k8s/baseline
k8s/baseline
3
0
Fork 0
Code Issues 1 Pull requests Releases Activity
No description
210 commits 1 branch 0 tags 402 KiB
Python 49%
Jsonnet 48.5%
Shell 2.5%
Find a file
Sebastian Mark 9b8adc3958 fix(init): update argocd app definition format 
update project an application definition based an this (mostly useless)
changelog entry:

> make the chart use maps instead of lists

Usefull hints on the new structure can be found in then git diff:
https://github.com/argoproj/argo-helm/compare/argo-events-2.4.4...argocd-apps-2.0.0

or in the new valuesContent:
https://artifacthub.io/packages/helm/argo/argocd-apps?modal=values
2024-08-14 09:23:41 +02:00
_templates REFACTOR: merge templates into one 2022-04-17 19:00:24 +02:00
bin Revert "feat: add renovate-bot cronjob" 2023-07-29 17:44:54 +02:00
manifests chore: update helm release ingress-nginx to 4.10.* 2024-08-14 09:23:41 +02:00
.gitignore FEAT: get kubeconfig after k3s installation 2022-05-01 20:04:05 +02:00
.renovaterc.json chore(config): migrate config .renovaterc.json 2023-09-25 17:24:36 +00:00
argocd-init.yml fix(init): update argocd app definition format 2024-08-14 09:23:41 +02:00
logo.png FEAT: add logo 2021-11-30 14:49:29 +01:00
pb_install.yml chore: update dependency k3s-io/k3s to v1.29.3+k3s1 2024-08-14 09:23:41 +02:00
README.md break(monitoring): remove prometheus-stack and loki 2024-08-14 09:23:41 +02:00

README.md

Kubernetes Baseline

Installation (k3s + baseline)

ansible-playbook -i <host|ip>, pb_install.yml

Installation (baseline only)

make sure kubectl is configure to reach the destination cluster, then:

kubectl apply -f argocd-init.yml

Notes

ArgoCD

To retrieve the initial admin password use kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

To change the password follow Argocd account update password.

Linode

PROXY protocol needs to be enabled for ingress-nginx to see the clients IP in ingress log.

Add the PROXY protocol annotation to the ingress-nginx service:

annotations:
    service.beta.kubernetes.io/linode-loadbalancer-proxy-protocol: v2

Update the ingress-nginx ConfigMap to make nginx expect PROXY protocol data:

data:
  use-proxy-protocol: "true"

cert-manager

However, when you have the PROXY protocol enabled, the external load balancer does modify the traffic, prepending the PROXY line before each TCP connection. If you connect directly to the web server internally, bypassing the external load balancer, then it will receive traffic without the PROXY line.

This is particularly a problem when using cert-manager for provisioning SSL certificates.

After enabling the PROXY protocol cert-manager is unable to perform a self check ("propagation check failed", "failed to perform self check GET request").

hairpin-proxy adds PROXY protocol support for internal-to-LoadBalancer traffic for Kubernetes Ingress users, specifically for cert-manager self-checks (no further configuration needed).