diff --git a/README.md b/README.md index 70eee39..96f86a5 100644 --- a/README.md +++ b/README.md @@ -1,43 +1,55 @@ # K3s cluster -| Name | Usage | Accessibility | Host | DB type | Additional data | Backup configuration | Loki integration | Prometheus integration | Secret management | Status | Standalone migration | -|-------------------------|--------------------------------------|------------------|-------------------------|------------|----------------------|----------------------|------------------|------------------------|------------------------|-----------------------------------|----------------------| -| Traefik | Reverse proxy and load balancer | Public & Private | Socrates & Pythagoras-b | - | - | - | Configured | Configured | - | Completed5 | Backbone | -| ArgoCD | Declarative GitOPS CD | Private | Pythagoras-b | - | - | - | Configured | Configured | - | Completed | Backbone | -| Vaultwarden | Password manager | Public | Pythagoras-b | PostgreSQL | - | 4AM K8s CronJob | Configured | Not available | Configured | Completed | Completed | -| Gitea | Version control system | Public | Pythagoras-b | PostgreSQL | User created content | Not configured | Configured | Not configured | Configured | Partial4 | Awaiting | -| Grafana | Graph visualizer | Public | Pythagoras-b | - | - | Not configured | Configured | Not configured | Configured | Partial | Awaiting | -| Prometheus | Metrics aggregator | Private | Pythagoras-b | TBD | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | -| Loki | Log aggregator | Private | Pythagoras-b | TBD | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | -| Adguard | DNS ad blocker and custom DNS server | Private | Socrates | - | - | - | Not configured | Not configured | Not configured | Pending configuration1 | Awaiting | -| Synapse | Matrix server - Message centralizer | Public | Pythagoras-b | PostgreSQL | User medias | 4AM K8s CronJob | Configured | Not configured | Not configured | Pending configuration3 | Awaiting | -| Home assistant | Home automation and monitoring | Private | Pythagoras-a | MariaDB | - | Not configured | Not configured | Not configured | Not configured | Awaiting configuration | Awaiting | -| therbron.com | Personal website | Public | Socrates | - | - | - | Not configured | Not configured | - | Awaiting configuration | Awaiting | -| Owncloud Infinity Scale | File hosting webUI | Public | Plato | ? | Drive files | Not configured | Configured | Not available | Not configured | Pending configuration2 | Awaiting | -| Radarr | Movie collection manager | Private | Plato | PostgreSQL | - | - | Configured | Not configured | Not configured | Partial | Awaiting | -| Flaresolverr | Cloudflare proxy | Private | Plato | - | - | - | - | - | - | Completed | Awaiting | -| Sonarr | TV shows collection manager | Private | Plato | SQLite | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | -| Prowlarr | Torrent indexer | Private | Plato | PostgreSQL | - | Not configured | Configured | Not available | Not configured | Partial | Awaiting | -| Jellyfin | Media streaming | Public | Archimedes | SQLite** | - | - | Configured | Not configured | Configured6 | Completed | Awaiting | -| Jellyseerr | Media requesting WebUI | Public | Pythagoras-b | - | - | - | Not configured | Not available | Configured7 | Awaiting configuration | Awaiting | -| Deluge | Torrent client | Private | Plato | - |
?
| - | Not configured | Not configured | Not configured | Awaiting configuration | Awaiting | -| Minecraft | Vanilla minecraft server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Awaiting configuration | Awaiting | -| Satisfactory | Satisfactory server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | -| Space engineers | Space engineers server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | -| Raspsnir | Bachelor memorial website | Public | Pythagoras-b | PostgreSQL | - | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | -| Vikunja | To-do and Kanban boards | Public | Pythagoras-b | - | - | - | Not configured | Not configured | - | Migrate to Gitea | Awaiting | -| Wiki | Documentation manager | Public | Pythagoras-b | - | - | - | Not configured | Not configured | - | Migrate to VuePress and Gitea | Awaiting | -| PaperlessNG | PDF viewer and organiser | Public | Pythagoras-b | PostgreSQL | - | - | Not configured | Not configured | - | Research migration into OCIS | Awaiting | +## CRDs + +| Name | Description | Operator | Prometheus integration | +|--------------------------------------------------------------------------|-------------------------------|----------|------------------------| +| [Traefik](https://doc.traefik.io/traefik/providers/kubernetes-ingress/) | Kubernetes Ingress Controller | No | Configured | +| [Prometheus](https://github.com/prometheus-operator/prometheus-operator) | Metrics scraping | Yes | Configured | +| [ArgoCD](https://argo-cd.readthedocs.io/en/stable/) | Declarative GitOps CD | No | Configured | +| [Longhorn](https://longhorn.io/) | Distributed block storage | No | Not configured | +| [MetalLB](https://metallb.universe.tf/) | Vare metal load-balancer | No | Not configured | +| [CloudNativePG](https://cloudnative-pg.io/) | PostgreSQL operator | Yes | Not configured | +| [SOPS](https://github.com/isindir/sops-secrets-operator) | Secret management | Yes | Not configured | + +## Services + +| Name | Usage | Accessibility | Host | DB type | Additional data | Backup configuration | Loki integration | Prometheus integration | Secret management | Status | Standalone migration | +|-------------------------|--------------------------------------|------------------|-------------------------|------------|----------------------|------------------------|------------------|------------------------|------------------------|-------------------------------|-----------------------| +| Traefik | Reverse proxy and load balancer | Public & Private | Socrates & Pythagoras-b | - | - | - | Configured | Configured | - | Completed5 | Backbone | +| ArgoCD | Declarative GitOPS CD | Private | Pythagoras-b | - | - | - | Configured | Configured | - | Completed | Backbone | +| Vaultwarden | Password manager | Public | Pythagoras-b | PostgreSQL | - | - | Configured | Not available | Configured | Completed | Completed | +| Gitea | Version control system | Public | Pythagoras-b | PostgreSQL | User created content | Configured9 | Configured | Configured | Configured | Completed4 | Completed | +| Grafana | Graph visualizer | Public | Pythagoras-b | - | - | - | Configured | Configured | Configured | Completed | Completed8 | +| Prometheus | Metrics aggregator | Private | Pythagoras-b | - | - | Configured9 | Configured | Configured | - | Completed | Completed8 | +| Loki | Log aggregator | Private | Pythagoras-b | _ | - | Configured9 | Configured | Configured | - | Completed | Completed8 | +| Adguard | DNS ad blocker and custom DNS server | Private | Socrates | - | - | - | Configured | Configured | Configured | Completed | Completed | +| Synapse | Matrix server - Message centralizer | Public | Pythagoras-b | PostgreSQL | User files | Configured9 | Configured | Configured | Configured | Completed | Completed | +| Home assistant | Home automation and monitoring | Private | Pythagoras-a | PostgreSQL | Additional data | Configured9 | Configured | Configured | Configured | Completed | Completed | +| Owncloud Infinity Scale | File hosting webUI | Public | Plato | ? | Drive files | Not configured | Configured | Not configured | Configured | Pending configuration | Awaiting | +| therbron.com | Personal website | Public | Socrates | - | - | - | Not configured | Not configured | - | Awaiting configuration | Awaiting | +| Radarr | Movie collection manager | Private | Plato | PostgreSQL | - | - | Configured | Not configured | Not configured | Partial | Awaiting | +| Flaresolverr | Cloudflare proxy | Private | Plato | - | - | - | - | - | - | Completed | Awaiting | +| Sonarr | TV shows collection manager | Private | Plato | SQLite | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | +| Prowlarr | Torrent indexer | Private | Plato | PostgreSQL | - | Not configured | Configured | Not available | Not configured | Partial | Awaiting | +| Jellyfin | Media streaming | Public | Archimedes | SQLite** | - | - | Configured | Not configured | Configured6 | Completed | Awaiting | +| Jellyseerr | Media requesting WebUI | Public | Pythagoras-b | - | - | - | Not configured | Not available | Configured7 | Awaiting configuration | Awaiting | +| Minecraft | Vanilla minecraft server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Awaiting configuration | Awaiting | +| Satisfactory | Satisfactory server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | +| Space engineers | Space engineers server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | +| Raspsnir | Bachelor memorial website | Public | Pythagoras-b | PostgreSQL | - | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | +| Vikunja | To-do and Kanban boards | Public | Pythagoras-b | - | - | - | Not configured | Not configured | - | Migrate to Gitea | Awaiting | +| Wiki | Documentation manager | Public | Pythagoras-b | - | - | - | Not configured | Not configured | - | Migrate to VuePress and Gitea | Awaiting | +| PaperlessNG | PDF viewer and organiser | Public | Pythagoras-b | PostgreSQL | - | - | Not configured | Not configured | - | Research migration into OCIS | Awaiting | \* Configuration panel only available internally
** Current implementation only support SQLite, making manual backups a necessity
-1 Missing automated configuration pipeline for environment variable injection
-2 Missing configuration for NAS volume mounting (over network)
-3 Missing Longhorn scheduling for saving media_store and secret management
-4 Currently migrating from Gitlab installation
+4 Configuration completed, awaiting data migration from Gitlab
5 Missing dashboard configuration
6 Done through volume backup, because not possible otherwise
7 Done, but needs a reimplementation using kustomize for secret separation from configmap
+8 Done but included in a grouped project `Monitoring`
+9 Handled by Longhorn
## Backup management @@ -63,10 +75,12 @@ longhorn │ ... ``` ## TODO -- Add AntiAffinities to `outsider` nodes -- Migrate Homeassistant to PostgreSQL instead of MariaDB +- ~~Add AntiAffinities to `outsider` nodes~~ +- ~~Migrate Homeassistant to PostgreSQL instead of MariaDB~~ - ~~Move Prometheus connection management to ServiceMonitors instead of ConfigMap~~ - Schedule longhorn S3 backups +- Schedule CloudNativePG S3 backups +- Restrict `metrics` endpoint on public services - ~~Migrate Vaultwarden to PostgreSQL instead of MariaDB~~ - ~~Deploy PostgresQL cluster using operator for database HA and easy maintenance~~ - To be tested properly - Change host/deployment specific variables to use environment variables (using Kustomize) @@ -74,7 +88,8 @@ longhorn - ~~Write CI/CD pipeline to deploy cluster~~ Done with ArgoCD - ~~Setup internal traefik with nodeport as reverse proxy for internal only services~~ Done through double ingress class and LB - ~~Setup DB container sidecars for automated backups to Longhorn volume~~ -- Setup secrets configuration through CI/CD variable injection (using Kustomize) +- ~~Setup secrets configuration through CI/CD variable injection (using Kustomize)~~ Environment modified by SOPS implementation +- Figure out SOPS secret injection for absent namespaces - Explore permission issues when issuing OVH API keys (not working for wildcard and `beta.halia.dev` subdomain) - Setup default users for deployments - ~~Setup log and metric monitoring~~ @@ -98,6 +113,10 @@ Taint the outsider node to not be scheduled on unless actively setup kubectl taint nodes outsider type=services:NoSchedule ``` +``` +kubectl create -k monitoring/prometheus +``` + DO NOT FORGET TO INSTALL THE SOPS PART NOTE: It might be required to update the metallb IP range as well as traefik LoadBalancerIPs @@ -131,3 +150,4 @@ Secrets are decrypted on the fly when applied to the kluster using the SOPS Oper Inject the AGE key in the cluster to allow the operator to decrypt secrets : ``` kubectl create secret generic age-key --from-file= -n sops +```