storage: Add local path provisioner

storage/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+
+resources:
+  - local-path-cm.yaml
+  - storage-class.yaml

storage/local-path-cm.yaml

@@ -0,0 +1,42 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: local-path-config
+  namespace: kube-system
+data:
+  config.json: |-
+    {
+      "nodePathMap": [
+        {
+          "node": "DEFAULT_PATH_FOR_NON_LISTED_NODES",
+          "paths": [
+            "/mnt/data"
+          ]
+        }
+      ],
+      "setupCommand": "/manager",
+      "teardownCommand": "/manager"
+    }
+  setup: |-
+        #!/bin/sh
+        set -eu
+        mkdir -m 0777 -p "$VOL_DIR"
+  teardown: |-
+        #!/bin/sh
+        set -eu
+        rm -rf "$VOL_DIR"
+  helperPod.yaml: |-
+        apiVersion: v1
+        kind: Pod
+        metadata:
+          name: helper-pod
+        spec:
+          priorityClassName: system-node-critical
+          tolerations:
+            - key: node.kubernetes.io/disk-pressure
+              operator: Exists
+              effect: NoSchedule
+          containers:
+          - name: helper-pod
+            image: busybox
+

storage/storage-class.yaml

@@ -0,0 +1,7 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: retain-local-path
+provisioner: rancher.io/local-path
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Retain

traefik/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+
+generators:
+- ./secret-generator.yaml
+
+
+helmCharts:
+  - name: traefik
+    releaseName: traefik
+    version: 25.0.0
+    repo: https://helm.traefik.io/traefik
+    namespace: kube-system
+    includeCRDs: true
+    valuesFile: values.yaml
+

traefik/secret-generator.yaml

@@ -0,0 +1,16 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: authelia-secret-generator
+  annotations:
+    config.kubernetes.io/function: |
+        exec:
+          path: ksops
+secretFrom:
+- metadata:
+    name: traefik-cf-secret
+    namespace: kube-system
+    annotations:
+      kustomize.config.k8s.io/needs-hash: "false"
+  envs:
+  - ./secret.enc.env

traefik/secret.enc.env

@@ -0,0 +1,8 @@
+CF_DNS_API_TOKEN=ENC[AES256_GCM,data:pgwhUhsLXCc4dtXtdPYlhhQ66H8ur7Nj+PWsWaFFtdUtvL5BR2LBLA==,iv:ngsYYLF1ByRsMaYsLcDnGtIRN5+m19LN75o8XV8nWRQ=,tag:ui60I/hhLTJbuRCgRlVYOg==,type:str]
+CF_API_EMAIL=ENC[AES256_GCM,data:VhQlU6MsfhjEjvuRJXSt4mk=,iv:Inv+pthRc8PaAYT48I05ImF1JJtYwqWB2g57kH0UyI4=,tag:0zrcVQJMTdUE6rW9QZweWg==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzK2EraFF2aURMMnFRZjF5\nS3FDZHRwNldBbldyMTlCZ0d3MmowK29qMzJvCk9KL01CZERTL0haZFRBci9MazNy\naTlNQTk2Yk9TWSs2QUdRNlJweTNMTm8KLS0tIG13OWFBUi92UG54a1FobUdmQkhh\nZCtzZHFtSlhnSUFobU1DeTR2Qy9ib2sKcNKGJLPhJkZ5h3FMYi4oxMatlhgpfXws\nWI9h6x4aTJAvQXUHWQXieA4SlCE6vO1pesLDuoNdsyPZIQaW6i6+Fw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age14dgmts59tc2gv2xu9305auvu854n3pfl8vkheqzzqyrygyeequ0sjhl92v
+sops_lastmodified=2023-11-28T21:12:41Z
+sops_mac=ENC[AES256_GCM,data:G9f/oSqe+ewSY7F72//Q3vNbBN5C9+mTTF/Vxwd22sc32rpgB2Zv2xbofb/yMcBZnTHBjYsW3pDKYvKC134BOezdQs7HoC5QcQ1O4OfSIV26uuXqHz2JZfHadrhkSjT1zLSV4NakAEsAj9U2XlepYWRtmGhUW5ElxCkocgHR+KI=,iv:CwgkHxqUGB/vjQePH3tI+Q5cBkkSwgJnrfE9dhaxTWs=,tag:pCBDRFtdbnUqb25czJKj5A==,type:str]
+sops_unencrypted_regex=^(apiVersion|metadata|kind|type)$
+sops_version=3.8.1

traefik/values.yaml

@@ -0,0 +1,67 @@
+
+deployment:
+  initContainers:
+  - name: volume-permissions
+    image: busybox:latest
+    command: ["sh", "-c", "rm /data/acme.json; touch /data/acme.json; chown 65532:65532 /data/acme.json; chmod -v 600 /data/acme.json; chown -R 65532:65532 /var/log/traefik"]
+    securityContext:
+      runAsNonRoot: false
+      runAsGroup: 0
+      runAsUser: 0
+    volumeMounts:
+      - name: data
+        mountPath: /data
+      - name: access-log
+        mountPath: /var/log/traefik
+  additionalVolumes:
+  - name: access-log
+    hostPath:
+      path:  /var/log/traefik/
+certResolvers:
+  letsencrypt:
+    email: namesny.matus@gmail.com
+    dnsChallenge:
+      provider: cloudflare
+      delayBeforeCheck: 30
+      resolvers:
+      - 1.1.1.1
+      - 8.8.8.8
+    storage: /data/acme.json
+envFrom:
+- secretRef:
+    name: traefik-cf-secret
+additionalVolumeMounts:
+- name: access-log
+  mountPath: /var/log/traefik/
+logs:
+  access:
+    enabled: true
+    filePath: /var/log/traefik/access.log
+ingressRoute:
+  dashboard:
+    enabled: true
+    matchRule: Host(`traefik.namesny.com`)
+    entryPoints: ["websecure"]
+    middlewares:
+      - name: "auth-authelia@kubernetescrd"
+providers:
+  kubernetesCRD:
+    allowCrossNamespace: true
+persistence:
+  enabled: true
+  storageClass: retain-local-path
+ports:
+  websecure:
+    tls:
+      enabled: true
+      certResolver: letsencrypt
+      domains:
+      - main: namesny.com
+        sans:
+        - "*.namesny.com"
+  web:
+    redirectTo:
+      port: websecure
+service:
+  spec:
+    externalTrafficPolicy: Local