||||
```
|
||||
ssh://git@localhost:2222/srv/git/local-git.git
|
||||
```
|
||||
|
||||
Von Kubernetes aus ist der Git Server unter folgender Adresse erreichbar:
|
||||
```
|
||||
ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/local-flux.git
|
||||
```
|
||||
|
||||
### Hinzufügen von Code in Flux
|
||||
|
||||
Das `local-k8s.sh` Script fügt im Repo ein weiteres git-remote Target hinzu:
|
||||
|
||||
```
|
||||
git remote add develop ssh://git@localhost:2222/srv/git/local-flux.git
|
||||
```
|
||||
|
||||
Damit können nun Änderungen an dem k3d-develop cluster Teil (flux/cluster/k3d-develop) durchgeführt werden. Zudem muss in
|
||||
`flux/cluster/k3d-develop/flux-sync.yaml` der Branch angepasst werden. Sobald dies erfolgt ist, können die Änderungen auf
|
||||
den Git Server hinzugefügt werden:
|
||||
|
||||
```
|
||||
git push develop
|
||||
```
|
||||
|
||||
### Hinzufügen weiterer Repos
|
||||
|
||||
Die Repos werden über ein Init Script angelegt:
|
||||
|
||||
|
||||
__/local-git/custom-cont-init.d/init-git.sh:__
|
||||
|
||||
```
|
||||
#!/bin/bash
|
||||
|
||||
GITREPOS=("local-flux" "test")
|
||||
|
||||
apk update
|
||||
apk add git
|
||||
rm /etc/motd
|
||||
mkdir -p /srv/git
|
||||
for repo in ${GITREPOS[@]}; do
|
||||
mkdir -p /srv/git/${repo}.git
|
||||
cd /srv/git/${repo}.git
|
||||
git init --bare
|
||||
done
|
||||
chown -R git:git /srv/git
|
||||
```
|
||||
|
||||
Das Array GITREPOS steuert die Anlage der Repos. Diese werden nur beim Aufsetzen der Umgebung angelegt. Im laufenden Betrieb ist das
|
||||
nicht möglich.
|
||||
|
||||
## Test mit weiterer NodeGroup
|
||||
|
||||
Möchte man etwas mit einer weiteren NodeGroup testen (wie z.b. nginx Ingress oder varnish), so kann man tatsächlich mit k3d einen weiteren Node simulieren:
|
||||
|
||||
```
|
||||
k3d node create -c develop --k3s-node-label node=ingress ingress
|
||||
|
||||
# -c develop - ist der Clustername, hier sollte develop schon richtig sein
|
||||
# --k3s-node-label node=ingress - der node wird mit dem Label node=ingess makiert und kann später damit explzit gewählt werden
|
||||
# ingress - so heißt diese Node Gruppe
|
||||
```
|
||||
|
||||
Damit der Scheduler den neuen Node nicht verwendet, muss dieser noch getainted werden:
|
||||
|
||||
```
|
||||
kubectl taint nodes k3d-ingress-0 node=ingress:NoSchedule
|
||||
|
||||
# Der interne Node Name wird anscheinend wie folgt zusammengebaut: k3d-NODEGROUPNAME-COUNTER
|
||||
# node=ingress:NoSchedule ist der taint
|
||||
```
|
||||
|
||||
Hier gibt es weiterführende Infos:
|
||||
|
||||
* [Taint and Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
|
||||
@@ -0,0 +1,34 @@
|
||||
# Lokale flux Entwicklungsumgebung
|
||||
|
||||
## Benötigte Tools
|
||||
|
||||
* Docker
|
||||
* [k3d](https://k3d.io/)
|
||||
* [sops](https://github.com/mozilla/sops)
|
||||
* [flux](https://github.com/fluxcd/flux2)
|
||||
|
||||
## Lokaler K8S
|
||||
|
||||
### Starten
|
||||
|
||||
```
|
||||
local-k8s/local-k8s.sh start
|
||||
```
|
||||
|
||||
### Stoppen bzw. löschen
|
||||
|
||||
```
|
||||
local-k8s/local-k8s.sh delete
|
||||
```
|
||||
|
||||
### Generieren der benötigen Keys
|
||||
|
||||
```
|
||||
local-k8s/local-k8s.sh generate
|
||||
```
|
||||
|
||||
### Löschen der Keys
|
||||
|
||||
```
|
||||
local-k8s/local-k8s.sh clean
|
||||
```
|
||||
Reference in New Issue
Block a user