feat(traefik): Move traefik to manifests

Remove helm configuration in favor of manifests only configuration system

traefik/dashboard-hook-ingressroute.yaml

@@ -0,0 +1,22 @@
+---
+# Source: traefik/templates/dashboard-hook-ingressroute.yaml
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard
+  annotations:
+    helm.sh/hook: "post-install,post-upgrade"
+  labels:
+    app.kubernetes.io/name: traefik
+    helm.sh/chart: traefik-10.24.2
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: traefik
+spec:
+  entryPoints:
+    - traefik
+  routes:
+  - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService

traefik/dashboard.yaml

@@ -0,0 +1,27 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+    name: internal-ipwhitelist
+spec:
+    ipWhiteList:
+        sourceRange:
+            - 10.10.0.1/24
+            - 10.20.0.1/24
+            - 10.42.1.1/24
+        ipStrategy:
+            depth: 0
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+    name: traefik-dashboard
+spec:
+    entryPoints:
+        - websecure
+    routes:
+        - kind: Rule
+          match: Host(`traefik.k3s.beta`)
+          services:
+              - name: api@internal
+                kind: TraefikService

traefik/deployment.yaml

@@ -0,0 +1,151 @@
+---
+# Source: traefik/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    helm.sh/chart: traefik-10.24.2
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: traefik
+  annotations:
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+      app.kubernetes.io/instance: traefik
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+  minReadySeconds: 0
+  template: 
+    metadata:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "9100"
+      labels:
+        app.kubernetes.io/name: traefik
+        helm.sh/chart: traefik-10.24.2
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/instance: traefik
+    spec:
+      serviceAccountName: traefik
+      terminationGracePeriodSeconds: 60
+      hostNetwork: false
+      containers:
+      - image: "traefik:2.8.4"
+        imagePullPolicy: IfNotPresent
+        name: traefik
+        resources:
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 9000
+          failureThreshold: 1
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 2
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: 9000
+          failureThreshold: 3
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 2
+        ports:
+        - name: "admin"
+          containerPort: 8080
+          protocol: "TCP"
+        - name: "metrics"
+          containerPort: 9100
+          protocol: "TCP"
+        - name: "minecrafttcp"
+          containerPort: 25565
+          protocol: "TCP"
+        - name: "traefik"
+          containerPort: 9000
+          protocol: "TCP"
+        - name: "web"
+          containerPort: 8000
+          protocol: "TCP"
+        - name: "websecure"
+          containerPort: 8443
+          protocol: "TCP"
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+        volumeMounts:
+          - name: data
+            mountPath: /certs
+          - name: tmp
+            mountPath: /tmp
+        args:
+          - "--global.checknewversion"
+          - "--global.sendanonymoususage"
+          - "--entrypoints.admin.address=:8080/tcp"
+          - "--entrypoints.metrics.address=:9100/tcp"
+          - "--entrypoints.minecrafttcp.address=:25565/tcp"
+          - "--entrypoints.traefik.address=:9000/tcp"
+          - "--entrypoints.web.address=:8000/tcp"
+          - "--entrypoints.websecure.address=:8443/tcp"
+          - "--api.dashboard=true"
+          - "--ping=true"
+          - "--metrics.prometheus=true"
+          - "--metrics.prometheus.entrypoint=metrics"
+          - "--providers.kubernetescrd"
+          - "--providers.kubernetesingress"
+          - "--entrypoints.web.http.redirections.entryPoint.to=:443"
+          - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
+          - "--log.level=DEBUG"
+          - "--entrypoints.websecure.http.tls=true"
+          - "--entrypoints.websecure.http.tls.certresolver=letsencrypt"
+          - "--entrypoints.websecure.http.tls.domains[0].main=beta.halia.dev"
+          - "--entrypoints.websecure.http.tls.domains[0].sans=*.beta.halia.dev"
+          - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+          - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
+          - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ovh"
+          - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1"
+          - "--certificatesresolvers.letsencrypt.acme.email=tanguy.herbron@outlook.com"
+          - "--certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json"
+        env:
+          - name: OVH_APPLICATION_KEY
+            valueFrom:
+              secretKeyRef:
+                key: appKey
+                name: ovh-api-credentials
+          - name: OVH_APPLICATION_SECRET
+            valueFrom:
+              secretKeyRef:
+                key: appSecret
+                name: ovh-api-credentials
+          - name: OVH_CONSUMER_KEY
+            valueFrom:
+              secretKeyRef:
+                key: consumerKey
+                name: ovh-api-credentials
+          - name: OVH_ENDPOINT
+            valueFrom:
+              secretKeyRef:
+                key: endpoint
+                name: ovh-api-credentials
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: traefik
+        - name: tmp
+          emptyDir: {}
+      securityContext:
+        fsGroup: 65532

traefik/pvc.yaml

@@ -0,0 +1,20 @@
+---
+# Source: traefik/templates/pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik
+  annotations:
+    helm.sh/resource-policy: keep
+  labels:
+    app.kubernetes.io/name: traefik
+    helm.sh/chart: traefik-10.24.2
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: traefik
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "128Mi"
+  storageClassName: "local-path"

traefik/rbac/clusterrole.yaml

@@ -0,0 +1,55 @@
+---
+# Source: traefik/templates/rbac/clusterrole.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    helm.sh/chart: traefik-10.24.2
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: traefik
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - traefik.containo.us
+    resources:
+      - ingressroutes
+      - ingressroutetcps
+      - ingressrouteudps
+      - middlewares
+      - middlewaretcps
+      - tlsoptions
+      - tlsstores
+      - traefikservices
+      - serverstransports
+    verbs:
+      - get
+      - list
+      - watch

traefik/rbac/clusterrolebinding.yaml

@@ -0,0 +1,19 @@
+---
+# Source: traefik/templates/rbac/clusterrolebinding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    helm.sh/chart: traefik-10.24.2
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: traefik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: default

traefik/rbac/serviceaccount.yaml

@@ -0,0 +1,12 @@
+---
+# Source: traefik/templates/rbac/serviceaccount.yaml
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    helm.sh/chart: traefik-10.24.2
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/instance: traefik
+  annotations:

traefik/service.yaml

@@ -0,0 +1,39 @@
+---
+# Source: traefik/templates/service.yaml
+apiVersion: v1
+kind: List
+metadata:
+  name: traefik
+items:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: traefik
+      labels:
+        app.kubernetes.io/name: traefik
+        helm.sh/chart: traefik-10.24.2
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/instance: traefik
+      annotations:
+    spec:
+      type: LoadBalancer
+      selector:
+        app.kubernetes.io/name: traefik
+        app.kubernetes.io/instance: traefik
+      ports:
+      - port: 8080
+        name: admin
+        targetPort: "admin"
+        protocol: TCP
+      - port: 25565
+        name: minecrafttcp
+        targetPort: "minecrafttcp"
+        protocol: TCP
+      - port: 80
+        name: web
+        targetPort: "web"
+        protocol: TCP
+      - port: 443
+        name: websecure
+        targetPort: "websecure"
+        protocol: TCP