djpbessems/Kubernetes.K3s.installLog
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Updated documentation

Browse Source
This commit is contained in:
Danny Bessems
2021-06-14 16:42:22 +02:00
parent c6a9c7ab35
commit 033ddc61ca
4 changed files with 32 additions and 509 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
README.md
View File

@ -23,7 +23,7 @@ mount -a
</details>
## K3s cluster
## K3s cluster
On first node:
```shell
curl -sfL https://get.k3s.io | sh -s - --disable local-path,traefik
@ -100,7 +100,7 @@ Expose Longhorn's dashboard through `IngressRoute`:
```shell
kubectl apply -f storage/Longhorn/ingressRoute-Longhorn.yml
```
Add additional `storageClass` with backup schedule:
Add additional `storageClass` with backup schedule:
***After** specifying a NFS backup target (syntax: `nfs://servername:/path/to/share`) through Longhorn's dashboard*
```yaml
kind: StorageClass
@ -151,23 +151,24 @@ kubectl delete ingressroute traefik-dashboard --namespace kube-system
```
### 3) Secret management
*Perform these steps **after** configuring persistent storage **and** ingress*
*Perform these steps **after** configuring persistent storage **and** ingress*
##### 3.1) Create `persistentVolume` and `ingressRoute`
*Requires specifying a `uid` & `gid` in the flexvolSMB-`persistentVolume`*
*Requires specifying a `uid` & `gid` in the flexvolSMB-`persistentVolume`*
```shell
kubectl create namespace vault
kubectl apply -f services/Vault/persistentVolume-Vault.yml
kubectl apply -f services/Vault/ingressRoute-Vault.yml
```
##### 3.2) Install Helm Chart
See [HashiCorp Vault](https://www.vaultproject.io/docs/platform/k8s/helm/run):
*REMOVED; left for reference*
See [HashiCorp Vault](https://www.vaultproject.io/docs/platform/k8s/helm/run):
```shell
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update
helm install vault hashicorp/vault --namespace vault --values=services/Vault/chart-values.yml
```
Configure Vault for use;
- Enable Kubernetes authentication (see https://www.vaultproject.io/api-docs/auth/kubernetes)
- ~~Enable Kubernetes authentication (see https://www.vaultproject.io/api-docs/auth/kubernetes)~~
- Store basic access policy template
- Enable `kv`-engine
```
@ -175,11 +176,6 @@ Configure Vault for use;
# It might be necessary to first login with an existing token:
# vault login
vault auth enable kubernetes
vault write auth/kubernetes/config \
token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
kubernetes_host=https://${KUBERNETES_PORT_443_TCP_ADDR}:443 \
kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
cat <<EOF > /home/vault/app-policy.hcl
path "secret*" {
@ -206,41 +202,17 @@ vault write auth/kubernetes/role/adminer \
ttl=1h
vault policy write adminer /home/vault/app-policy.hcl
```
##### 4.2) [Bitwarden_rs](https://github.com/dani-garcia/bitwarden_rs) <small>(password manager)</small>
##### 4.2) [Vaultwarden](https://github.com/dani-garcia/vaultwarden) <small>(password manager)</small>
*Requires [mount.cifs](https://linux.die.net/man/8/mount.cifs)' option `nobrl`*
```shell
kubectl apply -f services/Bitwarden/secret-Bitwarden.yml
kubectl apply -f services/Bitwarden/deploy-Bitwarden.yml
```
Vault configuration:
```
vault kv put secret/bitwarden \
admintoken=<value> \
yubicoclientid=<value> \
yubicosecretkey=<value>
vault write auth/kubernetes/role/bitwarden \
bound_service_account_names=bitwarden \
bound_service_account_namespaces=default \
policies=bitwarden \
ttl=1h
vault policy write bitwarden /home/vault/app-policy.hcl
```
##### 4.3) [DroneCI](https://drone.io/) <small>(contineous delivery)</small>
```shell
kubectl apply -f services/DroneCI/secret-DroneCI.yml
kubectl apply -f services/DroneCI/deploy-DroneCI.yml
```
Vault configuration:
```
vault kv put secret/drone \
rpcsecret=<value> \
giteaclientid=<value> \
giteaclientsecret=<value>
vault write auth/kubernetes/role/drone \
bound_service_account_names=drone \
bound_service_account_namespaces=default \
policies=drone \
ttl=1h
vault policy write drone /home/vault/app-policy.hcl
```
##### 4.4) [Gitea](https://gitea.io/) <small>(git repository)</small>
```shell
kubectl apply -f services/Gitea/deploy-Gitea.yml
@ -263,31 +235,28 @@ kubectl rollout restart deployment guacamole
```
##### 4.7) [Lighttpd](https://www.lighttpd.net/) <small>(webserver)</small>
*Serves various semi-containerized websites; respective webcontent is stored on fileshare*
*Serves various semi-containerized websites; respective webcontent is stored on fileshare*
```shell
kubectl apply -f services/Lighttpd/configMap-Lighttpd.yml
kubectl apply -f services/Lighttpd/deploy-Lighttpd.yml
kubectl apply -f services/Lighttpd/cronJob-Spotweb.yml
```
##### 4.8) [Matrix]() <small>(federated chat)</small>
*WIP*
```shell
kubectl apply -f services/Matrix/configMap-Matrix.yml
kubectl apply -f services/Matrix/middleware-Matrix.yml
kubectl apply -f services/Matrix/deploy-Matrix.yml
```
##### 4.9) PVR `namespace` <small>(automated media management)</small>
##### 4.8) PVR `namespace` <small>(automated media management)</small>
*Containers use shared resources to be able to interact with downloaded files*
```shell
kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>> -n pvr
kubectl apply -f services/PVR/persistentVolumeClaim-PVR.yml
kubectl apply -f services/PVR/storageClass-PVR.yml
```
###### 4.9.1) [NZBHydra](https://github.com/theotherp/nzbhydra2) <small>(index aggregator)</small>
###### 4.8.1) [NZBHydra](https://github.com/theotherp/nzbhydra2) <small>(index aggregator)</small>
```shell
kubectl apply -f services/PVR/deploy-NZBHydra.yml
```
###### 4.9.2) [Plex](https://www.plex.tv/) <small>(media library)</small>
###### 4.8.2) [Overseerr](https://overseerr.dev/) <small>(request management)</small>
```shell
kubectl apply -f services/PVR/deploy-Overseerr.yml
```
###### 4.8.3) [Plex](https://www.plex.tv/) <small>(media library)</small>
*Due to usage of symlinks, partially incompatible with SMB-share-backed storage*
```shell
kubectl apply -f services/PVR/deploy-Plex.yml
@ -297,36 +266,36 @@ After deploying, Plex server needs to be *claimed* (=assigned to Plex-account):
kubectl get endpoints Plex -n PVR
```
Browse to the respective IP address (http://<nodeipaddress>:32400/web) and follow instructions.
###### 4.9.3) [Radarr](https://radarr.video/) <small>(movie management)</small>
###### 4.8.4) [Radarr](https://radarr.video/) <small>(movie management)</small>
```shell
kubectl apply -f services/PVR/deploy-Radarr.yml
```
###### 4.9.4) [Readarr](https://readarr.com/) <small>(book management)</small>
###### 4.8.5) [Readarr](https://readarr.com/) <small>(book management)</small>
```shell
kubectl apply -f services/PVR/deploy-Readarr.yml
```
###### 4.9.5) [SABnzbd](https://sabnzbd.org/) <small>(download client)</small>
###### 4.8.6) [SABnzbd](https://sabnzbd.org/) <small>(download client)</small>
```shell
kubectl apply -f services/PVR/deploy-SABnzbd.yml
```
###### 4.9.6) [Sonarr](https://sonarr.tv/) <small>(tv management)</small>
###### 4.8.7) [Sonarr](https://sonarr.tv/) <small>(tv management)</small>
```shell
kubectl apply -f services/PVR/deploy-Sonarr.yml
```
##### 4.10) [Shaarli](https://github.com/shaarli/Shaarli) <small>(bookmarks/notes)</small>
##### 4.9) [Shaarli](https://github.com/shaarli/Shaarli) <small>(bookmarks/notes)</small>
```shell
kubectl apply -f services/Shaarli/deploy-Shaarli.yml
```
##### 4.11) [Theia](https://theia-ide.org/) <small>(web IDE)</small>
##### 4.10) [Theia](https://theia-ide.org/) <small>(web IDE)</small>
```shell
kubectl apply -f services/Theia/deploy-Theia.yml
```
##### 4.12) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper) <small>(certificate tooling)</small>
##### 4.11) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper) <small>(certificate tooling)</small>
```shell
kubectl apply -f services/TraefikCertsDumper/deploy-TraefikCertsDumper.yml
```
##### 4.13) [Unifi-Controller]() <small>(wlan AP management)</small>
##### 4.12) [Unifi-Controller]() <small>(wlan AP management)</small>
```shell
kubectl apply -f services/Unifi/deploy-Unifi.yml
```
@ -343,26 +312,26 @@ ssh <username>@<ipaddress>
sed -e 's|stun://<ipaddress>|stun://<ipaddress>:3479|' -i /etc/persistent/cfg/mgmt
```
### 5) Miscellaneous
*Various notes/useful links*
*Various notes/useful links*
* Replacement for [not-yet-deprecated](https://github.com/kubernetes/kubectl/issues/151) `kubectl get all -A`:
kubectl get $(kubectl api-resources --verbs=list -o name | paste -sd, -) --ignore-not-found --all-namespaces
* `DaemonSet` to configure nodes' **sysctl** `fs.inotify.max-user-watches`:
kubectl apply -f system/InotifyMaxWatchers/daemonSet-InotifyMaxWatchers.yml
* Debug DNS lookups within the cluster:
kubectl run -it --rm dnsutils --restart=Never --image=gcr.io/kubernetes-e2e-test-images/dnsutils -- nslookup [-debug] [fqdn]
or
kubectl run -it --rm busybox --restart=Never --image=busybox:1.28 -- nslookup api.github.com [-debug] [fqdn]
* Delete namespaces stuck in `Terminating` state:
kubectl get namespace <name> -o json | jq -j '.spec.finalizers=null' > tmp.json
kubectl replace --raw "/api/v1/namespaces/<name>/finalize" -f ./tmp.json
rm ./tmp.json