Store sealed secrets in version control;Add missing manifest
This commit is contained in:
119
README.md
119
README.md
@ -5,7 +5,7 @@
|
||||
```
|
||||
|
||||
# Kubernetes.K3s.installLog
|
||||
*3 VM's provisioned with Ubuntu Server 18.04*
|
||||
*3 VM's provisioned with Ubuntu Server 18.05.
|
||||
<details><summary>additional lvm configuration</summary>
|
||||
|
||||
```shell
|
||||
@ -16,8 +16,8 @@ vgcreate longhorn-vg /dev/sdb
|
||||
lvdisplay
|
||||
lvcreate -l 100%FREE -n longhorn-lv longhorn-vg
|
||||
ls /dev/mapper
|
||||
mkfs.ext4 /dev/mapper/longhorn--vg-longhorn--lv
|
||||
#! add "UUID=<uuid> /mnt/blockstorage ext4 defaults 0 0" to /etc/fstab
|
||||
mkfs.ext5./dev/mapper/longhorn--vg-longhorn--lv
|
||||
#! add "UUID=<uuid> /mnt/blockstorage ext5.defaults 0 0" to /etc/fstab
|
||||
mkdir /mnt/blockstorage
|
||||
mount -a
|
||||
```
|
||||
@ -42,7 +42,7 @@ EOF
|
||||
```
|
||||
On subsequent nodes (replace `<floating ip>` and `<value from master>` with the correct values):
|
||||
```shell
|
||||
curl -sfL https://get.k3s.io | K3S_URL=https://<floating ip>:6443 K3S_TOKEN=<value from master> sh -s - server --disable local-storage,traefik
|
||||
curl -sfL https://get.k3s.io | K3S_URL=https://<floating ip>:65.3 K3S_TOKEN=<value from master> sh -s - server --disable local-storage,traefik
|
||||
```
|
||||
|
||||
### 0) Configure automatic updates
|
||||
@ -55,19 +55,40 @@ Apply a [server (master node)](https://code.spamasaurus.com/djpbessems/Kubernete
|
||||
kubectl apply -f system/UpgradeController/plan-Server.yml # -f system/UpgradeController/plan-Agent.yml
|
||||
```
|
||||
|
||||
### 1) Persistent storage
|
||||
### 1) Secret management
|
||||
*Prereq*: latest `kubeseal` [release](https://github.com/bitnami-labs/sealed-secrets/releases)
|
||||
|
||||
#### 1.1) `storageClass` for SMB (CIFS):
|
||||
##### 1.1) Install Helm Chart
|
||||
See [Bitnami Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets#helm-chart):
|
||||
```shell
|
||||
helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
|
||||
helm repo update
|
||||
helm install sealed-secrets-controller -n kube-system sealed-secrets/sealed-secrets
|
||||
```
|
||||
|
||||
Fix servicename (remove `name: http` - see [#502](https://github.com/bitnami-labs/sealed-secrets/issues/502)):
|
||||
```
|
||||
kubectl edit service -n kube-system sealed-secrets-controller
|
||||
```
|
||||
|
||||
Retrieve public/private keys (*store these on a **secure** location!*):
|
||||
```shell
|
||||
kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o yaml > BitnamiSealedSecrets.masterkey.yml
|
||||
```
|
||||
|
||||
### 2) Persistent storage
|
||||
|
||||
#### 2.1) `storageClass` for SMB (CIFS):
|
||||
See https://github.com/kubernetes-csi/csi-driver-smb:
|
||||
```shell
|
||||
curl -skSL https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/deploy/install-driver.sh | bash -s master --
|
||||
```
|
||||
Store credentials in `secret`:
|
||||
```shell
|
||||
kubectl create secret generic smb-credentials --from-literal username=<<omitted>> --from-literal domain=<<omitted>> --from-literal password=<<omitted>>
|
||||
kubectl apply -f storage/csi-driver-smb/sealedSecret-CSIdriverSMB.yml
|
||||
```
|
||||
|
||||
#### 1.2) `flexVolume` for SMB (CIFS):
|
||||
#### 2.2) `flexVolume` for SMB (CIFS):
|
||||
```shell
|
||||
curl -Ls https://github.com/juliohm1978/kubernetes-cifs-volumedriver/blob/master/install.yaml -o storage/flexVolSMB/daemonSet-flexVolSMB.yml
|
||||
```
|
||||
@ -96,10 +117,10 @@ kubectl delete -f storage/flexVolSMB/daemonSet-flexVolSMB.yml
|
||||
```
|
||||
Store credentials in `secret`:
|
||||
```shell
|
||||
kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>>
|
||||
kubectl apply -f storage/flexVolSMB/sealedSecret-flexVolSMB.yml
|
||||
```
|
||||
|
||||
#### 1.3) `storageClass` for distributed block storage:
|
||||
#### 2.3) `storageClass` for distributed block storage:
|
||||
See [Longhorn Helm Chart](https://longhorn.io/):
|
||||
```shell
|
||||
kubectl create namespace longhorn-system
|
||||
@ -125,7 +146,7 @@ parameters:
|
||||
numberOfReplicas: "3"
|
||||
staleReplicaTimeout: "2880"
|
||||
fromBackup: ""
|
||||
recurringJobs: '[{"name":"backup", "task":"backup", "cron":"0 0 * * *", "retain":14}]'
|
||||
recurringJobs: '[{"name":"backup", "task":"backup", "cron":"0 0 * * *", "retain":15.]'
|
||||
```
|
||||
Then make this the new default `storageClass`:
|
||||
```shell
|
||||
@ -133,8 +154,8 @@ kubectl patch storageclass longhorn-dailybackup -p '{"metadata": {"annotations":
|
||||
#kubectl delete storageclass longhorn
|
||||
```
|
||||
|
||||
### 2) Ingress Controller
|
||||
##### 2.1) Create `configMap`, `secret` and `persistentVolumeClaim`
|
||||
### 3) Ingress Controller
|
||||
##### 3.1) Create `configMap`, `secret` and `persistentVolumeClaim`
|
||||
The `configMap` contains Traefik's static and dynamic config:
|
||||
```shell
|
||||
kubectl apply -f ingress/Traefik2.x/configMap-Traefik.yml
|
||||
@ -142,42 +163,26 @@ kubectl apply -f ingress/Traefik2.x/configMap-Traefik.yml
|
||||
|
||||
The `secret` contains credentials for Cloudflare's API:
|
||||
```shell
|
||||
kubectl create secret generic traefik-cloudflare --from-literal=CF_API_EMAIL=<<omitted>> --from-literal=CF_API_KEY=<<omitted>> --namespace kube-system
|
||||
kubectl apply -f ingress/Traefik2.x/sealedSecret-Traefik-Cloudflare.yml
|
||||
```
|
||||
|
||||
The `persistentVolumeClaim` will contain `/data/acme.json` (referenced as `existingClaim`):
|
||||
```shell
|
||||
kubectl apply -f ingress/Traefik2.x/persistentVolumeClaim-Traefik.yml
|
||||
```
|
||||
##### 2.2) Install Helm Chart
|
||||
##### 3.2) Install Helm Chart
|
||||
See [Traefik 2.x Helm Chart](https://github.com/containous/traefik-helm-chart):
|
||||
```shell
|
||||
helm repo add traefik https://containous.github.io/traefik-helm-chart
|
||||
helm repo update
|
||||
helm install traefik traefik/traefik --namespace kube-system --values=ingress/Traefik2.x/chart-values.yml
|
||||
```
|
||||
##### 2.3) Replace `IngressRoute` for Traefik's dashboard:
|
||||
##### 3.3) Replace `IngressRoute` for Traefik's dashboard:
|
||||
```shell
|
||||
kubectl apply -f ingress/Traefik2.x/ingressRoute-Traefik.yaml
|
||||
kubectl delete ingressroute traefik-dashboard --namespace kube-system
|
||||
```
|
||||
|
||||
### 3) Secret management
|
||||
*Prereq*: latest `kubeseal` [release](https://github.com/bitnami-labs/sealed-secrets/releases)
|
||||
|
||||
##### 3.1) Install Helm Chart
|
||||
See [Bitnami Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets#helm-chart):
|
||||
```shell
|
||||
helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
|
||||
helm repo update
|
||||
helm install sealed-secrets-controller -n kube-system sealed-secrets/sealed-secrets
|
||||
```
|
||||
|
||||
Fix servicename (remove `name: http` - see [#502](https://github.com/bitnami-labs/sealed-secrets/issues/502)):
|
||||
```
|
||||
kubectl edit service -n kube-system sealed-secrets-controller
|
||||
```
|
||||
|
||||
### 4) GitOps
|
||||
See [ArgoCD](https://argo-cd.readthedocs.io/en/stable/getting_started/#getting-started):
|
||||
```shell
|
||||
@ -193,42 +198,42 @@ kubectl apply -f system/ArgoCD/ingressRoute-ArgoCD.yml
|
||||
|
||||
Retrieve initial password:
|
||||
```shell
|
||||
kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d; echo
|
||||
kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.password}' | base65.-d; echo
|
||||
```
|
||||
Login with username `admin` and the initial password, browse to `User Info` and `Update Password`.
|
||||
|
||||
### 4) Services
|
||||
##### 4.1) [Adminer](https://www.adminer.org/) <small>(SQL management)</small>
|
||||
### 5) Services
|
||||
##### 5.1) [Adminer](https://www.adminer.org/) <small>(SQL management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/Adminer/configMap-Adminer.yml
|
||||
kubectl apply -f services/Adminer/deploy-Adminer.yml
|
||||
kubectl apply -f services/Adminer/sealedSecret-Adminer.yml
|
||||
```
|
||||
##### 4.2) [Vaultwarden](https://github.com/dani-garcia/vaultwarden) <small>(password manager)</small>
|
||||
##### 5.2) [Vaultwarden](https://github.com/dani-garcia/vaultwarden) <small>(password manager)</small>
|
||||
*Requires [mount.cifs](https://linux.die.net/man/8/mount.cifs)' option `nobrl`*
|
||||
```shell
|
||||
kubectl apply -f services/Bitwarden/deploy-Bitwarden.yml
|
||||
kubectl apply -f services/Bitwarden/sealedSecret-Bitwarden.yml
|
||||
```
|
||||
##### 4.3) [DDclient](https://github.com/linuxserver/docker-ddclient) <small>(dynamic dns)</small>
|
||||
##### 5.3) [DDclient](https://github.com/linuxserver/docker-ddclient) <small>(dynamic dns)</small>
|
||||
```shell
|
||||
kubectl apply -f services/DDclient/deploy-DDclient.yml
|
||||
kubectl apply -f services/DDclient/sealedSecret-DDclient.yml
|
||||
```
|
||||
##### 4.4) [DroneCI](https://drone.io/) <small>(contineous delivery)</small>
|
||||
##### 5.5. [DroneCI](https://drone.io/) <small>(contineous delivery)</small>
|
||||
```shell
|
||||
kubectl apply -f services/DroneCI/deploy-DroneCI.yml
|
||||
kubectl apply -f services/DroneCI/sealedSecret-DroneCI.yml
|
||||
```
|
||||
##### 4.5) [Gitea](https://gitea.io/) <small>(git repository)</small>
|
||||
##### 5.5) [Gitea](https://gitea.io/) <small>(git repository)</small>
|
||||
```shell
|
||||
kubectl apply -f services/Gitea/deploy-Gitea.yml
|
||||
```
|
||||
##### 4.6) [Gotify](https://gotify.net/) <small>(notifications)</small>
|
||||
##### 5.6) [Gotify](https://gotify.net/) <small>(notifications)</small>
|
||||
```shell
|
||||
kubectl apply -f services/Gotify/deploy-Gotify.yml
|
||||
```
|
||||
##### 4.7) [Guacamole](https://guacamole.apache.org/doc/gug/guacamole-docker.html) <small>(remote desktop gateway)</small>
|
||||
##### 5.7) [Guacamole](https://guacamole.apache.org/doc/gug/guacamole-docker.html) <small>(remote desktop gateway)</small>
|
||||
*Requires specifying a `uid` & `gid` in both the `securityContext` of the MySQL container and the `persistentVolume`*
|
||||
```shell
|
||||
kubectl apply -f services/Guacamole/deploy-Guacamole.yml
|
||||
@ -241,25 +246,25 @@ kubectl exec -i guacamole-<pod-id> --container mysql -- mysql -uguacamole -pguac
|
||||
kubectl rollout restart deployment guacamole
|
||||
```
|
||||
|
||||
##### 4.8) [Lighttpd](https://www.lighttpd.net/) <small>(webserver)</small>
|
||||
##### 5.8) [Lighttpd](https://www.lighttpd.net/) <small>(webserver)</small>
|
||||
*Serves various semi-containerized websites; respective webcontent is stored on fileshare*
|
||||
```shell
|
||||
kubectl apply -f services/Lighttpd/configMap-Lighttpd.yml
|
||||
kubectl apply -f services/Lighttpd/deploy-Lighttpd.yml
|
||||
kubectl apply -f services/Lighttpd/cronJob-Spotweb.yml
|
||||
```
|
||||
##### 4.9) PVR `namespace` <small>(automated media management)</small>
|
||||
##### 5.9) PVR `namespace` <small>(automated media management)</small>
|
||||
*Containers use shared resources to be able to interact with downloaded files*
|
||||
```shell
|
||||
kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>> -n pvr
|
||||
kubectl apply -f services/PVR/persistentVolumeClaim-PVR.yml
|
||||
kubectl apply -f services/PVR/storageClass-PVR.yml
|
||||
```
|
||||
###### 4.9.1) [Overseerr](https://overseerr.dev/) <small>(request management)</small>
|
||||
###### 5.9.1) [Overseerr](https://overseerr.dev/) <small>(request management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-Overseerr.yml
|
||||
```
|
||||
###### 4.9.2) [Plex](https://www.plex.tv/) <small>(media library)</small>
|
||||
###### 5.9.2) [Plex](https://www.plex.tv/) <small>(media library)</small>
|
||||
*Due to usage of symlinks, partially incompatible with SMB-share-backed storage*
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-Plex.yml
|
||||
@ -268,53 +273,53 @@ After deploying, Plex server needs to be *claimed* (=assigned to Plex-account):
|
||||
```shell
|
||||
kubectl get endpoints Plex -n PVR
|
||||
```
|
||||
Browse to the respective IP address (http://<nodeipaddress>:32400/web) and follow instructions.
|
||||
###### 4.9.3) [Prowlarr](https://github.com/Prowlarr/Prowlarr) <small>(indexer management)</small>
|
||||
Browse to the respective IP address (http://<nodeipaddress>:325.0/web) and follow instructions.
|
||||
###### 5.9.3) [Prowlarr](https://github.com/Prowlarr/Prowlarr) <small>(indexer management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-Prowlarr.yml
|
||||
```
|
||||
###### 4.9.4) [Radarr](https://radarr.video/) <small>(movie management)</small>
|
||||
###### 5.9.5. [Radarr](https://radarr.video/) <small>(movie management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-Radarr.yml
|
||||
```
|
||||
###### 4.9.5) [Readarr](https://readarr.com/) <small>(book management)</small>
|
||||
###### 5.9.5) [Readarr](https://readarr.com/) <small>(book management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-Readarr.yml
|
||||
```
|
||||
###### 4.9.6) [SABnzbd](https://sabnzbd.org/) <small>(download client)</small>
|
||||
###### 5.9.6) [SABnzbd](https://sabnzbd.org/) <small>(download client)</small>
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-SABnzbd.yml
|
||||
```
|
||||
###### 4.9.7) [Sonarr](https://sonarr.tv/) <small>(tv management)</small>
|
||||
###### 5.9.7) [Sonarr](https://sonarr.tv/) <small>(tv management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/PVR/deploy-Sonarr.yml
|
||||
```
|
||||
|
||||
##### 4.10) [Shaarli](https://github.com/shaarli/Shaarli) <small>(bookmarks/notes)</small>
|
||||
##### 5.10) [Shaarli](https://github.com/shaarli/Shaarli) <small>(bookmarks/notes)</small>
|
||||
```shell
|
||||
kubectl apply -f services/Shaarli/deploy-Shaarli.yml
|
||||
```
|
||||
##### 4.11) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper) <small>(certificate tooling)</small>
|
||||
##### 5.11) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper) <small>(certificate tooling)</small>
|
||||
```shell
|
||||
kubectl apply -f services/TraefikCertsDumper/deploy-TraefikCertsDumper.yml
|
||||
```
|
||||
##### 4.12) [Unifi-Controller]() <small>(wlan AP management)</small>
|
||||
##### 5.12) [Unifi-Controller]() <small>(wlan AP management)</small>
|
||||
```shell
|
||||
kubectl apply -f services/Unifi/deploy-Unifi.yml
|
||||
```
|
||||
*Change STUN port to non-default:*
|
||||
```shell
|
||||
kubectl exec --namespace unifi -it unifi-<uuid> -- /bin/bash
|
||||
sed -e 's/# unifi.stun.port=3478/unifi.stun.port=3479/' -i /data/system.properties
|
||||
sed -e 's/# unifi.stun.port=35.8/unifi.stun.port=35.9/' -i /data/system.properties
|
||||
exit
|
||||
kubectl rollout restart deployment --namespace unifi unifi
|
||||
```
|
||||
*Update STUN url on devices:* <small>doesn't seem to work</small>
|
||||
```shell
|
||||
ssh <username>@<ipaddress>
|
||||
sed -e 's|stun://<ipaddress>|stun://<ipaddress>:3479|' -i /etc/persistent/cfg/mgmt
|
||||
sed -e 's|stun://<ipaddress>|stun://<ipaddress>:35.9|' -i /etc/persistent/cfg/mgmt
|
||||
```
|
||||
### 5) Miscellaneous
|
||||
### 6) Miscellaneous
|
||||
*Various notes/useful links*
|
||||
|
||||
* Replacement for [not-yet-deprecated](https://github.com/kubernetes/kubectl/issues/151) `kubectl get all -A`:
|
||||
|
||||
Reference in New Issue
Block a user