diff --git a/clusters/kube0/build.nix b/clusters/kube0/build.nix deleted file mode 100644 index 0961011..0000000 --- a/clusters/kube0/build.nix +++ /dev/null @@ -1,2 +0,0 @@ -with import {}; -pkgs.callPackage ./certs.nix {} diff --git a/clusters/kube0/certs.nix b/clusters/kube0/certs.nix deleted file mode 100644 index 7965c9e..0000000 --- a/clusters/kube0/certs.nix +++ /dev/null @@ -1,36 +0,0 @@ -{ pkgs, ...}: -let - pki = pkgs.callPackage ../lib/pki.nix {}; -in -{ - initca = pki.initca; - ca = pki.ca; - apiserver = pki.apiserver '' - "10.253.18.100", - "10.0.0.1", - "127.0.0.1", - "kubernetes", - "kubernetes.default.svc", - "etcd0", - "fs0-2", - "k0-0" - ''; - kube-proxy = pki.kube-proxy; - admin = pki.admin; - etcd = pki.etcd '' - "etcd0", - "etcd1", - "etcd2", - "10.253.18.100", - "10.253.18.101", - "10.253.18.102", - "127.0.0.1" - ''; - k0-0 = pki.worker { name = "k0-0"; ip = "10.253.18.100"; }; - k0-1 = pki.worker { name = "k0-1"; ip = "10.253.18.101"; }; - k0-2 = pki.worker { name = "k0-2"; ip = "10.253.18.102"; }; - k0-3 = pki.worker { name = "k0-3"; ip = "10.253.18.103"; }; - k0-4 = pki.worker { name = "k0-4"; ip = "10.253.18.107"; }; - k0-5 = pki.worker { name = "k0-5"; ip = "10.253.18.108"; }; -} - diff --git a/clusters/kube0/default.nix b/clusters/kube0/default.nix new file mode 100644 index 0000000..e5ff247 --- /dev/null +++ b/clusters/kube0/default.nix @@ -0,0 +1,63 @@ +with import {}; +let + settings = { + clusterName = "kube0"; + master = { + name = "k0-0"; address = "10.253.18.100"; + }; + workers = [ + { name = "k0-1"; address = "10.253.18.101"; } + { name = "k0-2"; address = "10.253.18.102"; } + ]; + cidr = "10.11.0.0/16"; + initca = ./ca; + fileserver = "fs0-0"; + clusterHosts = '' + 10.253.18.106 fs0-0 fs0-0.itpartner.no fs0-0.itpartner.intern + 10.1.2.164 fs0-1 fs0-1.itpartner.no fs0-1.itpartner.intern + + 10.253.18.100 k0-0 k0-0.itpartner.no k0-0.itpartner.intern + 10.253.18.101 k0-1 k0-1.itpartner.no k0-1.itpartner.intern + 10.253.18.102 k0-2 k0-2.itpartner.no k0-2.itpartner.intern + + 10.253.18.109 k1-0 k1-0.itpartner.no k1-0.itpartner.intern + 10.253.18.110 k1-1 k1-1.itpartner.no k1-1.itpartner.intern + 10.253.18.111 k1-2 k1-2.itpartner.no k1-2.itpartner.intern + 10.253.18.108 k1-3 k1-3.itpartner.no k1-3.itpartner.intern + 10.253.18.107 k0-4 k1-4.itpartner.no k1-4.itpartner.intern + + 10.253.18.114 k2-0 k2-0.itpartner.no k2-0.itpartner.intern + 10.253.18.115 k2-1 k2-1.itpartner.no k2-1.itpartner.intern + 10.253.18.116 k2-2 k2-2.itpartner.no k2-2.itpartner.intern + 10.253.18.117 k2-3 k2-3.itpartner.no k2-3.itpartner.intern + 10.253.18.118 k2-4 k2-4.itpartner.no k2-4.itpartner.intern + 10.253.18.103 k2-5 k2-5.itpartner.no k2-5.itpartner.intern + ''; + adminAuthorizedKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiAS30ZO+wgfAqDE9Y7VhRunn2QszPHA5voUwo+fGOf jonas" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMWEYtm1u3HiK4q4J5su6iKWfFjLXt9CIlm9Z9BfJYVj jens@itpartner@Jens-HP3" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCk5EKXxo/KLogjqSxSf/GkQdZ30UxB3wXc5k6Y6RRKQ/5iJ+XyYTbuqYOUp30p54apZzbayU2icahE/upr754lQicQwJtOXW/Iut57VRhSpq4P+mKCIdT58xCUkAZYr8Aja8UjHlYeJgFvp023K/fqmwbapu8R1gh4bzXm7uU1XeJoYfuOb+Cb8NGMn1ICrw2aztA0yVOXZ7tyJd2qyr1+6PuM/Ca2nKN4wLIX2vwyN3vZjR15nkIaHQGlTaJlNk2NEG1YTxsIQ9axDjNtyL80kjUr5M8zxW6s0h3451zr1b21EetP1i+1POIjS9uWXv5iabF+1Qb1GaS4FAYzzpqNY+moLzY7Zqfi05MPsMYkNoZ1Kg5aj0IuZb0OM9i6ZJrFs9nYAGG0uLSUTfrs957f9nokFyILGYg5xY46YN3uQrqfZifvcR0KaEdxEKvnfq0qrNG3uYLR/OYm2yblRcNbWgDoQ1hH7qa9uJM2JrPM07s4sJGkqfAib8Hwz9+l7jMrL6KIGUOA4aX0B1KZaIKKiZa42WlgdbeA17aW3laIqS5mZCkI3pLMYZAxe+A6rQi+V8ZAvDSyOL/Vws3lboXaN5QLu17R8uCY7MkIAvRBiZSpdWNeX3JO5m6zexkxkrFlxyEBf+ott4ATSw+eMYMs8i5xQRqPjgO1cABWkUdGpw== martin.moe.carstens@itpartner.no" + ]; + acme_email = "innovasjon@itpartner.no"; + grafana_smtp_user = "utvikling"; + grafana_smtp_password = "S0m3rp0m@de#21!"; + grafana_ldap_toml = '' + verbose_logging = true + + [[servers]] + host = "itp-dc1.itpartner.intern" + port = 636 + use_ssl = true + start_tls = false + ssl_skip_verify = true + bind_dn = "gitlab@itpartner.intern" + bind_password = "hipp hopp snipp snopp" + search_filter = "(&(objectClass=user)(objectClass=person)(|(sAMAccountName=%s)(mail=%s)))" + search_base_dns = ["DC=itpartner,DC=intern"] + ''; + }; +in + import ../../lib/k8s.nix { + inherit pkgs lib settings; + here = ./.; + } diff --git a/clusters/kube0/deployment.nix b/clusters/kube0/deployment.nix deleted file mode 100644 index 376f1b1..0000000 --- a/clusters/kube0/deployment.nix +++ /dev/null @@ -1,89 +0,0 @@ -with import {}; -let - certs = pkgs.callPackage ./certs.nix {}; - pki = pkgs.callPackage ../lib/pki.nix {}; - cluster = callPackage ../lib/k8s.nix { - masterAddress = "10.253.18.100"; - etcdNodes = [ "etcd0" "etcd1" "etcd2" ]; - clusterHosts = '' - 10.253.18.100 k0-0 etcd0 kubernetes - 10.253.18.101 k0-1 etcd1 - 10.253.18.102 k0-2 etcd2 - 10.253.18.103 k0-3 - 10.253.18.107 k0-4 - 10.253.18.108 k0-5 - 10.253.18.106 fs0-0 fs0-0.local - 10.1.2.164 fs0-1 fs0-1.local - 10.253.18.100 fs0-2 fs0-2.local - 10.253.18.100 itp-registry - 10.253.18.100 nuget.itpartner.no - 10.253.18.109 k1-0 - ''; - certs = { - ca = certs.ca; - apiserver = pki.toSet certs.apiserver; - kube-proxy = pki.toSet certs.kube-proxy; - admin = pki.toSet certs.admin; - etcd = pki.toSet certs.etcd; - k0-0 = pki.toSet certs.k0-0; - k0-1 = pki.toSet certs.k0-1; - k0-2 = pki.toSet certs.k0-2; - k0-3 = pki.toSet certs.k0-3; - k0-4 = pki.toSet certs.k0-4; - k0-5 = pki.toSet certs.k0-5; - }; - }; -in -{ - k0-0 = { ... }: - let - apiserver = pki.toSet certs.apiserver; - in { - require = [ (cluster.apiserver "10.253.18.100" "k0-0" "etcd0") ]; - boot.kernelModules = [ - "dm_snapshot" - "dm_mirror" - "dm_thin_pool" - ]; - # services.dnsmasq.enable = true; - fileSystems."/data" = { - device = "fs0-0:gv0"; - fsType = "glusterfs"; - }; - fileSystems."/var/lib/docker-registry" = { - device = "fs0-0:docker-registry"; - fsType = "nfs4"; - }; - services.dockerRegistry = { - enable = true; - listenAddress = "0.0.0.0"; - enableDelete = true; - enableGarbageCollect = true; - extraConfig = { - REGISTRY_HTTP_TLS_CERTIFICATE = "${apiserver.cert}"; - REGISTRY_HTTP_TLS_KEY = "${apiserver.key}"; - }; - }; - environment.systemPackages = [ pkgs.lvm2 ]; - networking.extraHosts = '' - 10.253.18.100 itp-registry itp-registry.local - 10.253.18.100 helm-registry helm-registry.local - 10.253.18.100 nuget.local - 10.253.18.100 dashboard.k0.local - 10.253.18.100 gitlab.k0.local - 10.253.18.100 baywash.k0.local - ''; - systemd.services.gitlab-upgrade = { - description = "Upgrade gitlab by zapping pod"; - startAt = "Sun 09:00:00"; - script = "kubectl delete pods -n gitlab --all"; - path = [ pkgs.kubectl ]; - }; - }; - - k0-1 = cluster.server "10.253.18.101" "k0-1" "etcd1"; - k0-2 = cluster.server "10.253.18.102" "k0-2" "etcd2"; - k0-3 = cluster.worker "10.253.18.103" "k0-3"; - k0-4 = cluster.worker "10.253.18.107" "k0-4"; - k0-5 = cluster.worker "10.253.18.108" "k0-5"; -} diff --git a/clusters/kube0/k0-3.nix b/clusters/kube0/k0-3.nix deleted file mode 100644 index e380fbb..0000000 --- a/clusters/kube0/k0-3.nix +++ /dev/null @@ -1,21 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, ... }: - -{ - imports = [ ]; - - boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "floppy" "sd_mod" "sr_mod" ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/6b3a3c7b-b8dc-4274-a189-21fbe4d8a488"; - fsType = "ext4"; - }; - - swapDevices = [ ]; - - nix.maxJobs = lib.mkDefault 1; -} diff --git a/clusters/kube0/k0-4.nix b/clusters/kube0/k0-4.nix deleted file mode 100644 index cb8e0f1..0000000 --- a/clusters/kube0/k0-4.nix +++ /dev/null @@ -1,21 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, ... }: - -{ - imports = [ ]; - - boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "floppy" "sd_mod" "sr_mod" ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/241cdf57-a2b5-482d-a522-01725badc859"; - fsType = "ext4"; - }; - - swapDevices = [ ]; - - nix.maxJobs = lib.mkDefault 1; -} diff --git a/clusters/kube0/k0-5.nix b/clusters/kube0/k0-5.nix deleted file mode 100644 index fe4ae9d..0000000 --- a/clusters/kube0/k0-5.nix +++ /dev/null @@ -1,21 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, ... }: - -{ - imports = [ ]; - - boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "floppy" "sd_mod" "sr_mod" ]; - boot.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = - { device = "/dev/disk/by-uuid/67441b95-19f2-484d-b57b-3f4b2a55f3cc"; - fsType = "ext4"; - }; - - swapDevices = [ ]; - - nix.maxJobs = lib.mkDefault 1; -} diff --git a/clusters/kube0/registry-auth-secret.yaml b/clusters/kube0/registry-auth-secret.yaml new file mode 100644 index 0000000..84e46ec --- /dev/null +++ b/clusters/kube0/registry-auth-secret.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +data: + .dockerconfigjson: eyJhdXRocyI6eyJodHRwczovL3JlZ2lzdHJ5Lml0cGFydG5lci5ubyI6eyJ1c2VybmFtZSI6ImpvbmFzIiwicGFzc3dvcmQiOiJTRldwLVk0bkVfdXpNZFJxeHp6SyIsImF1dGgiOiJhbTl1WVhNNlUwWlhjQzFaTkc1RlgzVjZUV1JTY1hoNmVrcz0ifX19 +kind: Secret +metadata: + name: registry-auth +type: kubernetes.io/dockerconfigjson