shpaq/auricom-home-cluster
1
0
Fork 0
mirror of https://github.com/auricom/home-cluster.git synced 2025-09-17 18:24:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: cilium-gateway

Browse Source
This commit is contained in:
auricom
2025-08-18 21:57:45 +02:00
parent e04439b50e
commit 5b82fd7742
19 changed files with 591 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
kubernetes/apps/default/atuin/app/helmrelease.yaml
View File

@@ -68,31 +68,31 @@ spec:
ports:
http:
port: *port
# route:
# app:
# hostnames: ["sh.${SECRET_EXTERNAL_DOMAIN}"]
# parentRefs:
# - name: internal
# namespace: network
# sectionName: https
# rules:
# - backendRefs:
# - name: app
# port: *port
ingress:
route:
app:
enabled: true
className: internal
hosts:
- host: &host "sh.${SECRET_EXTERNAL_DOMAIN}"
paths:
- path: /
service:
identifier: app
port: http
tls:
- hosts:
- *host
hostnames: ["sh.${SECRET_EXTERNAL_DOMAIN}"]
parentRefs:
- name: internal
namespace: kube-system
sectionName: https
rules:
- backendRefs:
- name: app
port: *port
# ingress:
# app:
# enabled: true
# className: internal
# hosts:
# - host: &host "sh.${SECRET_EXTERNAL_DOMAIN}"
# paths:
# - path: /
# service:
# identifier: app
# port: http
# tls:
# - hosts:
# - *host
persistence:
config:
existingClaim: atuin

22
kubernetes/apps/kube-system/cilium/README.md Normal file
View File

@@ -0,0 +1,22 @@
# Cilium
## UniFi BGP
```sh
router bgp 64513
bgp router-id 192.168.1.1
no bgp ebgp-requires-policy
neighbor k8s peer-group
neighbor k8s remote-as 64514
neighbor 192.168.42.10 peer-group k8s
neighbor 192.168.42.11 peer-group k8s
neighbor 192.168.42.12 peer-group k8s
address-family ipv4 unicast
neighbor k8s next-hop-self
neighbor k8s soft-reconfiguration inbound
exit-address-family
exit
```

9
kubernetes/apps/kube-system/cilium/app/helm/values.yaml
View File

@@ -18,10 +18,13 @@ enableIPv4BIGTCP: true
endpointRoutes:
enabled: true
envoy:
enabled: false
rollOutPods: true
prometheus:
serviceMonitor:
enabled: true
gatewayAPI:
enabled: false
enableAlpn: false
enabled: true
enableAlpn: true
xffNumTrustedHops: 1
hubble:
enabled: false

35
kubernetes/apps/kube-system/cilium/gateway/external.yaml Normal file
View File

@@ -0,0 +1,35 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/gateway_v1.json
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: external
annotations:
external-dns.alpha.kubernetes.io/target: &hostname external.${SECRET_EXTERNAL_DOMAIN}
spec:
gatewayClassName: cilium
addresses:
- type: IPAddress
value: 192.168.169.122
infrastructure:
annotations:
external-dns.alpha.kubernetes.io/hostname: *hostname
listeners:
- name: http
protocol: HTTP
port: 80
hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
allowedRoutes:
namespaces:
from: Same
- name: https
protocol: HTTPS
port: 443
hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
allowedRoutes:
namespaces:
from: All
tls:
certificateRefs:
- kind: Secret
name: ${SECRET_EXTERNAL_DOMAIN//./-}-tls

7
kubernetes/apps/kube-system/cilium/gateway/gatewayclass.yaml Normal file
View File

@@ -0,0 +1,7 @@
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/gatewayclass_v1.json
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: cilium
spec:
controllerName: io.cilium/gateway-controller

35
kubernetes/apps/kube-system/cilium/gateway/internal.yaml Normal file
View File

@@ -0,0 +1,35 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/gateway_v1.json
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: internal
annotations:
external-dns.alpha.kubernetes.io/target: &hostname internal.${SECRET_EXTERNAL_DOMAIN}
spec:
gatewayClassName: cilium
addresses:
- type: IPAddress
value: 192.168.169.121
infrastructure:
annotations:
external-dns.alpha.kubernetes.io/hostname: *hostname
listeners:
- name: http
protocol: HTTP
port: 80
hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
allowedRoutes:
namespaces:
from: Same
- name: https
protocol: HTTPS
port: 443
hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
allowedRoutes:
namespaces:
from: All
tls:
certificateRefs:
- kind: Secret
name: ${SECRET_EXTERNAL_DOMAIN//./-}-tls

9
kubernetes/apps/kube-system/cilium/gateway/kustomization.yaml Normal file
View File

@@ -0,0 +1,9 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./external.yaml
- ./internal.yaml
- ./gatewayclass.yaml
- ./redirect.yaml

22
kubernetes/apps/kube-system/cilium/gateway/redirect.yaml Normal file
View File

@@ -0,0 +1,22 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/httproute_v1.json
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: httpsredirect
annotations:
external-dns.alpha.kubernetes.io/controller: none
spec:
parentRefs:
- name: internal
namespace: kube-system
sectionName: http
- name: external
namespace: kube-system
sectionName: http
rules:
- filters:
- requestRedirect:
scheme: https
statusCode: 301
type: RequestRedirect

23
kubernetes/apps/kube-system/cilium/ks.yaml
View File

@@ -11,7 +11,7 @@ spec:
app.kubernetes.io/name: *app
interval: 1h
path: ./kubernetes/apps/kube-system/cilium/app
prune: false
prune: true
retryInterval: 2m
sourceRef:
kind: GitRepository
@@ -20,3 +20,24 @@ spec:
targetNamespace: *namespace
timeout: 5m
wait: false
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app cilium-gateway
namespace: &namespace kube-system
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
interval: 1h
path: ./kubernetes/apps/kube-system/cilium/gateway
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: *namespace
timeout: 15m
wait: false

32
kubernetes/apps/kube-system/gateway-api-crds/app/helmrelease.yaml Normal file
View File

@@ -0,0 +1,32 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1.json
apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
name: gateway-api-crds
spec:
interval: 5m
layerSelector:
mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
operation: copy
ref:
tag: 1.3.0
url: oci://ghcr.io/wiremind/wiremind-helm-charts/gateway-api-crds
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: gateway-api-crds
spec:
interval: 1h
chartRef:
kind: OCIRepository
name: gateway-api-crds
install:
remediation:
retries: -1
upgrade:
cleanupOnFail: true
remediation:
retries: 3

6
kubernetes/apps/kube-system/gateway-api-crds/app/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./helmrelease.yaml

22
kubernetes/apps/kube-system/gateway-api-crds/ks.yaml Normal file
View File

@@ -0,0 +1,22 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app gateway-api-crds
namespace: &namespace kube-system
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
interval: 1h
path: ./kubernetes/apps/kube-system/gateway-api-crds/app
prune: true
retryInterval: 2m
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
targetNamespace: *namespace
timeout: 5m
wait: false

1
kubernetes/apps/kube-system/kustomization.yaml
View File

@@ -10,6 +10,7 @@ resources:
- ./coredns/ks.yaml
- ./descheduler/ks.yaml
- ./intel-device-plugin/ks.yaml
- ./gateway-api-crds/ks.yaml
- ./kubelet-csr-approver/ks.yaml
- ./metrics-server/ks.yaml
- ./node-feature-discovery/ks.yaml