Create VM from clone delivered.

git-subtree-dir: acm-hub-bootstrap
git-subtree-split: 4b79b1a0be6da2a9efc9ace8871b4762342da70b

.gitignore

@@ -32,6 +32,7 @@ Temporary Items
 *.icloud
 
 # Terraform
+terraform/
 .terraform/
 *.tfstate
 *.tfstate.backup
@@ -46,3 +47,6 @@ crash.log
 # Ignore CLI configuration files
 .terraformrc
 .terraformrc.json
+
+# Ignore secrets
+doppler-token.yaml

10-sno-hub-cluster/03-openshift-image/templates/install-config.yaml.j2

@@ -1,25 +0,0 @@
-apiVersion: v1
-baseDomain: {{ hostvars[groups['hub-cluster'][0]].base_domain }}
-compute:
-- name: worker
-  replicas: {{ hostvars[groups['hub-cluster'][0]].worker_node_count }}
-controlPlane:
-  hyperthreading: Enabled
-  name: master
-  replicas: {{ hostvars[groups['hub-cluster'][0]].master_node_count }}
-metadata:
-  name: {{ hostvars[groups['hub-cluster'][0]].cluster_name }}
-networking:
-  clusterNetwork:
-  - cidr: {{ hostvars[groups['hub-cluster'][0]].cluster_network }}
-    hostPrefix: {{ hostvars[groups['hub-cluster'][0]].cluster_network_host_prefix }}
-  machineNetwork:
-  - cidr: {{ hostvars[groups['hub-cluster'][0]].machine_network }}
-  networkType: OVNKubernetes
-  serviceNetwork:
-  - {{ hostvars[groups['hub-cluster'][0]].service_network }}
-platform:
-  {{ hostvars[groups['hub-cluster'][0]].platform_type }}: {}
-fips: false
-pullSecret: '{{ vault_pull_secret }}'
-sshKey: '{{ vault_ssh_key }}'

10-sno-hub-cluster/README.md

@@ -1 +0,0 @@
-# Moved to other documentation

README.md

@@ -4,6 +4,12 @@ This repository is the configuration of my homelab. In addition to providing ser
 
 This implementation is built on easily accessible consumer based hardware and will focus heavily on GitOps practices and automation will be used wherever possible.
 
+This repo is a mono-repo that is broken up into three sections:
+
+- infra-config
+- apps
+- cluster
+
 ## Hardware
 
 - Dell 7050 SFF (7)
@@ -28,7 +34,7 @@ This implementation is built on easily accessible consumer based hardware and wi
 ## Prerequisites
 
 - Ansible user created
-- Ansible configured 
+- Ansible configured
 - [Networking](docs/networks.md)
 - [Proxmox](docs/proxmox.md) (In my homelab, internal DNS, identity manangement, and ipxe are hosted here.)
 - Matchbox
@@ -52,7 +58,7 @@ A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a H
 - Advanced Cluster Management
 - Ansible Automation Platform
 - Vault
-- OpenShift GitOps
+- ~~OpenShift GitOps~~
 
 #### Network Prerequisites
 
@@ -88,6 +94,7 @@ This makes it to where you just need 3 bare metal nodes. You could run one HCP B
 You'll also either need you just need at least 2 bare metal nodes.
 
 ---
+
 ## Credits
 
 - Ken Moini - As I used his [repo](https://github.com/kenmoini/ztp-for-you-and-me) as the baseline for this project.

cluster/acm/acm.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: acm
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "5"
+spec:
+  destination:
+    name: in-cluster
+    namespace: open-cluster-management
+  project: default
+  source:
+    path: cluster/acm
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: openshift-gitops
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas

cluster/acm/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- namespace.yaml

cluster/acm/multiclusterhub.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: operator.open-cluster-management.io/v1
+kind: MultiClusterHub
+metadata:
+  name: multiclusterhub
+  namespace: open-cluster-management
+spec:
+  imagePullSecret:
+    name: multiclusterhub-pull-secret

cluster/acm/namespace.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: open-cluster-management
+    name: open-cluster-management
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+  name: open-cluster-management
+spec:
+  finalizers:
+  - kubernetes

cluster/acm/operatorconfig.yaml

@@ -0,0 +1,25 @@
+apiVersion: operator.external-secrets.io/v1alpha1
+kind: OperatorConfig
+metadata:
+  name: cluster
+spec:
+  prometheus:
+    enabled: true
+    service:
+      port: 8080
+  resources:
+   requests:
+     cpu: 10m
+     memory: 96Mi
+   limits:
+     cpu: 100m
+     memory: 256Mi
+
+
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: open-cluster-management
+spec:
+  targetNamespaces:
+  - open-cluster-management

cluster/acm/subscription.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  labels:
+    operators.coreos.com/external-secrets-operator.openshift-operators: ''
+  name: acm-operator-subscription
+spec:
+  sourceNamespace: openshift-marketplace
+  source: redhat-operators
+  channel: release-1.0
+  installPlanApproval: Automatic
+  name: advanced-cluster-management

cluster/cert-manager.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  destination:
+    name: in-cluster
+    namespace: cert-manager
+  project: default
+  source:
+    #path: cluster/cert-manager/overlays/hub
+    path: cluster/cert-manager
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+    helm:
+      valueFiles:
+        - values-hub.yaml
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: openshift-gitops
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas

cluster/cert-manager/Chart.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v2
+name: cert-manager-umbrella
+description: A helm chart to include cert-manager with values
+type: application
+version: 0.1.0
+appVersion: 0.1.0
+
+dependencies:
+- name: cert-manager
+  version: v1.17.2
+  repository: https://charts.jetstack.io
+  alias: cert-manager
+  condition: cert-manager.enabled

cluster/cert-manager/templates/certs/api-server.yaml

@@ -0,0 +1,30 @@
+{{- if and .Values.le.prod.enabled .Values.le.apiCert.enabled -}}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ocp-api
+  namespace: openshift-config
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  dnsNames:
+  - api.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  secretName: ocp-api
+---
+apiVersion: config.openshift.io/v1
+kind: APIServer
+metadata:
+  name: cluster
+spec:
+  servingCerts:
+    namedCertificates:
+    - names:
+      - api.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+      servingCertificate:
+        name: ocp-api
+{{- end }}

cluster/cert-manager/templates/certs/router.yaml

@@ -0,0 +1,29 @@
+{{- if and .Values.le.prod.enabled .Values.le.routerCert.enabled -}}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: router-cert
+  namespace: openshift-ingress
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  commonName: apps.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+  dnsNames:
+  - apps.{{ .Values.cluster_name }}.{{ .Values.base_domain }}
+  - "*.apps.{{ .Values.cluster_name }}.{{ .Values.base_domain }}"
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  secretName: router-cert
+---
+apiVersion: operator.openshift.io/v1
+kind: IngressController
+metadata:
+  name: default
+  namespace: openshift-ingress-operator
+spec:
+  defaultCertificate:
+    name: router-cert
+{{- end }}

cluster/cert-manager/templates/cloudflare-secret-eso.yaml

@@ -0,0 +1,17 @@
+{{- if or .Values.le.prod.enabled .Values.le.staging.enabled }}
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token # This is the secret name
+  namespace: cert-manager
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  refreshInterval: "1h"
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: CLOUDFLARE_TOKEN
+{{- end }}

cluster/cert-manager/templates/clusterissuers.yaml

@@ -0,0 +1,69 @@
+{{- define "le.solvers" -}}
+{{- range $solver := .Values.le.solvers -}}
+{{- if eq $solver.type "dns" -}}
+- dns01:
+    {{- toYaml $solver.dnsConfig | nindent 4 }}
+  {{- with $solver.dnsZones }}
+  selector:
+    dnsZones:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- else if eq $solver.type "http" }}
+- http01:
+    ingress:
+      ingressClassName: {{ $solver.ingressClassName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if .Values.ca.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  ca:
+    secretName: cert-manager-ca
+{{- end }}
+{{- if .Values.le.prod.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: {{ .Values.le.email }}
+    {{- with .Values.le.preferredChain }}
+    preferredChain: {{ toYaml . }}
+    {{- end }}
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: {{ .Values.le.prod.server }}
+    solvers:
+    {{- include "le.solvers" . | nindent 4 }}
+{{- end }}
+{{- if .Values.le.staging.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: {{ .Values.le.email }}
+    {{- with .Values.le.preferredChain }}
+    preferredChain: {{ toYaml . }}
+    {{- end }}
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    server: {{ .Values.le.staging.server }}
+    solvers:
+    {{- include "le.solvers" . | nindent 4 }}
+{{- end }}

cluster/cert-manager/values-hub.yaml

@@ -0,0 +1,53 @@
+---
+# https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
+
+cert-manager:
+  enabled: true
+  installCRDs: true
+  dns01RecursiveNameservers: 1.1.1.1:53
+  dns01RecursiveNameserversOnly: true
+  livenessProbe:
+    enabled: true
+  prometheus:
+    enabled: true
+    servicemonitor:
+      enabled: true
+
+ca:
+  enabled: false
+  tlsCrt: |-
+    -----BEGIN CERTIFICATE-----
+    <actual certificate>
+    -----END CERTIFICATE-----
+  tlsKey: |-
+    -----BEGIN PRIVATE KEY-----
+    <actual key>
+    -----END PRIVATE KEY-----
+
+le:
+  prod:
+    enabled: true
+    server: https://acme-v02.api.letsencrypt.org/directory
+  staging:
+    enabled: true
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+  apiCert:
+    enabled: true
+  routerCert:
+    enabled: true
+  preferredChain: ""
+  email: ryan.blundon@protonmail.com
+  solvers:
+  - type: dns
+    dnsConfig:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+    dnsZones:
+    - mk-labs.cloud
+
+cluster_name: hub
+base_domain: int.mk-labs.cloud

cluster/external-secrets.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: openshift-gitops
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  destination:
+    name: in-cluster
+    namespace: openshift-operators
+  project: default
+  source:
+    #path: cluster/external-secrets
+    path: cluster/external-secrets/overlays/hub
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+    #helm:
+    #  valueFiles:
+    #    - values-hub.yaml
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: openshift-gitops
+  # ignoreDifferences:
+  # - group: apps
+  #   kind: Deployment
+  #   jsonPointers:
+  #   - /spec/replicas

cluster/external-secrets/base/cluster-secret-store.yaml

@@ -0,0 +1,13 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: doppler-cluster
+spec:
+  provider:
+    doppler:
+      auth:
+        secretRef:
+          dopplerToken:
+            name: doppler-cluster-token
+            key: dopplerToken
+            namespace: external-secrets

cluster/external-secrets/base/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- namespace.yaml
+- subscription.yaml
+- operatorconfig.yaml
+# Deploy cluster resources
+#- doppler-token.yaml
+- cluster-secret-store.yaml

cluster/external-secrets/base/namespace.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    argocd.argoproj.io/tracking-id: 'external-secrets:/Namespace:openshift-operators/external-secrets'
+  name: external-secrets
+  labels:
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+    kubernetes.io/metadata.name: external-secrets
+spec:
+  finalizers:
+  - kubernetes

cluster/external-secrets/base/operatorconfig.yaml

@@ -0,0 +1,16 @@
+apiVersion: operator.external-secrets.io/v1alpha1
+kind: OperatorConfig
+metadata:
+  name: cluster
+spec:
+  prometheus:
+    enabled: true
+    service:
+      port: 8080
+  resources:
+   requests:
+     cpu: 10m
+     memory: 96Mi
+   limits:
+     cpu: 100m
+     memory: 256Mi

cluster/external-secrets/base/subscription.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  labels:
+    operators.coreos.com/external-secrets-operator.openshift-operators: ''
+  name: external-secrets-operator
+  namespace: openshift-operators
+spec:
+  channel: stable
+  installPlanApproval: Automatic
+  name: external-secrets-operator
+  source: community-operators
+  sourceNamespace: openshift-marketplace

cluster/external-secrets/overlays/hub/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# - github.com/redhat-cop/gitops-catalog/external-secrets-operator/operator/overlays/stable
+# - github.com/redhat-cop/gitops-catalog/external-secrets-operator/instance/overlays/default
+- ../../base

cluster/nmstate.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nmstate
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  destination:
+    name: in-cluster
+    namespace: openshift-nmstate
+  project: default
+  source:
+    path: cluster/nmstate/overlays/hub
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: openshift-gitops
+  

cluster/nmstate/base/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- namespace.yaml
+- operatorgroup.yaml
+- subscription.yaml
+- nmstate.yaml
+- multinetwork-enable.yaml

cluster/nmstate/base/multinetwork-enable.yaml

@@ -0,0 +1,6 @@
+apiVersion: operator.openshift.io/v1
+kind: Network
+metadata:
+  name: cluster
+spec:
+  useMultiNetworkPolicy: true

cluster/nmstate/base/namespace.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: openshift-nmstate
+    name: openshift-nmstate
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+  name: openshift-nmstate
+spec:
+  finalizers:
+  - kubernetes

cluster/nmstate/base/nmstate.yaml

@@ -0,0 +1,5 @@
+apiVersion: nmstate.io/v1
+kind: NMState
+metadata:
+  name: nmstate
+spec: {}

cluster/nmstate/base/operatorgroup.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  annotations: {}
+#    olm.providedAPIs: NMState.v1.nmstate.io
+  name: openshift-nmstate
+  namespace: openshift-nmstate
+spec:
+  targetNamespaces:
+  - openshift-nmstate

cluster/nmstate/base/subscription.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  labels:
+    operators.coreos.com/kubernetes-nmstate-operator.openshift-nmstate: ""
+  name: kubernetes-nmstate-operator
+  namespace: openshift-nmstate
+spec:
+  channel: stable
+  installPlanApproval: Automatic
+  name: kubernetes-nmstate-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace

cluster/nmstate/overlays/hub/iscsi-nad.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  annotations:
+    description: Native VLAN connection for iSCSI
+  name: vlan121-localnet
+  namespace: default
+spec:
+  config: |-
+    {
+      "name": "iscsi-net",
+      "cniVersion": "0.3.1",
+      "type": "vlan",
+      "master": "enp1s0f0",
+      "mtu": 1500,
+      "vlanId": 121,
+      "linkInContainer": false,
+      "ipam": {
+        "type": "static",
+        "addresses": [
+          {
+            "address": "10.10.121.10/24"
+          }
+        ]
+      }
+    }
+
+    # {
+    #   "cniVersion": "0.3.1",
+    #   "name": "bridge-net",
+    #   "type": "bridge",
+    #   "isGateway": true,
+    #   "vlan": 2,
+    #   "ipam": {
+    #     "type": "dhcp"
+    #     }
+    # }

cluster/nmstate/overlays/hub/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../base
+- ocp-storage-vlan.yaml

cluster/nmstate/overlays/hub/ocp-storage-vlan.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: nmstate.io/v1
+kind: NodeNetworkConfigurationPolicy
+metadata:
+  name: storage-network-ocp-hub
+spec:
+  nodeSelector:
+    kubernetes.io/hostname: ocp-hub
+  desiredState:
+    interfaces:
+      - name: enp1s0f0.121
+        state: up
+        type: vlan
+        vlan:
+          base-iface: enp1s0f0
+          id: 121
+      - bridge:
+          port:
+            - name: enp1s0f0.121
+        ipv4:
+          address:
+            - ip: 10.10.121.10
+              prefix-length: 24
+          enabled: true
+        name: storage-network
+        state: up
+        type: linux-bridge
+        description: Linux bridge with enp1s0 as a port on VLAN 121

cluster/synology-storageclass.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: synology-storageclass
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+spec:
+  destination:
+    name: in-cluster
+    namespace: synology-csi
+  project: default
+  source:
+    path: cluster/synology-storageclass
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: openshift-gitops
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas

cluster/synology-storageclass/controller.yaml

@@ -0,0 +1,170 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: csi-controller-sa
+  namespace: synology-csi
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: synology-csi-controller-role
+rules:
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims/status"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["csinodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["csi.storage.k8s.io"]
+    resources: ["csinodeinfos"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments", "volumeattachments/status"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: synology-csi-controller-role
+  namespace: synology-csi
+subjects:
+  - kind: ServiceAccount
+    name: csi-controller-sa
+    namespace: synology-csi
+roleRef:
+  kind: ClusterRole
+  name: synology-csi-controller-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: synology-csi-controller
+  namespace: synology-csi
+spec:
+  serviceName: "synology-csi-controller"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: synology-csi-controller
+  template:
+    metadata:
+      labels:
+        app: synology-csi-controller
+    spec:
+      serviceAccountName: csi-controller-sa
+      hostNetwork: true
+      containers:
+        - name: csi-provisioner
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+            allowPrivilegeEscalation: true
+          image: registry.k8s.io/sig-storage/csi-provisioner:v3.0.0
+          args:
+            - --timeout=60s
+            - --csi-address=$(ADDRESS)
+            - --v=5
+            - --extra-create-metadata
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        - name: csi-attacher
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+            allowPrivilegeEscalation: true
+          image: registry.k8s.io/sig-storage/csi-attacher:v3.3.0
+          args:
+            - --v=5
+            - --csi-address=$(ADDRESS)
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        - name: csi-resizer
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+            allowPrivilegeEscalation: true
+          image: registry.k8s.io/sig-storage/csi-resizer:v1.3.0
+          args:
+            - --v=5
+            - --csi-address=$(ADDRESS)
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        - name: csi-plugin
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+            allowPrivilegeEscalation: true
+          image: synology/synology-csi:v1.2.0 #v1.1.3
+          args:
+            - --nodeid=NotUsed
+            - --endpoint=$(CSI_ENDPOINT)
+            - --client-info
+            - /etc/synology/client-info.yml
+            - --log-level=info
+          env:
+            - name: CSI_ENDPOINT
+              value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+            - name: client-info
+              mountPath: /etc/synology
+              readOnly: true
+      volumes:
+        - name: socket-dir
+          emptyDir: {}
+        - name: client-info
+          secret:
+            secretName: client-info-secret

cluster/synology-storageclass/csi-driver.yaml

@@ -0,0 +1,9 @@
+apiVersion: storage.k8s.io/v1
+kind: CSIDriver
+metadata:
+  name: csi.san.synology.com
+spec:
+  attachRequired: true # Indicates the driver requires an attach operation (TODO: ControllerPublishVolume should be implemented)
+  podInfoOnMount: true
+  volumeLifecycleModes:
+    - Persistent

cluster/synology-storageclass/enable-iscsi.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+metadata:
+  labels:
+    machineconfiguration.openshift.io/role: master
+  name: 99-master-custom-enable-iscsid
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: true
+        name: iscsid.service

cluster/synology-storageclass/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- namespace.yaml
+- synology-secret-eso.yaml
+- synology-csi-scc.yaml
+- controller.yaml
+- csi-driver.yaml
+- node.yaml
+- storage-class.yaml
+- snapshotter.yaml
+- volume-snapshot-class.yaml
+- enable-iscsi.yaml

cluster/synology-storageclass/namespace.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kubernetes.io/metadata.name: synology-csi
+    name: synology-csi
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+  name: synology-csi
+spec:
+  finalizers:
+  - kubernetes

cluster/synology-storageclass/node.yaml

@@ -0,0 +1,140 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: csi-node-sa
+  namespace: synology-csi
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: synology-csi-node-role
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "update"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes"]
+    verbs: ["get", "list", "watch", "update"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["volumeattachments"]
+    verbs: ["get", "list", "watch", "update"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: synology-csi-node-role
+  namespace: synology-csi
+subjects:
+  - kind: ServiceAccount
+    name: csi-node-sa
+    namespace: synology-csi
+roleRef:
+  kind: ClusterRole
+  name: synology-csi-node-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: synology-csi-node
+  namespace: synology-csi
+spec:
+  selector:
+    matchLabels:
+      app: synology-csi-node
+  template:
+    metadata:
+      labels:
+        app: synology-csi-node
+    spec:
+      serviceAccount: csi-node-sa
+      hostNetwork: true
+      containers:
+        - name: csi-driver-registrar
+          securityContext:
+            privileged: true
+          imagePullPolicy: Always
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.3.0
+          args:
+            - --v=5
+            - --csi-address=$(ADDRESS)                         # the csi socket path inside the pod
+            - --kubelet-registration-path=$(REGISTRATION_PATH) # the csi socket path on the host node
+          env:
+            - name: ADDRESS
+              value: /csi/csi.sock
+            - name: REGISTRATION_PATH
+              value: /var/lib/kubelet/plugins/csi.san.synology.com/csi.sock
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          volumeMounts:
+            - name: plugin-dir
+              mountPath: /csi
+            - name: registration-dir
+              mountPath: /registration
+        - name: csi-plugin
+          securityContext:
+            privileged: true
+          imagePullPolicy: Always #IfNotPresent
+          image: synology/synology-csi:v1.2.0 #v1.1.3
+          args:
+            - --nodeid=$(KUBE_NODE_NAME)
+            - --endpoint=$(CSI_ENDPOINT)
+            - --client-info
+            - /etc/synology/client-info.yml
+            - --log-level=info
+          env:
+            - name: CSI_ENDPOINT
+              value: unix://csi/csi.sock
+            - name: KUBE_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          volumeMounts:
+            - name: kubelet-dir
+              mountPath: /var/lib/kubelet
+              mountPropagation: "Bidirectional"
+            - name: plugin-dir
+              mountPath: /csi
+            - name: client-info
+              mountPath: /etc/synology
+              readOnly: true
+            - name: host-root
+              mountPath: /host
+            - name: device-dir
+              mountPath: /dev
+      volumes:
+        - name: kubelet-dir
+          hostPath:
+            path: /var/lib/kubelet
+            type: Directory
+        - name: plugin-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins/csi.san.synology.com/
+            type: DirectoryOrCreate
+        - name: registration-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins_registry
+            type: Directory
+        - name: client-info
+          secret:
+            secretName: client-info-secret
+        - name: host-root
+          hostPath:
+            path: /
+            type: Directory
+        - name: device-dir
+          hostPath:
+            path: /dev
+            type: Directory

cluster/synology-storageclass/snapshotter.yaml

@@ -0,0 +1,107 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: csi-snapshotter-sa
+  namespace: synology-csi
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: synology-csi-snapshotter-role
+rules:
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["list", "watch", "create", "update", "patch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotclasses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents"]
+    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshotcontents/status"]
+    verbs: ["update"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: synology-csi-snapshotter-role
+  namespace: synology-csi
+subjects:
+  - kind: ServiceAccount
+    name: csi-snapshotter-sa
+    namespace: synology-csi
+roleRef:
+  kind: ClusterRole
+  name: synology-csi-snapshotter-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+kind: StatefulSet
+apiVersion: apps/v1
+metadata:
+  name: synology-csi-snapshotter
+  namespace: synology-csi
+spec:
+  serviceName: "synology-csi-snapshotter"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: synology-csi-snapshotter
+  template:
+    metadata:
+      labels:
+        app: synology-csi-snapshotter
+    spec:
+      serviceAccountName: csi-snapshotter-sa
+      hostNetwork: true
+      containers:
+        - name: csi-snapshotter
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+            allowPrivilegeEscalation: true
+          image: registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1
+          args:
+            - --v=5
+            - --csi-address=$(ADDRESS)
+          env:
+            - name: ADDRESS
+              value: /var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+        - name: csi-plugin
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+            allowPrivilegeEscalation: true
+          image: synology/synology-csi:v1.1.3
+          args:
+            - --nodeid=NotUsed
+            - --endpoint=$(CSI_ENDPOINT)
+            - --client-info
+            - /etc/synology/client-info.yml
+            - --log-level=info
+          env:
+            - name: CSI_ENDPOINT
+              value: unix:///var/lib/csi/sockets/pluginproxy/csi.sock
+          imagePullPolicy: IfNotPresent
+          volumeMounts:
+            - name: socket-dir
+              mountPath: /var/lib/csi/sockets/pluginproxy/
+            - name: client-info
+              mountPath: /etc/synology
+              readOnly: true
+      volumes:
+        - name: socket-dir
+          emptyDir: {}
+        - name: client-info
+          secret:
+            secretName: client-info-secret

cluster/synology-storageclass/storage-class.yaml

@@ -0,0 +1,15 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: synology-iscsi-storage
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: csi.san.synology.com
+# if all params are empty, synology CSI will choose an available location to create volume
+parameters:
+  dsm: '10.10.121.35'
+  protocol: 'iscsi'
+  location: '/volume1'
+  csi.storage.k8s.io/fstype: 'ext4'
+reclaimPolicy: Delete #Retain
+allowVolumeExpansion: true

cluster/synology-storageclass/synology-csi-scc.yaml

@@ -0,0 +1,29 @@
+---
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: synology-csi-scc
+allowHostDirVolumePlugin: true
+allowHostNetwork: true
+allowPrivilegedContainer: true
+allowedCapabilities:
+- 'SYS_ADMIN'
+defaultAddCapabilities: []
+fsGroup:
+  type: RunAsAny
+groups: []
+priority:
+readOnlyRootFilesystem: false
+requiredDropCapabilities: []
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+users:
+- system:serviceaccount:synology-csi:csi-controller-sa
+- system:serviceaccount:synology-csi:csi-node-sa
+- system:serviceaccount:synology-csi:csi-snapshotter-sa
+volumes:
+- '*'

cluster/synology-storageclass/synology-secret-eso.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: client-info-secret
+  namespace: synology-csi
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  refreshInterval: "1h"
+  data:
+    - secretKey: client-info.yml
+      remoteRef:
+        key: SYNOLOGY_CLIENT_INFO

cluster/synology-storageclass/volume-snapshot-class.yaml

@@ -0,0 +1,11 @@
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: synology-snapshotclass
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+driver: csi.san.synology.com
+deletionPolicy: Delete
+# parameters:
+#   description: 'Kubernetes CSI' ＃ only for iscsi protocol
+#   is_locked: 'false'

cluster/temp/base/cloudflare-secret-eso.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token # This is the secret name
+  namespace: cert-manager
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  refreshInterval: "1h"
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: CLOUDFLARE_TOKEN

cluster/temp/base/clusterissuers.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: ryan.blundon@protonmail.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-issuer-account-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+      selector: 
+        dnsZones:
+          - 'mk-labs.cloud'
+          - 'monetnaildesign.com'
+
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: ryan.blundon@protonmail.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-issuer-account-key
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+      selector: 
+        dnsZones:
+          - 'mk-labs.cloud'
+          - 'monetnaildesign.com'

cluster/temp/base/kustomization.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- namespace.yaml
+- operatorgroup.yaml
+- subscription.yaml
+- monitoring.yaml
+# Deploy cluster resources
+# - cloudflare-secret-eso.yaml
+# - clusterissuers.yaml
+# - split-horizon-patch.yaml
+#- api-ingress.yaml

cluster/temp/base/monitoring.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: prometheus-k8s
+  namespace: cert-manager
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prometheus-k8s
+  namespace: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prometheus-k8s
+subjects:
+- kind: ServiceAccount
+  name: prometheus-k8s
+  namespace: openshift-monitoring
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  endpoints:
+  - interval: 30s
+    port: tcp-prometheus-servicemonitor
+    scheme: http
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: cert-manager

cluster/temp/base/namespace.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations: {}
+#    openshift.io/display-name: "cert-manager Operator for Red Hat OpenShift"
+  labels:
+    openshift.io/cluster-monitoring: 'true'
+  name: cert-manager-operator

cluster/temp/base/operatorgroup.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  targetNamespaces:
+    - cert-manager-operator

cluster/temp/base/split-horizon-patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: operator.openshift.io/v1alpha1
+kind: CertManager 
+metadata: 
+  name: cluster 
+spec: 
+  managementState: 'Managed'
+  unsupportedConfigOverrides: 
+    controller: 
+      args:
+        - "--dns01-recursive-nameservers=1.1.1.1:53" 
+        - "--dns01-recursive-nameservers-only"

cluster/temp/base/subscription.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  channel: stable-v1
+  installPlanApproval: Automatic
+  name: openshift-cert-manager-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace

cluster/temp/external-secrets-appset.yaml

@@ -0,0 +1,41 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: external-secrets
+  namespace: openshift-gitops
+spec:
+  generators:
+    - clusters: {} # Automatically use all clusters defined within Argo CD
+    # - list:
+    #     elements:
+    #       - cluster: dev
+    #         url: https://kubernetes-dev.example.com
+    #       - cluster: prod
+    #         url: https://kubernetes-prod.example.com
+  template:
+    metadata:
+      name: '{{cluster}}-external-secrets'
+    spec:
+      project: default
+      source:
+        repoURL: 'https://github.com/rblundon/homelab.git'
+        targetRevision: HEAD
+        path: 'cluster/external-secrets/overlays/{{cluster}}'
+      destination:
+        server: '{{url}}'
+        namespace: external-secrets
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - RespectIgnoreDifferences=true
+        - CreateNamespace=true
+        managedNamespaceMetadata:
+          labels:
+            argocd.argoproj.io/managed-by: openshift-gitops
+      ignoreDifferences:
+      - group: apps
+        kind: Deployment
+        jsonPointers:
+        - /spec/replicas

cluster/temp/overlays/hub/api-ingress.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  generation: 1
+  name: letsencrypt
+  namespace: openshift-ingress
+spec:
+  commonName: '*.apps.hub.int.mk-labs.cloud'
+  dnsNames:
+  - '*.apps.hub.int.mk-labs.cloud'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  renewBefore: 360h0m0s
+  secretName: letsencrypt
+  usages:
+  - server auth
+  - client auth
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  name: letsencrypt
+  namespace: openshift-config
+spec:
+  commonName: 'api.hub.int.mk-labs.cloud'
+  dnsNames:
+  - api.hub.int.mk-labs.cloud
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  renewBefore: 360h0m0s
+  secretName: letsencrypt
+  usages:
+  - server auth
+  - client auth

cluster/temp/overlays/hub/apiserver-cert-config.yaml

@@ -0,0 +1,11 @@
+apiVersion: config.openshift.io/v1
+kind: APIServer
+metadata:
+  name: cluster
+spec:
+  servingCerts:
+    namedCertificates:
+    - names:
+      - api.hub.int.mk-labs.cloud
+      servingCertificate:
+        name: letsencrypt

cluster/temp/overlays/hub/ingress-controller-cert-config.yaml

@@ -0,0 +1,8 @@
+apiVersion: operator.openshift.io/v1
+kind: IngressController
+metadata:
+  name: default
+  namespace: openshift-ingress-operator
+spec:
+  defaultCertificate:
+    name: letsencrypt

cluster/temp/overlays/hub/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../base
+#- api-ingress.yaml
+#- apiserver-cert-config.yaml
+#- ingress-controller-cert-config.yaml

dns-entry.yml

@@ -1,54 +0,0 @@
----
-# file: dns-entry.yml
-
-- name: Check if terraform directory exists
-  ansible.builtin.stat:
-    path: homelab/terraform/dns
-  register: terraform_dir
-
-- name: Create Terraform directory for DNS entries
-  ansible.builtin.file:
-    path: homelab/terraform/dns
-    state: directory
-    mode: '0755'
-  when: not terraform_dir.stat.exists
-
-- name: "Create/Update Terraform DNS provider"
-  ansible.builtin.template:
-    src: templates/dns_provider.tf.j2
-    dest: homelab/terraform/dns/provider.tf
-    mode: '0644'
-
-- name: Loop through all hosts
-  vars:
-    my_hosts: "{{ query('inventory_hostnames', 'all') }}"
-  # ansible.builtin.debug:
-  #   msg: "Host {{ item }} has IP address: {{ hostvars[my_hosts[my_idx]].ip_address | default('No IP address defined') }}"
-  ansible.builtin.template:
-    src: templates/dns.tf.j2
-    dest: homelab/terraform/dns/{{ item }}.tf
-    mode: '0644'
-  when: hostvars[my_hosts[my_idx]].ip_address is defined
-  loop: "{{ my_hosts }}"
-  loop_control:
-    index_var: my_idx
-
-# - name: Loop through all hosts
-#   block:
-#     - name: Create Terraform files for all eligible hosts
-#       when: "{{hostvars["{{ item }}"].ip_address}}" is defined
-#       ansible.builtin.template:
-#         src: templates/dns.tf.j2
-#         dest: homelab/terraform/dns/{{ item }}.tf
-#         mode: '0644'
-#   loop: "{{ query('inventory_hostnames', 'all') }}"
-
-# - name: Update DNS entries via Terraform
-#   community.general.terraform:
-#     project_path: homelab/terraform/dns/
-#     variables:
-#       freeipa_server: "{{ dns_server }}"
-#       freeipa_admin: "{{ dns_admin }}"
-#       freeipa_password: "{{ vault_freeipa_password }}"
-#     state: present
-#     force_init: true

group_vars/all/vars

@@ -1,7 +0,0 @@
----
-# file: group_vars/all
-
-# DNS variables
-dns_server: "infra01.int.mk-labs.cloud"
-dns_admin: "admin"
-base_domain: "int.mk-labs.cloud"

group_vars/all/vault

@@ -1,153 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-64343766343632623130366435613934363465653264663165616466303364306632633930326333
-6336663534313662373938666530363636313561343738340a366131323836633061316338313766
-32303032626135373264396638643031326264383637343162343432373731303530333565653761
-3735303536396366630a666136373437353038333664306665333938666262646566396430623664
-32343163643863326566303635653032346266656538653034383266663566343064313261396561
-66313062333630656564653339353065666462626330653738353333623038623836653462633538
-61323235303339363836306434643033346234626238626136366534636463303163633130663533
-64646562346566386365336466346434656138306665623833313933383939323438393935623937
-33636131386430383861663363386532396664383239643133663738363635353736303262326462
-65613038353731363337633935623662666361646364653534643561306561623535663232366134
-33353466666561376262623062613563363662363461306434656361666233303763313732353466
-66616532613262313531363361343963343062396463396130356436666331323036383135663638
-36303364323436653730386365656332346164656139383436653836613066353334383335633661
-30393761363738626438393761623435326139343034306632653039666336633566653863653264
-35653734646466316564343036646237346534333139643735306636626664646361633035623362
-63376439656664323564363765386630613662393735633162316135653735636231633730346132
-61653930343238393262623439326635636630626234326338333163353139303833336339333361
-39376165343064383032313533636165613261623735646432313131363035626539653038616436
-39643737363238353536386236316434363066626164633837333264386163393831646439343631
-31363365333736353965393132363535613363663138643432386633653764383738346431626133
-63633864613533366536633130316662333761366330313535333363653038623763316561353264
-65663033636134343833656336633762353364306537303837343939373066616430376565393137
-62383030323563363236343765383235626139393137626663353537613037663539316565663662
-37373165636630633664303362386331633662303136653132356234383435376665636430303937
-38396639653363643839376166653436636435326464613939353439316463613462343631663565
-66346466376332366135323932656265353234393735346132333932306537353862356436346133
-65663637396662623665653334313464353339303362396139366639383866353061383062303337
-63633863366432383435363866613939323433613164323132376436323236353335353337646663
-64303338323830386337636463663738376566616630633663383165313332643438323137326565
-34333035616533393961653531323466303032383765303065323464373130663839343661633063
-39353761396430313035376365653031396232316464343662323734386538326431653065646331
-63336465386261326338646632363565623132663264623832303565346261663531393463396239
-36326236383231363530383566393937616636666335626364623239396463346566643066343736
-62396632383839346463613735613730373762383435343065306562356462383630383962653139
-63323739306437313065663139303037363365656365343038633466346339353437393439393166
-37333033623531313333666363353230323339666232393936663331666433386238383532343634
-61613531646438363466626565373033356365343931636265303633666539306639303237373130
-38656239343065643830623739343236343062356162663165656537636238653265643039643834
-63353039656362373365646466626135353438663865643861313238633539336666323535343637
-61666533356533626563346664333338373832396162363534393130613561663335323134653030
-62333038616235383637313736353264346233303437303632393933376463343133396638613366
-34366165336339313932633866623663353736373965303666653334383239326362633836636437
-30313564353835343564356334353862373761643861336536326338623334656539663934323865
-61303430316265663464316330643032313732353763393165636133616232386635363333346164
-65393864623939343430343435386638333735363838646530633036396530666233303231653366
-31316333343530323962383430616336323638623735616431323366303132613533373937376135
-63326431653832356137656535393763646134666239376164346330633637613631303236333632
-35616266616431383333656530663838346238616331363635326532396566386461353362353035
-63633138666561653063333566373637623433643666346534313938666361376431396234666265
-33323563323139326333396633383537623564333636626461633333623264626363303161346139
-32616432663737303764353366323766333665326561343463373339346331366338326432613230
-33653165343835393564373334306631363334646462656665643631303539303065346638653031
-64343862373665363231353464373639356139373338373639656161646135393665373738303866
-65353262623536366636316137336633383434306463656336643233363837376238386166663438
-38393762353962353365366333623336336631353133636238313238616234333564313530383036
-66343964353564303434316137653261613635313430656335316534633339373964383765623865
-34333930343033373234326561333432336165306533313237343866363330393334616130366336
-34316330336165393034336135633465313566346265616238656362363762356664643564313132
-39326434303163656166373965373338383439616132303065333762326465376136653562663339
-32373063313837643339323062323361643766376366386563386431353563363736323933356333
-33633737336239316164653533626231393037343664616536393039356332363338303765653833
-65363134646238356534653037383631303866633234313331383066666233336262303062383064
-30366362663736353632393032363030653537666162356230343261623463353439623538613863
-35623564353465313335373763373538333537333938363536646231396132646364383135343534
-34323635346663383361616664306530353038653436376638656464386334626238356239363231
-32393365376462323035366432326165366138646163343734646136623033376134643737666635
-35663962653662353039623737353466306662323664643430373835313832666363346133366261
-32386435633366613337333933326564623230663631373964663832633662616239373262366264
-62663164636263646538653037646136353433383937393434313362656262356532613331383232
-36646361326332666634383435373632613231316165326637333439633638323265373437336461
-64313163326364306236613162653036646163383164646237623938333934343366643930666530
-36633763663730386432653461613833376462336162343334346435323537633537633161363464
-62313136346362323433623137323935366235393334336139363731336332303362643664373038
-66366437353332313464656131396434663132656531363762663432373632306332653163633765
-36663165656562383063333538393261323062336662346539623335643463336437636334396661
-62656163356530333534313539356436323733393663313265656431613130613137306530643538
-32393362623237393764313930646661636565363331643431303533323838323030366562376231
-62636536363733623536346339356634303236656531393737333834396231386637353638666638
-62323964666530313361333666326238626439323834393434633831316466623938653431396434
-37326136396134326162383331656563346339623032646565336262636632636433313439383264
-34336432393761613938623839396138376533326663656161393331383461353234626637343633
-65633765363064663636363031653636313034636563326565353931656633626236333037633261
-30666633306133386536343133383538636336353261376531626566383134613966343766386232
-30386464343731626634626234386633343462366434303763383733386263396361353132343339
-62636130346262336637643934643838333762623931323230333137366363333062343763393762
-35616630333138383034386232626532636532623962636534353130323732613937323231313637
-39323837396133366363366261326232656464356338336362336163333362313661303433356562
-64353431333761376237343062333266343664386439663964333538653134663237396538333031
-61323031376235363137623364393735383337383661333762343561373433376137373234613938
-64633531656230333465303666643034346236373532306139323466383134636361613262636162
-31336135636237393565313334666230646630376462393937393565333531643735616432306665
-66313361313835363333373562333764353236653331666431363838653565613562343437353432
-34653933363131323932363333336466346631303036613134323063376364363763313730646465
-37663637613866623432316165616463613739336632646332386532313438363766656566373430
-64383930373333396135663662646230656565613161616238306338376332653362353430646637
-61666636363332343733613263343030613164393237616238363562373938383865643031343032
-37613238353935366638363564643461326330383339343431396434643430643434383365383162
-66643535353565333838636265386365666261656637633133633164616566323061363837323364
-65653037386133393039353062313630353065653436666333613637376534653665633261623239
-66616134613766353264353864323464396364653838363363393036343132633630393132343631
-35656434643631323630343230323537653334663135393439356263666237333662373631323538
-31653839336436636130653035373061323038623339623336313935373530646331346131663838
-32313835376566366464656634633261353562323566383330386336396335653731636636343062
-66623533663539326461393739663063343666636239633839643330356537346231653034353934
-63396662363133386635666232333535373038333632656336633736393733643566393462663631
-64353137653032653263366266623531323633346661343561306161643334633237633532353434
-36373532383532373936383532633936616436623135653263613338393232623739363132666166
-37343337333561346331313336396331346666653138666262356434646536313731613938616634
-34626466333630653765343665653465643933306533626634333635336565646236613633366532
-36313539373736383834373833373836316137313639336231386662663836303861353465306639
-32303035303832666564653032636339663830333930313630316536333966366536653133656338
-32666432663064376436653865366138353337393665616562356434663031626138386334633661
-62393565303164343965313166646361356262353063623134333936313963316139636432383738
-34663736306663373666623538633732663630646136333135663433356336666635306132343032
-64333565396635346337303663383865323262636365356537376465656631613462326264643835
-37333933363339323836346338623562323737356535323762356235363964383265333836343761
-65666465306539666437386436666262663163393639663662393363306237356630616630363863
-39363338366365366430333730323133396633366136353039306437383162313131656563623664
-39343639663037323535363437623936336235353237356164316161343364383736373630626335
-37333539633064323232373330366239636631306264353661343861333530366439366131643936
-32643132616537643339653730303835623235636561316261396238353463643133313263383463
-63323332393939303564656436326238386266366464373038376263633135303164383261376235
-61323830386537323762393134666163663064613330636235383837623436353339336561633732
-38363130633338666334383864383935326131376566313133313166333639653338653037393139
-31626138643339643137613864633662303162343166643039623062663338346561633430643065
-62316535373631353665323938646464623863323632346463336430663031393435333463303930
-36363434306135313332623839313138353132323266636163333661383634306434306164363735
-32333632343265313831323235363764343061363537323963646430333031363534353065303063
-63303265383234303335383638343438323636323235663230313762313566663833333866383134
-62663061383464616565626635313732343335356536633932323639306661663430336230353064
-36393066633330633438353431373761653761373439353463346163646232653865366533396462
-39306462383862646436353339313734333463336530326433326634336264313034343431353037
-65393461616361666462366234666563393234633862616532323966346662643533393832626133
-34313435626264376334313066333638376562666633356231613037303536343431623666643937
-63326330303830356436393131376331393732636161306633643630663836306266343766306332
-63656331353438643636623763323866376435616161633734613532636663653939333434356333
-66613162616664373561666232313036323733353535343238393665636433326234653163663834
-31616336653664316337393762626463353065643837303737313336656264613230663430636466
-31326537306662373062303761623261363766643665393835613733646161623361356132353265
-30366336616463386334643966633633643261333833636130353362643233666339303235356366
-34626564633062363336383431376631343836366561653634396638326262323062303237336566
-64643365636232633338643035353030326130643164303231363537646465353562363938626265
-64393464333330333635313338666565366138643866663966643362633237366634643465353366
-31646262623865366664646662613931343963343364323234613935373362316539633430353535
-30386531343932373537376137373335313965313763623333303935643965633338373530626661
-34353439626664383639623665336135623234336435653261316635646364366233383034346533
-66633736613636396336323665666431346135346336656538623361336236653262653063386562
-64373634643065663765313331353438313139386333313263643639633861663431313833653263
-61363930386632663937663863333561363533363434346132396366626234306136646161653935
-61336362313439336439356663666264343935313137653264336539386262666536333930356235
-39323263623461373336336364666466336631643738333731366230616232323737353164356361
-61346530373561383864

host_vars/pve01/vars

@@ -1,6 +0,0 @@
----
-# file: host_vars/pve01/vars
-# mac_address: "98:b7:85:1e:c6:f1"
-ip_address: "10.1.71.51"
-hostname: "pve01.{{ base_domain }}"
-# primary_interface: "enp1s0f0"

hub-cluster-bootstrap/app-of-apps.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-applications
+  namespace: openshift-gitops
+spec:
+  destination:
+    name: in-cluster
+    namespace: openshift-gitops
+  project: default
+  source:
+    path: cluster
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - RespectIgnoreDifferences=true
+  ignoreDifferences:
+    - group: argoproj.io
+      kind: Application
+      jsonPointers:
+        - /spec/syncPolicy/automated

hub-cluster-bootstrap/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonLabels:
+  cluster: hub.int.mk-labs.cloud
+
+resources:
+- namespace.yaml
+- operatorgroup.yaml
+- subscription.yaml
+- rbac.yaml
+# - argocd.yaml
+- app-of-apps.yaml
+#- enable-iscsi.yaml

hub-cluster-bootstrap/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+  name: openshift-gitops-operator

hub-cluster-bootstrap/operatorgroup.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: openshift-gitops-operator
+  namespace: openshift-gitops-operator
+spec:
+  upgradeStrategy: Default

hub-cluster-bootstrap/rbac.yaml

@@ -0,0 +1,37 @@
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: openshift-gitops-admin
+subjects:
+  - kind: ServiceAccount
+    name: gitops-service-cluster
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-applicationset-controller
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-application-controller
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-dex-server
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-grafana
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-redis
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-redis-ha
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-server
+    namespace: openshift-gitops
+  - kind: ServiceAccount
+    name: openshift-gitops-operator-controller-manager
+    namespace: openshift-operators
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin

hub-cluster-bootstrap/subscription.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-gitops-operator
+  namespace: openshift-gitops-operator
+spec:
+  channel: gitops-1.16
+  config:
+    env:
+    - name: ARGOCD_CLUSTER_CONFIG_NAMESPACES
+      value: openshift-gitops
+  installPlanApproval: Automatic
+  name: openshift-gitops-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace

infra-config/03-infra01-server/install.yml

@@ -2,13 +2,11 @@
 - name: Install all software on infra01
   hosts: infra01
   gather_facts: true
-  become: true
+  #become: true
 
   tasks:
   # - Update all packages
-  # - Install ansible-core
   # - Copy .vault_pass.txt from laptop and set env variable
-  # - Clone git repo
   # - Install ansible required packages
 
     - name: Install ansible-core
@@ -23,12 +21,31 @@
         state: present
       become: true
 
+    - name: Install git
+      ansible.builtin.package:
+        name: git
+        state: present
+      become: true
+
+    - name: Register status of git repo
+      ansible.builtin.stat:
+        path: homelab/.git
+      register: git_status
+
+    - name: Clone GitHub repository
+      when: not git_status.stat.exists
+      block:
+        - name: First run, cloning the repo
+          ansible.builtin.git:
+            repo: https://github.com/rblundon/homelab.git
+            dest: homelab
+
     - name: Register status of /usr/local/bin/terraform
       ansible.builtin.stat:
         path: /usr/local/bin/terraform
       register: terraform_path
 
-    - name: Download and installt erraform version
+    - name: Download and install terraform version
       when: not terraform_path.stat.exists
       block:
         - name: Download  and install terraform
@@ -38,6 +55,7 @@
             remote_src: true
             mode: '0755'
             exclude: "LICENSE.txt"
+          become: true
 
   roles:
     - somaz94.ansible_k8s_iac_tool.install_kustomize

infra-config/04-vm-templates/README.md

@@ -0,0 +1,34 @@
+# Steps for creating VM templates with Hashicorp Packer
+
+As this is one of the early steps, the assumption is made that these commands will be run on a jumpbox/laptop.
+
+Templates will always live on <template-node> within the cluster.
+
+Steps to install Packer:
+
+```bash
+brew tap hashicorp/tap
+brew install hashicorp/tap/packer
+```
+
+fedora-<version>/
+├── fedora-<version>.pkr.hcl # Main build definition(s)
+├── variables.pkr.hcl        # Variable declarations and default values
+├── <image_name>.pkrvars.hcl # (Optional) Specific variable values for a particular image
+├── files/                   # Files to load on VM
+│   └── ansible.pub         # public key for ansible user
+├── scripts/                 # Directory for shell scripts
+│   ├── cleanup.sh          # Clean up the template
+│   └── setup.yml           # Ansible playbook
+├── httpd/                   # Subdirectory for kickstart configiration
+│   └── ks.cfg              # Source block for Apache image
+└── README.md
+
+# Create templates
+
+```bash
+packer build -var-file ./fedora-42-small.pkrvars.hcl -var-file ./proxmox.pkvars.hcl -var 'ssh_password=<wed ssh password>' -var 'proxmox_password=<proxmox user password>' .
+packer build -var-file ./fedora-42-medium.pkrvars.hcl -var-file ./proxmox.pkvars.hcl -var 'ssh_password=<wed ssh password>' -var 'proxmox_password=<proxmox user password>' .
+packer build -var-file ./fedora-42-large.pkrvars.hcl -var-file ./proxmox.pkvars.hcl -var 'ssh_password=<wed ssh password>' -var 'proxmox_password=<proxmox user password>' .
+packer build -var-file ./fedora-42-xlarge.pkrvars.hcl -var-file ./proxmox.pkvars.hcl -var 'ssh_password=<wed ssh password>' -var 'proxmox_password=<proxmox user password>' .
+```

infra-config/04-vm-templates/fedora-42/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 eaksel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

infra-config/04-vm-templates/fedora-42/fedora-42-large.pkrvars.hcl

@@ -0,0 +1,28 @@
+##################################################################################
+# VARIABLES
+##################################################################################
+
+# Virtual Machine Settings
+
+vm_boot_wait    = "5s"
+vm_name         = "fedora-42-large"
+vm_id           = "9103"
+vm_cpu_sockets  = "1"
+vm_cpu_cores    = "4"
+vm_mem_size     = "4096"
+vm_disk_size    = "32"
+
+proxmox_bridge  = "vmbr1"
+proxmox_vlan    = "71"
+
+ssh_username    = "wed"
+
+# ISO Objects
+
+iso_file             = "Fedora-Server-netinst-x86_64-42-1.1.iso"
+iso_checksum         = "231f3e0d1dc8f565c01a9f641b3d16c49cae44530074bc2047fe2373a721c82f"
+iso_checksum_type    = "sha256"
+
+# Scripts
+
+shell_scripts               = ["scripts/cleanup.sh"]

infra-config/04-vm-templates/fedora-42/fedora-42-medium.pkrvars.hcl

@@ -0,0 +1,28 @@
+##################################################################################
+# VARIABLES
+##################################################################################
+
+# Virtual Machine Settings
+
+vm_boot_wait    = "5s"
+vm_name         = "fedora-42-medium"
+vm_id           = "9102"
+vm_cpu_sockets  = "1"
+vm_cpu_cores    = "2"
+vm_mem_size     = "4096"
+vm_disk_size    = "16"
+
+proxmox_bridge  = "vmbr1"
+proxmox_vlan    = "71"
+
+ssh_username    = "wed"
+
+# ISO Objects
+
+iso_file             = "Fedora-Server-netinst-x86_64-42-1.1.iso"
+iso_checksum         = "231f3e0d1dc8f565c01a9f641b3d16c49cae44530074bc2047fe2373a721c82f"
+iso_checksum_type    = "sha256"
+
+# Scripts
+
+shell_scripts               = ["scripts/cleanup.sh"]

infra-config/04-vm-templates/fedora-42/fedora-42-small.pkrvars.hcl

@@ -0,0 +1,28 @@
+##################################################################################
+# VARIABLES
+##################################################################################
+
+# Virtual Machine Settings
+
+vm_boot_wait    = "5s"
+vm_name         = "fedora-42-small"
+vm_id           = "9101"
+vm_cpu_sockets  = "1"
+vm_cpu_cores    = "2"
+vm_mem_size     = "2048"
+vm_disk_size    = "8"
+
+proxmox_bridge  = "vmbr1"
+proxmox_vlan    = "71"
+
+ssh_username    = "wed"
+
+# ISO Objects
+
+iso_file             = "Fedora-Server-netinst-x86_64-42-1.1.iso"
+iso_checksum         = "231f3e0d1dc8f565c01a9f641b3d16c49cae44530074bc2047fe2373a721c82f"
+iso_checksum_type    = "sha256"
+
+# Scripts
+
+shell_scripts               = ["scripts/cleanup.sh"]

infra-config/04-vm-templates/fedora-42/fedora-42-xlarge.pkrvars.hcl

@@ -0,0 +1,28 @@
+##################################################################################
+# VARIABLES
+##################################################################################
+
+# Virtual Machine Settings
+
+vm_boot_wait    = "5s"
+vm_name         = "fedora-42-xlarge"
+vm_id           = "9104"
+vm_cpu_sockets  = "1"
+vm_cpu_cores    = "4"
+vm_mem_size     = "8192"
+vm_disk_size    = "128"
+
+proxmox_bridge  = "vmbr1"
+proxmox_vlan    = "71"
+
+ssh_username    = "wed"
+
+# ISO Objects
+
+iso_file             = "Fedora-Server-netinst-x86_64-42-1.1.iso"
+iso_checksum         = "231f3e0d1dc8f565c01a9f641b3d16c49cae44530074bc2047fe2373a721c82f"
+iso_checksum_type    = "sha256"
+
+# Scripts
+
+shell_scripts               = ["scripts/cleanup.sh"]

infra-config/04-vm-templates/fedora-42/fedora-42.pkr.hcl

@@ -0,0 +1,132 @@
+##################################################################################
+# LOCALS
+##################################################################################
+
+locals {
+  buildtime = formatdate("YYYY-MM-DD hh:mm ZZZ", timestamp())
+}
+
+packer {
+  required_plugins {
+    ansible = {
+      version = ">= 1.1.3"
+      source  = "github.com/hashicorp/ansible"
+    }
+    name = {
+      version = "~> 1"
+      source  = "github.com/hashicorp/proxmox"
+    }
+  }
+}
+
+##################################################################################
+# SOURCE
+##################################################################################
+
+source "proxmox-iso" "fedora-kickstart" {
+  #insecure_skip_tls_verify = "${var.proxmox_insecure_verify}"
+
+  boot_iso {
+    type = "scsi"
+    iso_file = "${var.proxmox_iso_storage_pool}:iso/${var.iso_file}"
+    unmount = true
+      #iso_checksum = "sha512:33c08e56c83d13007e4a5511b9bf2c4926c4aa12fd5dd56d493c0653aecbab380988c5bf1671dbaea75c582827797d98c4a611f7fb2b131fbde2c677d5258ec9"
+    iso_checksum = "${var.iso_checksum_type}:${var.iso_checksum}"
+  }
+
+  os   = "l26"
+  bios = "ovmf"
+  vm_id = "${var.vm_id}"
+
+  efi_config {
+    efi_storage_pool  = "${var.proxmox_vm_storage_pool}"
+    efi_type          = "4m"
+    #pre_enrolled_keys = true
+  }
+
+  http_directory      = "http"
+
+  boot_command = [
+    "<up><wait>",
+    "e",
+    "<down><down><down><left>",
+    # leave a space from last arg
+    " inst.ks=http://{{.HTTPIP}}:{{.HTTPPort}}/ks.cfg <f10>"
+  ]
+
+  boot_wait    = "${var.vm_boot_wait}"
+
+  sockets         = "${var.vm_cpu_sockets}"
+  cores           = "${var.vm_cpu_cores}"
+  cpu_type        = "host"
+  memory          = "${var.vm_mem_size}"
+  scsi_controller = "virtio-scsi-single"
+
+  disks {
+    storage_pool      = "${var.proxmox_vm_storage_pool}"
+    disk_size         = "${var.vm_disk_size}G"
+  }
+
+  network_adapters {
+    model    = "virtio"
+    bridge   = "${var.proxmox_bridge}"
+    vlan_tag = "${var.proxmox_vlan}"
+    firewall = "true"
+  }
+
+  node                 = "${var.proxmox_node}"
+  username             = "${var.proxmox_username}"
+  password             = "${var.proxmox_password}"
+  proxmox_url          = "https://${var.proxmox_node}.${var.proxmox_domain}:8006/api2/json"
+  ssh_timeout          = "15m"
+  ssh_username         = "${var.ssh_username}"
+  ssh_password         = "${var.ssh_password}"
+  template_description = "Fedora 41-1.4, generated on ${timestamp()}"
+  template_name        = "${var.vm_name}"
+}
+
+##################################################################################
+# BUILD
+##################################################################################
+#    inline          = ["dnf -y update", "dnf -y install python-pip", "python3 -m pip install --upgrade pip", "alternatives --set python /usr/bin/python3", "pip3 install ansible"]
+
+build {
+  sources = ["source.proxmox-iso.fedora-kickstart"]
+  #name    = "${var.vm_mame}"
+  provisioner "shell" {
+    execute_command = "echo 'packer'|{{ .Vars }} sudo -S -E bash '{{ .Path }}'"
+    inline          = [
+      "dnf -y update",
+      "dnf -y install python-pip",
+      "pip install ansible"
+    ]
+  }
+
+  provisioner "file" {
+    source = "files/ansible.pub"
+    destination = "/tmp/ansible.pub"
+  }
+
+  provisioner "shell" {
+    execute_command = "echo 'packer'|{{ .Vars }} sudo -S -E bash '{{ .Path }}'"
+    inline          = [
+      "mkdir /home/wed/.ssh",
+      "chown wed:wed /home/wed/.ssh",
+      "cat /tmp/ansible.pub > /home/wed/.ssh/authorized_keys",
+      "chmod 600 /home/wed/.ssh/authorized_keys",
+      "chown wed:wed /home/wed/.ssh/authorized_keys",
+      "rm /tmp/ansible.pub"
+    ]
+  }
+
+  provisioner "ansible-local" {
+    playbook_file = "scripts/setup.yml"
+  }
+
+  provisioner "shell" {
+    execute_command = "echo 'packer'|{{ .Vars }} sudo -S -E bash '{{ .Path }}'"
+    scripts         = [
+      "scripts/cleanup.sh"
+    ]
+  }
+ }

infra-config/04-vm-templates/fedora-42/http/ks.cfg

@@ -0,0 +1,72 @@
+# Kickstart file for Fedora 41 Server (Text-based Installation)
+#
+# For use with the Fedora Server netinstall ISO.
+# Boot the installer with:
+#   linux /isolinux/vmlinuz inst.ks=http://<server>/<path>/ks.cfg
+#
+# For a local file on a USB drive, you can use:
+#   linux /isolinux/vmlinuz inst.ks=hd:LABEL=<USB_LABEL>:/ks.cfg
+
+# Use text mode install
+text
+
+# Disable Initial Setup on first boot
+firstboot --disable
+
+# Keyboard layout
+keyboard --vckeymap=us --xlayouts='us'
+
+# System language
+lang en_US.UTF-8
+
+# Installation source
+url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-42&arch=x86_64
+
+
+# Network information
+network --bootproto=dhcp --device=link --activate
+network --hostname=fedora.localdomain
+
+# Root password
+rootpw $5$CXpezfLKTajPP7yI$VM8STd3QaHBTKMe2DLTmK5p.lEGbUYYZV8jGG3nxX2/ --iscrypted
+
+# SELinux configuration
+selinux --enforcing
+
+# Do not configure the X Window System
+skipx
+
+# System timezone
+timezone US/Chicago --utc
+
+# Add a user named wed
+user --groups=wheel --name=wed --password=$5$UOpZHG55fWCHlNSp$nFnpaVLb9enbQTebHo4SKBqolGr39SMYo2ZshHCe2d3 --iscrypted --gecos="wed"
+
+# System bootloader configuration
+bootloader --location=mbr --append="crashkernel=auto"
+
+# Clear the Master Boot Record
+zerombr
+
+# Remove partitions
+clearpart --all --initlabel
+
+# Automatically create partitions using LVM
+autopart --type=lvm
+
+# Reboot after successful installation
+reboot
+
+%packages --ignoremissing
+qemu-guest-agent #Make sure that this package gets installed because if you use DHCP this is how Promxox and then Packer will know the IP address to connect to
+#@^Infrastructure Server
+%end
+
+%post --nochroot --logfile=/mnt/sysimage/root/ks-post.log
+# Disable quiet boot and splash screen
+sed --follow-symlinks -i "s/ rhgb quiet//" /mnt/sysimage/etc/default/grub
+sed --follow-symlinks -i "s/ rhgb quiet//" /mnt/sysimage/boot/grub2/grubenv
+
+# Passwordless sudo for the user 'wed'
+echo "wed ALL=(ALL) NOPASSWD: ALL" >> /mnt/sysimage/etc/sudoers.d/wed
+%end

infra-config/04-vm-templates/fedora-42/proxmox.pkvars.hcl

@@ -0,0 +1,17 @@
+##################################################################################
+# VARIABLES
+##################################################################################
+
+# Credentials
+
+proxmox_username   = "root@pam"
+ssh_username       = "wed"
+
+# Proxmox Objects
+proxmox_node                    = "pve03"
+proxmox_domain                  = "int.mk-labs.cloud"
+proxmox_vm_storage_pool         = "pve-templates"
+#proxmox_insecure_connection     = false #Default: true
+proxmox_iso_storage_pool        = "local"
+
+#template_name   = ""

infra-config/04-vm-templates/fedora-42/scripts/cleanup.sh

@@ -0,0 +1,12 @@
+#!/bin/bash -eux
+
+pip uninstall -y ansible
+
+dnf clean all
+
+# Zero out the rest of the free space using dd, then delete the written file.
+#dd if=/dev/zero of=/EMPTY bs=1M
+#rm -f /EMPTY
+
+# Add `sync` so Packer doesn't quit too early, before the large file is deleted.
+sync

infra-config/04-vm-templates/fedora-42/scripts/setup.yml

@@ -0,0 +1,51 @@
+---
+- name: "Setup.yml"
+  hosts: localhost
+  gather_facts: yes
+  become: yes
+  tasks:
+      - name: Colorize root shell prompt
+        lineinfile:
+            path: /root/.bashrc
+            line: 'export PS1="\[\033[38;5;11m\]\u\[$(tput sgr0)\]\[\033[38;5;15m\]@\h:\[$(tput sgr0)\]\[\033[38;5;6m\][\w]:\[$(tput sgr0)\]\[\033[38;5;15m\] \[$(tput sgr0)\]"'
+            state: present
+
+      - name: Alias vi to vim
+        lineinfile:
+            path: /root/.bashrc
+            line: "alias vi='vim'"
+            state: present
+
+      - name: Create vim configuration file
+        file:
+            path: /root/.vimrc
+            state: touch
+            owner: root
+            group: root
+            mode: 0644
+
+      - name: Configure vim
+        blockinfile:
+            path: /root/.vimrc
+            block: |
+                set nocompatible
+                set number
+                set autoindent
+                syntax on
+                highlight Comment ctermfg=LightCyan
+            marker: ""
+            state: present
+
+      - name: Disable GSSAPIAuthentication
+        lineinfile:
+            path: /etc/ssh/sshd_config
+            regexp: "^GSSAPIAuthentication"
+            line: "GSSAPIAuthentication no"
+            state: present
+
+      - name: Update CA bundle (RedHat)
+        get_url:
+            url: https://curl.haxx.se/ca/cacert.pem
+            dest: /etc/pki/tls/certs/ca-bundle.crt
+            force: yes
+        when: ansible_os_family == "RedHat"

infra-config/04-vm-templates/fedora-42/variables.pkr.hcl

@@ -0,0 +1,144 @@
+# Proxmox variable definitions
+
+variable "proxmox_username" {
+  type    = string
+  description = "The username for authenticating to Proxmox."
+  default = ""
+  sensitive = true
+}
+
+variable "proxmox_password" {
+  type    = string
+  description = "The plaintext password for authenticating to Proxmox."
+  default = ""
+  sensitive = true
+}
+
+variable "proxmox_node" {
+  type    = string
+  description = "The Proxmox node to store the templates on."
+  default = ""
+}
+
+variable "proxmox_domain" {
+  type    = string
+  description = "The domain the Proxmox node resizes in."
+  default = ""
+}
+
+variable "proxmox_insecure_verify" {
+  type    = bool
+  description = "If true, does not validate the proxmox server's TLS certificate."
+  default = true
+}
+
+variable "proxmox_vm_storage_pool" {
+  type    = string
+  description = "The storage pool where the VM will live."
+  default = ""
+}
+
+# Virtual Machine variables
+
+variable "vm_name" {
+  type    = string
+  description = "The template vm name"
+  default = ""
+}
+
+variable "vm_id" {
+  type = number
+  description = "The ID of virtual machine."
+}
+
+variable "vm_cpu_sockets" {
+  type = number
+  description = "The number of virtual CPUs sockets."
+  default = "1"
+}
+
+variable "vm_cpu_cores" {
+  type = number
+  description = "The number of virtual CPUs cores per socket."
+  default = "1"
+}
+
+variable "vm_mem_size" {
+  type = number
+  description = "The size for the virtual memory in MB."
+}
+
+variable "vm_disk_size" {
+  type = number
+  description = "The size of the primary virtual disk in GiB."
+}
+
+variable "proxmox_bridge" {
+  type = string
+  description = "The Proxmox bridge the NIC connects to."
+}
+
+variable "proxmox_vlan" {
+  type = number
+  description = "The VLAN the NIC is on."
+}
+
+variable "vm_boot_wait" {
+  type = string
+  description = "The time to wait before boot (in seconds)."
+  default = ""
+}
+
+variable "shell_scripts" {
+  type = list(string)
+  description = "A list of scripts."
+  default = []
+}
+
+# ISO Objects
+
+variable "proxmox_iso_storage_pool" {
+  type    = string
+  description = "The storage pool where the ISO is located."
+  default = ""
+}
+
+variable "iso_url" {
+  type    = string
+  description = "The url to retrieve the iso image"
+  default = ""
+  }
+
+variable "iso_file" {
+  type = string
+  description = "The file name of the guest operating system ISO image installation media."
+  default = ""
+}
+
+variable "iso_checksum" {
+  type    = string
+  description = "The checksum of the ISO image."
+  default = ""
+}
+
+variable "iso_checksum_type" {
+  type    = string
+  description = "The checksum type of the ISO image. Ex: sha256"
+  default = ""
+}
+
+# SSH info
+
+variable "ssh_username" {
+  type    = string
+  description = "The username to use to authenticate over SSH."
+  default = ""
+  sensitive = true
+}
+
+variable "ssh_password" {
+  type    = string
+  description = "The plaintext password to use to authenticate over SSH."
+  default = ""
+  sensitive = true
+}

infra-config/04-vm-templates/fedora-42/variables.pkrvars-xlarge.hcl

@@ -0,0 +1,35 @@
+##################################################################################
+# VARIABLES
+##################################################################################
+
+# HTTP Settings
+
+http_directory = "http"
+
+# Virtual Machine Settings
+
+vm_name                     = "centos9-large"
+vm_guest_os_type            = "centos8_64Guest"
+vm_version                  = 19
+vm_firmware                 = "efi"
+vm_cdrom_type               = "sata"
+vm_cpu_sockets              = 1
+vm_cpu_cores                = 1
+vm_mem_size                 = 2048
+vm_disk_size                = 102400
+thin_provision              = true
+disk_eagerly_scrub          = false
+vm_disk_controller_type     = ["pvscsi"]
+vm_network_card             = "vmxnet3"
+vm_boot_wait                = "5s"
+ssh_username                = "wed"
+ssh_password                = "1mag!ne3R"
+
+# ISO Objects
+
+iso_checksum                = "ca03867ab88fbe565b91ae518e6f7f83debe6415234f29ff2cc5634052840ce8"
+iso_checksum_type           = "sha256"
+iso_url                     = "https://mirror.rackspace.com/centos-stream/9-stream/BaseOS/x86_64/iso/CentOS-Stream-9-latest-x86_64-dvd1.iso"
+# Scripts
+
+shell_scripts               = ["scripts/cleanup.sh"]