Merge branch 'main' of https://github.com/rblundon/homelab

cluster/ingress-nginx/base/kustomization.yaml

@@ -6,9 +6,9 @@ commonAnnotations:
   argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 
 resources:
+- namespace.yaml
 # Operator deployment
 - subscription.yaml
 # Deploy cluster resources
 - scc.yaml
-- namespace.yaml
 - pvcs.yaml

cluster/ingress-nginx/overlays/internal/ingresscontroller-orig.yaml

@@ -0,0 +1,100 @@
+---
+kind: NginxIngress
+apiVersion: charts.nginx.org/v1alpha1
+metadata:
+  name: nginx
+  namespace: nginx-ingress
+spec:
+  routeSelector:
+    matchLabels:
+      type: nginx
+  controller:
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: nginx
+              app.kubernetes.io/name: nginx
+          topologyKey: kubernetes.io/hostname
+    config:
+      entries:
+        http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m
+          max_size=10g inactive=60m use_temp_path=off;
+        log-format-escaping: json
+        log-format: |-
+          {
+            "msec": "$msec",
+            "connection": "$connection",
+            "connection_requests": "$connection_requests",
+            "pid": "$pid",
+            "request_id": "$request_id",
+            "request_length": "$request_length",
+            "remote_addr": "$remote_addr",
+            "remote_user": "$remote_user",
+            "remote_port": "$remote_port",
+            "time_local": "$time_local",
+            "time_iso8601": "$time_iso8601",
+            "request": "$request",
+            "request_uri": "$request_uri",
+            "args": "$args",
+            "status": "$status",
+            "body_bytes_sent": "$body_bytes_sent",
+            "bytes_sent": "$bytes_sent",
+            "http_referer": "$http_referer",
+            "http_user_agent": "$http_user_agent",
+            "http_x_forwarded_for": "$http_x_forwarded_for",
+            "http_host": "$http_host",
+            "server_name": "$server_name",
+            "request_time": "$request_time",
+            "upstream": "$upstream_addr",
+            "upstream_connect_time": "$upstream_connect_time",
+            "upstream_header_time": "$upstream_header_time",
+            "upstream_response_time": "$upstream_response_time",
+            "upstream_response_length": "$upstream_response_length",
+            "upstream_cache_status": "$upstream_cache_status",
+            "ssl_protocol": "$ssl_protocol",
+            "ssl_cipher": "$ssl_cipher",
+            "scheme": "$scheme",
+            "request_method": "$request_method",
+            "server_protocol": "$server_protocol",
+            "pipe": "$pipe",
+            "gzip_ratio": "$gzip_ratio",
+            "http_cf_ray": "$http_cf_ray"
+          }
+    enableCustomResources: true
+    enableTLSPassthrough: true
+    enableSnippets: true
+    image:
+      pullPolicy: IfNotPresent
+      repository: nginx/nginx-ingress
+      tag: 5.1.0-ubi
+    ingressClass:
+      create: true
+      name: nginx
+      setAsDefaultIngress: false
+    initContainerResources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+    replicaCount: 2
+    reportIngressStatus:
+      annotations: {}
+      enable: true
+      enableLeaderElection: true
+      ingressLink: ''
+      leaderElectionLockName: nginx-ingress-leader
+    service:
+      externalTrafficPolicy: Local
+      loadBalancerIP: 10.1.82.0
+    prometheus:
+      create: true
+    serviceMonitor:
+      create: true
+    volumes:
+    - name: nginx-cache
+      persistentVolumeClaim:
+        claimName: nginx-cache
+    volumeMounts:
+    - name: nginx-cache
+      mountPath: /var/cache/nginx

cluster/ingress-nginx/overlays/internal/ingresscontroller.yaml

@@ -1,96 +1,175 @@
----
-kind: NginxIngress
 apiVersion: charts.nginx.org/v1alpha1
+kind: NginxIngress
 metadata:
   name: nginx
   namespace: nginx-ingress
 spec:
-  routeSelector:
-    matchLabels:
-      type: nginx
   controller:
-    affinity:
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchLabels:
-              app.kubernetes.io/instance: nginx
-              app.kubernetes.io/name: nginx
-          topologyKey: kubernetes.io/hostname
+    affinity: {}
+    annotations: {}
+    appprotect:
+      enable: false
+    appprotectdos:
+      debug: false
+      enable: false
+      maxDaemons: 0
+      maxWorkers: 0
+      memory: 0
+    autoscaling:
+      annotations: {}
+      behavior: {}
+      enabled: false
+      maxReplicas: 3
+      minReplicas: 1
+      targetCPUUtilizationPercentage: 50
+      targetMemoryUtilizationPercentage: 50
     config:
-      entries:
-        http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m
-          max_size=10g inactive=60m use_temp_path=off;
-        log-format-escaping: json
-        log-format: |-
-          {
-            "msec": "$msec",
-            "connection": "$connection",
-            "connection_requests": "$connection_requests",
-            "pid": "$pid",
-            "request_id": "$request_id",
-            "request_length": "$request_length",
-            "remote_addr": "$remote_addr",
-            "remote_user": "$remote_user",
-            "remote_port": "$remote_port",
-            "time_local": "$time_local",
-            "time_iso8601": "$time_iso8601",
-            "request": "$request",
-            "request_uri": "$request_uri",
-            "args": "$args",
-            "status": "$status",
-            "body_bytes_sent": "$body_bytes_sent",
-            "bytes_sent": "$bytes_sent",
-            "http_referer": "$http_referer",
-            "http_user_agent": "$http_user_agent",
-            "http_x_forwarded_for": "$http_x_forwarded_for",
-            "http_host": "$http_host",
-            "server_name": "$server_name",
-            "request_time": "$request_time",
-            "upstream": "$upstream_addr",
-            "upstream_connect_time": "$upstream_connect_time",
-            "upstream_header_time": "$upstream_header_time",
-            "upstream_response_time": "$upstream_response_time",
-            "upstream_response_length": "$upstream_response_length",
-            "upstream_cache_status": "$upstream_cache_status",
-            "ssl_protocol": "$ssl_protocol",
-            "ssl_cipher": "$ssl_cipher",
-            "scheme": "$scheme",
-            "request_method": "$request_method",
-            "server_protocol": "$server_protocol",
-            "pipe": "$pipe",
-            "gzip_ratio": "$gzip_ratio",
-            "http_cf_ray": "$http_cf_ray"
-          }
+      annotations: {}
+      entries: {}
+    containerPort:
+      http: 80
+      https: 443
+    customConfigMap: ''
+    customPorts: []
+    defaultHTTPListenerPort: 80
+    defaultHTTPSListenerPort: 443
+    defaultTLS:
+      cert: ''
+      key: ''
+      secret: ''
+    disableIPV6: false
+    dnsPolicy: ClusterFirst
+    enableCertManager: false
     enableCustomResources: true
-    enableTLSPassthrough: true
-    enableSnippets: true
+    enableExternalDNS: false
+    enableLatencyMetrics: false
+    enableOIDC: false
+    enableSSLDynamicReload: true
+    enableSnippets: false
+    enableTLSPassthrough: false
+    env: []
+    extraContainers: []
+    globalConfiguration:
+      create: false
+      spec: {}
+    healthStatus: false
+    healthStatusURI: /nginx-health
+    hostNetwork: false
+    hostPort:
+      enable: false
+      http: 80
+      https: 443
     image:
       pullPolicy: IfNotPresent
       repository: nginx/nginx-ingress
-      tag: 3.7.0-ubi
+      tag: 5.1.0-ubi
     ingressClass:
       create: true
       name: nginx
       setAsDefaultIngress: false
-    replicaCount: 2
+    initContainerResources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+    initContainers: []
+    lifecycle: {}
+    logFormat: glog
+    logLevel: info
+    mgmt:
+      licenseTokenSecretName: license-token
+    minReadySeconds: 0
+    name: controller
+    nginxDebug: false
+    nginxReloadTimeout: 60000
+    nginxStatus:
+      allowCidrs: 127.0.0.1
+      enable: true
+      port: 8080
+    nginxplus: false
+    pod:
+      annotations: {}
+      extraLabels: {}
+    podDisruptionBudget:
+      annotations: {}
+      enabled: false
+    readOnlyRootFilesystem: false
+    readyStatus:
+      enable: true
+      initialDelaySeconds: 0
+      port: 8081
+    replicaCount: 1
     reportIngressStatus:
       annotations: {}
       enable: true
       enableLeaderElection: true
       ingressLink: ''
-      leaderElectionLockName: ingress-leader
+      leaderElectionLockName: nginx-ingress-leader
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128Mi
+    selectorLabels: {}
     service:
+      annotations: {}
+      clusterIP: ''
+      create: true
+      customPorts: []
+      externalIPs: []
       externalTrafficPolicy: Local
-#      loadBalancerIP: 10.1.82.2
-    prometheus:
-      create: true
+      extraLabels: {}
+      httpPort:
+        enable: true
+        port: 80
+        targetPort: 80
+      httpsPort:
+        enable: true
+        port: 443
+        targetPort: 443
+      loadBalancerIP: 10.1.82.0
+      loadBalancerSourceRanges: []
+      type: LoadBalancer
+    serviceAccount:
+      annotations: {}
+      imagePullSecretName: ''
+      imagePullSecretsNames: []
+    shareProcessNamespace: false
+    strategy: {}
+    terminationGracePeriodSeconds: 30
+    tlsPassthroughPort: 443
+    tolerations: []
+    volumeMounts: []
+    volumes: []
+    watchNamespace: ''
+    watchNamespaceLabel: ''
+    watchSecretNamespace: ''
+    wildcardTLS:
+      cert: ''
+      key: ''
+      secret: ''
+    kind: deployment
+  nginxServiceMesh:
+    enable: false
+    enableEgress: false
+  prometheus:
+    create: true
+    port: 9113
+    scheme: http
+    secret: ''
+    service:
+      create: false
+      labels:
+        service: nginx-ingress-prometheus-service
     serviceMonitor:
-      create: true
-    volumes:
-    - name: nginx-cache
-      persistentVolumeClaim:
-        claimName: nginx-cache
-    volumeMounts:
-    - name: nginx-cache
-      mountPath: /var/cache/nginx
+      create: false
+      endpoints:
+        - port: prometheus
+      labels: {}
+      selectorMatchLabels:
+        service: nginx-ingress-prometheus-service
+  rbac:
+    create: true
+  serviceInsight:
+    create: false
+    port: 9114
+    scheme: http
+    secret: ''

cluster/metallb-operator-appset.yaml

@@ -0,0 +1,46 @@
+---
+
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: metallb-operator
+  namespace: openshift-gitops
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+  # - clusters: {} # Variable is .name
+  - list: # Variable is .cluster
+      elements:
+      - cluster: internal
+  template:
+    metadata:
+      name: '{{.cluster}}-metallb-operator'
+      annotations:
+        argocd.argoproj.io/sync-wave: "2"
+    spec:
+      destination:
+        name: '{{.cluster}}'
+        namespace: metallb-system
+      project: default
+      source:
+        path: cluster/metallb-operator/overlays/{{.cluster}}
+        repoURL: https://github.com/rblundon/homelab.git
+        targetRevision: HEAD
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - RespectIgnoreDifferences=true
+        - CreateNamespace=true
+        managedNamespaceMetadata:
+          labels:
+            argocd.argoproj.io/managed-by: argocd
+      ignoreDifferences:
+      - group: apps
+        kind: Deployment
+        jsonPointers:
+        - /spec/replicas

cluster/metallb-operator/base/bgp_advertisement.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: BGPAdvertisement
+metadata:
+  name: bgp-advert
+  namespace: metallb-system
+spec:
+  aggregationLength: 32
+  aggregationLengthV6: 128
+  ipAddressPools:
+    - bgp-ip-addresspool

cluster/metallb-operator/base/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- namespace.yaml
+- subscription.yaml
+- operatorgroup.yaml
+# Deploy cluster resources
+- metallb.yaml
+- bgp_advertisement.yaml

cluster/metallb-operator/base/metallb.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: MetalLB
+metadata:
+  name: metallb
+  namespace: metallb-system
+spec: {}

cluster/metallb-operator/base/namespace.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: metallb-system
+    name: metallb-system
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+    openshift.io/cluster-monitoring: 'true'
+  name: metallb-system
+spec:
+  finalizers:
+  - kubernetes

cluster/metallb-operator/base/operatorgroup.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: metallb-operator
+  namespace: metallb-system
+#spec:
+#  targetNamespaces:
+#    - metallb-system

cluster/metallb-operator/base/subscription.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: metallb-operator
+  namespace: metallb-system
+spec:
+  channel: stable
+  installPlanApproval: Automatic #Manual
+  name: metallb-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace

cluster/metallb-operator/overlays/external/bgp_peer.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: metallb.io/v1beta2
+kind: BGPPeer
+metadata:
+  name: bgp-peer-worlddrive
+  namespace: metallb-system
+spec:
+  disableMP: false
+  myASN: 65003
+  peerASN: 65002
+  peerAddress: 10.1.71.1
+  peerPort: 179

cluster/metallb-operator/overlays/external/ip_addresspool.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: bgp-ip-addresspool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.1.182.0/24
+  autoAssign: true
+  avoidBuggyIPs: false
+  

cluster/metallb-operator/overlays/internal/bgp_peer.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: metallb.io/v1beta2
+kind: BGPPeer
+metadata:
+  name: bgp-peer-worlddrive
+  namespace: metallb-system
+spec:
+  disableMP: false
+  myASN: 65001
+  peerASN: 65002
+  peerAddress: 10.1.71.1
+  peerPort: 179

cluster/metallb-operator/overlays/internal/ip_addresspool.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: bgp-ip-addresspool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.1.82.0/24
+  autoAssign: true
+  avoidBuggyIPs: false
+  

cluster/metallb-operator/overlays/internal/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../base
+- bgp_peer.yaml
+- ip_addresspool.yaml