athens-school/K3s-cluster
3
0
Fork 0
Code Issues 11 Pull Requests Packages Projects Releases Wiki Activity

feat(traefik): Move traefik to manifests

Browse Source 
Remove helm configuration in favor of manifests only configuration system
This commit is contained in:
Tanguy Herbron 2022-09-15 00:18:06 +02:00
parent cc08c4bbc9
commit 19cb94822f
8 changed files with 345 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
traefik/dashboard-hook-ingressroute.yaml Normal file
View File

@ -0,0 +1,22 @@
---
# Source: traefik/templates/dashboard-hook-ingressroute.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard
annotations:
helm.sh/hook: "post-install,post-upgrade"
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
spec:
entryPoints:
- traefik
routes:
- match: PathPrefix(`/dashboard`) || PathPrefix(`/api`)
kind: Rule
services:
- name: api@internal
kind: TraefikService

27
traefik/dashboard.yaml Normal file
View File

@ -0,0 +1,27 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: internal-ipwhitelist
spec:
ipWhiteList:
sourceRange:
- 10.10.0.1/24
- 10.20.0.1/24
- 10.42.1.1/24
ipStrategy:
depth: 0
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: traefik-dashboard
spec:
entryPoints:
- websecure
routes:
- kind: Rule
match: Host(`traefik.k3s.beta`)
services:
- name: api@internal
kind: TraefikService

151
traefik/deployment.yaml Normal file
View File

@ -0,0 +1,151 @@
---
# Source: traefik/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: traefik
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
annotations:
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: traefik
app.kubernetes.io/instance: traefik
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 1
minReadySeconds: 0
template:
metadata:
annotations:
prometheus.io/scrape: "true"
prometheus.io/path: "/metrics"
prometheus.io/port: "9100"
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
spec:
serviceAccountName: traefik
terminationGracePeriodSeconds: 60
hostNetwork: false
containers:
- image: "traefik:2.8.4"
imagePullPolicy: IfNotPresent
name: traefik
resources:
readinessProbe:
httpGet:
path: /ping
port: 9000
failureThreshold: 1
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
livenessProbe:
httpGet:
path: /ping
port: 9000
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
ports:
- name: "admin"
containerPort: 8080
protocol: "TCP"
- name: "metrics"
containerPort: 9100
protocol: "TCP"
- name: "minecrafttcp"
containerPort: 25565
protocol: "TCP"
- name: "traefik"
containerPort: 9000
protocol: "TCP"
- name: "web"
containerPort: 8000
protocol: "TCP"
- name: "websecure"
containerPort: 8443
protocol: "TCP"
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
volumeMounts:
- name: data
mountPath: /certs
- name: tmp
mountPath: /tmp
args:
- "--global.checknewversion"
- "--global.sendanonymoususage"
- "--entrypoints.admin.address=:8080/tcp"
- "--entrypoints.metrics.address=:9100/tcp"
- "--entrypoints.minecrafttcp.address=:25565/tcp"
- "--entrypoints.traefik.address=:9000/tcp"
- "--entrypoints.web.address=:8000/tcp"
- "--entrypoints.websecure.address=:8443/tcp"
- "--api.dashboard=true"
- "--ping=true"
- "--metrics.prometheus=true"
- "--metrics.prometheus.entrypoint=metrics"
- "--providers.kubernetescrd"
- "--providers.kubernetesingress"
- "--entrypoints.web.http.redirections.entryPoint.to=:443"
- "--entrypoints.web.http.redirections.entryPoint.scheme=https"
- "--log.level=DEBUG"
- "--entrypoints.websecure.http.tls=true"
- "--entrypoints.websecure.http.tls.certresolver=letsencrypt"
- "--entrypoints.websecure.http.tls.domains[0].main=beta.halia.dev"
- "--entrypoints.websecure.http.tls.domains[0].sans=*.beta.halia.dev"
- "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ovh"
- "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1"
- "--certificatesresolvers.letsencrypt.acme.email=tanguy.herbron@outlook.com"
- "--certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json"
env:
- name: OVH_APPLICATION_KEY
valueFrom:
secretKeyRef:
key: appKey
name: ovh-api-credentials
- name: OVH_APPLICATION_SECRET
valueFrom:
secretKeyRef:
key: appSecret
name: ovh-api-credentials
- name: OVH_CONSUMER_KEY
valueFrom:
secretKeyRef:
key: consumerKey
name: ovh-api-credentials
- name: OVH_ENDPOINT
valueFrom:
secretKeyRef:
key: endpoint
name: ovh-api-credentials
volumes:
- name: data
persistentVolumeClaim:
claimName: traefik
- name: tmp
emptyDir: {}
securityContext:
fsGroup: 65532

20
traefik/pvc.yaml Normal file
View File

@ -0,0 +1,20 @@
---
# Source: traefik/templates/pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: traefik
annotations:
helm.sh/resource-policy: keep
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "128Mi"
storageClassName: "local-path"

55
traefik/rbac/clusterrole.yaml Normal file
View File

@ -0,0 +1,55 @@
---
# Source: traefik/templates/rbac/clusterrole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: traefik
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
rules:
- apiGroups:
- ""
resources:
- services
- endpoints
- secrets
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- traefik.containo.us
resources:
- ingressroutes
- ingressroutetcps
- ingressrouteudps
- middlewares
- middlewaretcps
- tlsoptions
- tlsstores
- traefikservices
- serverstransports
verbs:
- get
- list
- watch

19
traefik/rbac/clusterrolebinding.yaml Normal file
View File

@ -0,0 +1,19 @@
---
# Source: traefik/templates/rbac/clusterrolebinding.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: traefik
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: traefik
subjects:
- kind: ServiceAccount
name: traefik
namespace: default

12
traefik/rbac/serviceaccount.yaml Normal file
View File

@ -0,0 +1,12 @@
---
# Source: traefik/templates/rbac/serviceaccount.yaml
kind: ServiceAccount
apiVersion: v1
metadata:
name: traefik
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
annotations:

39
traefik/service.yaml Normal file
View File

@ -0,0 +1,39 @@
---
# Source: traefik/templates/service.yaml
apiVersion: v1
kind: List
metadata:
name: traefik
items:
- apiVersion: v1
kind: Service
metadata:
name: traefik
labels:
app.kubernetes.io/name: traefik
helm.sh/chart: traefik-10.24.2
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/instance: traefik
annotations:
spec:
type: LoadBalancer
selector:
app.kubernetes.io/name: traefik
app.kubernetes.io/instance: traefik
ports:
- port: 8080
name: admin
targetPort: "admin"
protocol: TCP
- port: 25565
name: minecrafttcp
targetPort: "minecrafttcp"
protocol: TCP
- port: 80
name: web
targetPort: "web"
protocol: TCP
- port: 443
name: websecure
targetPort: "websecure"
protocol: TCP