athens-school/K3s-cluster
3
0
Fork 0
Code Issues 11 Pull Requests Packages Projects Releases Wiki Activity

docs(README): Update README to reflect latest updates

Browse Source
This commit is contained in:
Tanguy Herbron 2023-08-01 00:19:18 +02:00
parent 2154743b3b
commit eea09912d0
1 changed files with 55 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
README.md
View File

@ -1,26 +1,39 @@
# K3s cluster # K3s cluster
## CRDs
| Name | Description | Operator | Prometheus integration |
|--------------------------------------------------------------------------|-------------------------------|----------|------------------------|
| [Traefik](https://doc.traefik.io/traefik/providers/kubernetes-ingress/) | Kubernetes Ingress Controller | No | Configured |
| [Prometheus](https://github.com/prometheus-operator/prometheus-operator) | Metrics scraping | Yes | Configured |
| [ArgoCD](https://argo-cd.readthedocs.io/en/stable/) | Declarative GitOps CD | No | Configured |
| [Longhorn](https://longhorn.io/) | Distributed block storage | No | Not configured |
| [MetalLB](https://metallb.universe.tf/) | Vare metal load-balancer | No | Not configured |
| [CloudNativePG](https://cloudnative-pg.io/) | PostgreSQL operator | Yes | Not configured |
| [SOPS](https://github.com/isindir/sops-secrets-operator) | Secret management | Yes | Not configured |
## Services
| Name | Usage | Accessibility | Host | DB type | Additional data | Backup configuration | Loki integration | Prometheus integration | Secret management | Status | Standalone migration | | Name | Usage | Accessibility | Host | DB type | Additional data | Backup configuration | Loki integration | Prometheus integration | Secret management | Status | Standalone migration |
|-------------------------|--------------------------------------|------------------|-------------------------|------------|----------------------|----------------------|------------------|------------------------|------------------------|-----------------------------------|----------------------| |-------------------------|--------------------------------------|------------------|-------------------------|------------|----------------------|------------------------|------------------|------------------------|------------------------|-------------------------------|-----------------------|
| Traefik | Reverse proxy and load balancer | Public & Private | Socrates & Pythagoras-b | - | - | - | Configured | Configured | - | Completed<sup>5</sup> | Backbone | | Traefik | Reverse proxy and load balancer | Public & Private | Socrates & Pythagoras-b | - | - | - | Configured | Configured | - | Completed<sup>5</sup> | Backbone |
| ArgoCD | Declarative GitOPS CD | Private | Pythagoras-b | - | - | - | Configured | Configured | - | Completed | Backbone | | ArgoCD | Declarative GitOPS CD | Private | Pythagoras-b | - | - | - | Configured | Configured | - | Completed | Backbone |
| Vaultwarden | Password manager | Public | Pythagoras-b | PostgreSQL | - | 4AM K8s CronJob | Configured | Not available | Configured | Completed | Completed | | Vaultwarden | Password manager | Public | Pythagoras-b | PostgreSQL | - | - | Configured | Not available | Configured | Completed | Completed |
| Gitea | Version control system | Public | Pythagoras-b | PostgreSQL | User created content | Not configured | Configured | Not configured | Configured | Partial<sup>4</sup> | Awaiting | | Gitea | Version control system | Public | Pythagoras-b | PostgreSQL | User created content | Configured<sup>9</sup> | Configured | Configured | Configured | Completed<sup>4</sup> | Completed |
| Grafana | Graph visualizer | Public | Pythagoras-b | - | - | Not configured | Configured | Not configured | Configured | Partial | Awaiting | | Grafana | Graph visualizer | Public | Pythagoras-b | - | - | - | Configured | Configured | Configured | Completed | Completed<sup>8</sup> |
| Prometheus | Metrics aggregator | Private | Pythagoras-b | TBD | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | | Prometheus | Metrics aggregator | Private | Pythagoras-b | - | - | Configured<sup>9</sup> | Configured | Configured | - | Completed | Completed<sup>8</sup> |
| Loki | Log aggregator | Private | Pythagoras-b | TBD | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | | Loki | Log aggregator | Private | Pythagoras-b | _ | - | Configured<sup>9</sup> | Configured | Configured | - | Completed | Completed<sup>8</sup> |
| Adguard | DNS ad blocker and custom DNS server | Private | Socrates | - | - | - | Not configured | Not configured | Not configured | Pending configuration<sup>1</sup> | Awaiting | | Adguard | DNS ad blocker and custom DNS server | Private | Socrates | - | - | - | Configured | Configured | Configured | Completed | Completed |
| Synapse | Matrix server - Message centralizer | Public | Pythagoras-b | PostgreSQL | User medias | 4AM K8s CronJob | Configured | Not configured | Not configured | Pending configuration<sup>3</sup> | Awaiting | | Synapse | Matrix server - Message centralizer | Public | Pythagoras-b | PostgreSQL | User files | Configured<sup>9</sup> | Configured | Configured | Configured | Completed | Completed |
| Home assistant | Home automation and monitoring | Private | Pythagoras-a | MariaDB | - | Not configured | Not configured | Not configured | Not configured | Awaiting configuration | Awaiting | | Home assistant | Home automation and monitoring | Private | Pythagoras-a | PostgreSQL | Additional data | Configured<sup>9</sup> | Configured | Configured | Configured | Completed | Completed |
| Owncloud Infinity Scale | File hosting webUI | Public | Plato | ? | Drive files | Not configured | Configured | Not configured | Configured | Pending configuration | Awaiting |
| therbron.com | Personal website | Public | Socrates | - | - | - | Not configured | Not configured | - | Awaiting configuration | Awaiting | | therbron.com | Personal website | Public | Socrates | - | - | - | Not configured | Not configured | - | Awaiting configuration | Awaiting |
| Owncloud Infinity Scale | File hosting webUI | Public | Plato | ? | Drive files | Not configured | Configured | Not available | Not configured | Pending configuration<sup>2</sup> | Awaiting |
| Radarr | Movie collection manager | Private | Plato | PostgreSQL | - | - | Configured | Not configured | Not configured | Partial | Awaiting | | Radarr | Movie collection manager | Private | Plato | PostgreSQL | - | - | Configured | Not configured | Not configured | Partial | Awaiting |
| Flaresolverr | Cloudflare proxy | Private | Plato | - | - | - | - | - | - | Completed | Awaiting | | Flaresolverr | Cloudflare proxy | Private | Plato | - | - | - | - | - | - | Completed | Awaiting |
| Sonarr | TV shows collection manager | Private | Plato | SQLite | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting | | Sonarr | TV shows collection manager | Private | Plato | SQLite | - | Not configured | Configured | Not configured | Not configured | Partial | Awaiting |
| Prowlarr | Torrent indexer | Private | Plato | PostgreSQL | - | Not configured | Configured | Not available | Not configured | Partial | Awaiting | | Prowlarr | Torrent indexer | Private | Plato | PostgreSQL | - | Not configured | Configured | Not available | Not configured | Partial | Awaiting |
| Jellyfin | Media streaming | Public | Archimedes | SQLite** | - | - | Configured | Not configured | Configured<sup>6</sup> | Completed | Awaiting | | Jellyfin | Media streaming | Public | Archimedes | SQLite** | - | - | Configured | Not configured | Configured<sup>6</sup> | Completed | Awaiting |
| Jellyseerr | Media requesting WebUI | Public | Pythagoras-b | - | - | - | Not configured | Not available | Configured<sup>7</sup> | Awaiting configuration | Awaiting | | Jellyseerr | Media requesting WebUI | Public | Pythagoras-b | - | - | - | Not configured | Not available | Configured<sup>7</sup> | Awaiting configuration | Awaiting |
| Deluge | Torrent client | Private | Plato | - | <center> ? </center> | - | Not configured | Not configured | Not configured | Awaiting configuration | Awaiting |
| Minecraft | Vanilla minecraft server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Awaiting configuration | Awaiting | | Minecraft | Vanilla minecraft server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Awaiting configuration | Awaiting |
| Satisfactory | Satisfactory server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | | Satisfactory | Satisfactory server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting |
| Space engineers | Space engineers server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting | | Space engineers | Space engineers server for friends | Public | Archimedes | - | Game map | Not configured | Not configured | Not configured | - | Not needed for v1 | Awaiting |
@ -31,13 +44,12 @@
\* Configuration panel only available internally<br> \* Configuration panel only available internally<br>
** Current implementation only support SQLite, making manual backups a necessity<br> ** Current implementation only support SQLite, making manual backups a necessity<br>
<sup>1</sup> Missing automated configuration pipeline for environment variable injection<br> <sup>4</sup> Configuration completed, awaiting data migration from Gitlab<br>
<sup>2</sup> Missing configuration for NAS volume mounting (over network)<br>
<sup>3</sup> Missing Longhorn scheduling for saving media_store and secret management<br>
<sup>4</sup> Currently migrating from Gitlab installation<br>
<sup>5</sup> Missing dashboard configuration<br> <sup>5</sup> Missing dashboard configuration<br>
<sup>6</sup> Done through volume backup, because not possible otherwise<br> <sup>6</sup> Done through volume backup, because not possible otherwise<br>
<sup>7</sup> Done, but needs a reimplementation using kustomize for secret separation from configmap<br> <sup>7</sup> Done, but needs a reimplementation using kustomize for secret separation from configmap<br>
<sup>8</sup> Done but included in a grouped project `Monitoring`<br>
<sup>9</sup> Handled by Longhorn<br>
## Backup management ## Backup management
@ -63,10 +75,12 @@ longhorn
│ ... │ ...
``` ```
## TODO ## TODO
- Add AntiAffinities to `outsider` nodes - ~~Add AntiAffinities to `outsider` nodes~~
- Migrate Homeassistant to PostgreSQL instead of MariaDB - ~~Migrate Homeassistant to PostgreSQL instead of MariaDB~~
- ~~Move Prometheus connection management to ServiceMonitors instead of ConfigMap~~ - ~~Move Prometheus connection management to ServiceMonitors instead of ConfigMap~~
- Schedule longhorn S3 backups - Schedule longhorn S3 backups
- Schedule CloudNativePG S3 backups
- Restrict `metrics` endpoint on public services
- ~~Migrate Vaultwarden to PostgreSQL instead of MariaDB~~ - ~~Migrate Vaultwarden to PostgreSQL instead of MariaDB~~
- ~~Deploy PostgresQL cluster using operator for database HA and easy maintenance~~ - To be tested properly - ~~Deploy PostgresQL cluster using operator for database HA and easy maintenance~~ - To be tested properly
- Change host/deployment specific variables to use environment variables (using Kustomize) - Change host/deployment specific variables to use environment variables (using Kustomize)
@ -74,7 +88,8 @@ longhorn
- ~~Write CI/CD pipeline to deploy cluster~~ Done with ArgoCD - ~~Write CI/CD pipeline to deploy cluster~~ Done with ArgoCD
- ~~Setup internal traefik with nodeport as reverse proxy for internal only services~~ Done through double ingress class and LB - ~~Setup internal traefik with nodeport as reverse proxy for internal only services~~ Done through double ingress class and LB
- ~~Setup DB container sidecars for automated backups to Longhorn volume~~ - ~~Setup DB container sidecars for automated backups to Longhorn volume~~
- Setup secrets configuration through CI/CD variable injection (using Kustomize) - ~~Setup secrets configuration through CI/CD variable injection (using Kustomize)~~ Environment modified by SOPS implementation
- Figure out SOPS secret injection for absent namespaces
- Explore permission issues when issuing OVH API keys (not working for wildcard and `beta.halia.dev` subdomain) - Explore permission issues when issuing OVH API keys (not working for wildcard and `beta.halia.dev` subdomain)
- Setup default users for deployments - Setup default users for deployments
- ~~Setup log and metric monitoring~~ - ~~Setup log and metric monitoring~~
@ -98,6 +113,10 @@ Taint the outsider node to not be scheduled on unless actively setup
kubectl taint nodes outsider type=services:NoSchedule kubectl taint nodes outsider type=services:NoSchedule
``` ```
```
kubectl create -k monitoring/prometheus
```
DO NOT FORGET TO INSTALL THE SOPS PART DO NOT FORGET TO INSTALL THE SOPS PART
NOTE: It might be required to update the metallb IP range as well as traefik LoadBalancerIPs NOTE: It might be required to update the metallb IP range as well as traefik LoadBalancerIPs
@ -131,3 +150,4 @@ Secrets are decrypted on the fly when applied to the kluster using the SOPS Oper
Inject the AGE key in the cluster to allow the operator to decrypt secrets : Inject the AGE key in the cluster to allow the operator to decrypt secrets :
``` ```
kubectl create secret generic age-key --from-file=<path_to_file> -n sops kubectl create secret generic age-key --from-file=<path_to_file> -n sops
```