Sebastian Mark
1edbc436db
- Add new Kubernetes manifests for `renovate-bot` in `k8s-manifests/` directory
- The Kubernetes manifests include a ConfigMap for `renovate-bot` configuration and a CronJob definition
- The `renovate-bot` now runs as a Kubernetes CronJob scheduled daily
- Add new `start_renovate_bot.sh` script in `bin/` directory for manual job creation
- Update README and add new README.renovate
🤖
53 lines
2.1 KiB
Markdown
53 lines
2.1 KiB
Markdown
# Kubernetes Baseline
|
|
|
|
* [ArgoCD](https://argoproj.github.io/cd/)
|
|
* [NGINX Ingress Controller](https://kubernetes.github.io/ingress-nginx/)
|
|
* [cert-manager](https://cert-manager.io/)
|
|
* selfsigned issuer
|
|
* LetsEncrypt issuers (Prod and Staging)
|
|
* [prometheus and grafana](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack)
|
|
* [zabbix-proxy](https://git.zabbix.com/projects/ZT/repos/kubernetes-helm/browse?at=refs%2Fheads%2Frelease%2F6.4)
|
|
* [loki](https://grafana.com/docs/loki/latest/)
|
|
* [keel](https://keel.sh)
|
|
* [reloader](https://github.com/stakater/Reloader)
|
|
* [removate-bot](https://github.com/renovatebot/renovate) (see [README.renovate.md](README.renovate.md))
|
|
|
|
## Installation (k3s + baseline)
|
|
|
|
`ansible-playbook -i <host|ip>, pb_install.yml`
|
|
|
|
## Installation (baseline only)
|
|
|
|
make sure kubectl is configure to reach the destination cluster, then:
|
|
|
|
`kubectl apply -f argocd-init.yml`
|
|
|
|
## Notes
|
|
|
|
### Linode
|
|
|
|
PROXY protocol needs to be enabled for ingress-nginx to see the clients IP in ingress log.
|
|
|
|
Add the PROXY protocol annotation to the ingress-nginx service:
|
|
|
|
```
|
|
annotations:
|
|
service.beta.kubernetes.io/linode-loadbalancer-proxy-protocol: v2
|
|
```
|
|
|
|
Update the ingress-nginx ConfigMap to make nginx expect PROXY protocol data:
|
|
|
|
```
|
|
data:
|
|
use-proxy-protocol: "true"
|
|
```
|
|
|
|
#### cert-manager
|
|
|
|
> However, when you have the PROXY protocol enabled, the external load balancer does modify the traffic, prepending the PROXY line before each TCP connection. If you connect directly to the web server internally, bypassing the external load balancer, then it will receive traffic without the PROXY line.
|
|
>
|
|
> This is particularly a problem when using cert-manager for provisioning SSL certificates.
|
|
|
|
After enabling the PROXY protocol cert-manager is unable to perform a self check ("propagation check failed", "failed to perform self check GET request").
|
|
|
|
[hairpin-proxy](https://github.com/compumike/hairpin-proxy) adds PROXY protocol support for internal-to-LoadBalancer traffic for Kubernetes Ingress users, specifically for cert-manager self-checks (no further configuration needed).
|