athens-school/K3s-cluster
3
0
Fork 0
Code Issues 11 Pull Requests Packages Projects Releases Wiki Activity

docs(Network&Norm): Add networking documentation for ingress and naming norms

Browse Source
This commit is contained in:
Tanguy Herbron 2022-11-20 03:46:46 +01:00
parent 0a41373688
commit 19fd875927
1 changed files with 42 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
README.md
View File

@ -1,10 +1,8 @@
# K3s cluster # K3s cluster
/!\ CHECK PORT RULES FOR EXPOSING INTERNAL SERVICES
| Name | Usage | Accessibility | Host | DB type | Additional data | Backup configuration | Loki integration | Prometheus integration | Status | | Name | Usage | Accessibility | Host | DB type | Additional data | Backup configuration | Loki integration | Prometheus integration | Status |
|-------------------------|--------------------------------------|---------------|--------------|------------|----------------------|----------------------|------------------|------------------------|-----------------------------------| |-------------------------|--------------------------------------|------------------|-------------------------|------------|----------------------|----------------------|------------------|------------------------|-----------------------------------|
| Traefik | Reverse proxy and load balancer | Public* | Socrates | - | - | - | Configured | Configured | Completed<sup>5</sup> | | Traefik | Reverse proxy and load balancer | Public & Private | Socrates & Pythagoras-b | - | - | - | Configured | Configured | Completed<sup>5</sup> |
| Vaultwarden | Password manager | Public | Pythagoras-b | MariaDB | - | 4AM K8s CronJob | Configured | Not available | Completed | | Vaultwarden | Password manager | Public | Pythagoras-b | MariaDB | - | 4AM K8s CronJob | Configured | Not available | Completed |
| Gitlab | Version control system | Public | Pythagoras-b | PostgreSQL | User created content | 5AM internal CronJob | Configured | Configured | Completed<sup>4</sup> | | Gitlab | Version control system | Public | Pythagoras-b | PostgreSQL | User created content | 5AM internal CronJob | Configured | Configured | Completed<sup>4</sup> |
| Prometheus | Metrics aggregator | Private | Pythagoras-b | TBD | - | Not configured | Configured | Configured | Partial | | Prometheus | Metrics aggregator | Private | Pythagoras-b | TBD | - | Not configured | Configured | Configured | Partial |
@ -64,7 +62,7 @@ longhorn
- ~~Setup DB container sidecars for automated backups to Longhorn volume~~ - ~~Setup DB container sidecars for automated backups to Longhorn volume~~
- Setup secrets configuration through CI/CD variable injection - Setup secrets configuration through CI/CD variable injection
- Explore permission issues when issuing OVH API keys (not working for wildcard and `beta.halia.dev` subdomain) - Explore permission issues when issuing OVH API keys (not working for wildcard and `beta.halia.dev` subdomain)
- Setup default users for services - Setup default users for deployments
- ~~Setup log and metric monitoring~~ - ~~Setup log and metric monitoring~~
- ~~Define namespaces through yaml files~~ - ~~Define namespaces through yaml files~~
- ~~Look into CockroachDB for redundant database~~ Judged too complicated, moving to a 1 to 1 relationship between services and databases - ~~Look into CockroachDB for redundant database~~ Judged too complicated, moving to a 1 to 1 relationship between services and databases
@ -80,9 +78,6 @@ NOTE: For development, don't forget to also add the `cp` to the LB list, in orde
Setup OVH configuration Setup OVH configuration
`kubectl apply -f ovh-config.yaml` `kubectl apply -f ovh-config.yaml`
Install traefik
`kubectl apply -f traefik`
Install longhorn Install longhorn
``` ```
kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/master/deploy/longhorn.yaml kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/master/deploy/longhorn.yaml
@ -113,4 +108,20 @@ To only expose a service internally, the domain name should be *.k3s.beta
To split between external and internal services, two traefik ingresses are implemented through the `ingressclass` annotation. To split between external and internal services, two traefik ingresses are implemented through the `ingressclass` annotation.
`traefik-external` will only allow external access to a given service, while `traefik-internal` restrict to an internal only access. `traefik-external` will only allow external access to a given service, while `traefik-internal` restrict to an internal only access.
### Naming convention
As the project grows in size, all files must be renamed the following norm for easier readability and maintability :
```
{priority}-{optional-detail}-{service-name}.yaml
```
The priority here gives an execution order when applying files in bulk.
This means that, for example, to avoid the `namespace doesn't exist` error, the following order can be followed :
```
- 0-namespace.yaml
- 1-pvc.yaml
- 2-deployment.yaml
- 2-service.yaml
- 2-ingress.yaml
```
This also applies to directories, this behaviour can be seen in the `traefik` directory, where RBAC are prioritized before other files, as they are the first dependency.