oceanbox/platform
6
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add kube0 cluster

Browse Source
This commit is contained in:
Jonas Juselius
2020-02-27 15:45:11 +01:00
parent 060d519201
commit 1d8a15fca4
8 changed files with 70 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
clusters/kube0/build.nix
View File

@@ -1,2 +0,0 @@
with import <nixpkgs> {};
pkgs.callPackage ./certs.nix {}

36
clusters/kube0/certs.nix
View File

@@ -1,36 +0,0 @@
{ pkgs, ...}:
let
pki = pkgs.callPackage ../lib/pki.nix {};
in
{
initca = pki.initca;
ca = pki.ca;
apiserver = pki.apiserver ''
"10.253.18.100",
"10.0.0.1",
"127.0.0.1",
"kubernetes",
"kubernetes.default.svc",
"etcd0",
"fs0-2",
"k0-0"
'';
kube-proxy = pki.kube-proxy;
admin = pki.admin;
etcd = pki.etcd ''
"etcd0",
"etcd1",
"etcd2",
"10.253.18.100",
"10.253.18.101",
"10.253.18.102",
"127.0.0.1"
'';
k0-0 = pki.worker { name = "k0-0"; ip = "10.253.18.100"; };
k0-1 = pki.worker { name = "k0-1"; ip = "10.253.18.101"; };
k0-2 = pki.worker { name = "k0-2"; ip = "10.253.18.102"; };
k0-3 = pki.worker { name = "k0-3"; ip = "10.253.18.103"; };
k0-4 = pki.worker { name = "k0-4"; ip = "10.253.18.107"; };
k0-5 = pki.worker { name = "k0-5"; ip = "10.253.18.108"; };
}

63
clusters/kube0/default.nix Normal file
View File

@@ -0,0 +1,63 @@
with import <nixpkgs> {};
let
settings = {
clusterName = "kube0";
master = {
name = "k0-0"; address = "10.253.18.100";
};
workers = [
{ name = "k0-1"; address = "10.253.18.101"; }
{ name = "k0-2"; address = "10.253.18.102"; }
];
cidr = "10.11.0.0/16";
initca = ./ca;
fileserver = "fs0-0";
clusterHosts = ''
10.253.18.106 fs0-0 fs0-0.itpartner.no fs0-0.itpartner.intern
10.1.2.164 fs0-1 fs0-1.itpartner.no fs0-1.itpartner.intern
10.253.18.100 k0-0 k0-0.itpartner.no k0-0.itpartner.intern
10.253.18.101 k0-1 k0-1.itpartner.no k0-1.itpartner.intern
10.253.18.102 k0-2 k0-2.itpartner.no k0-2.itpartner.intern
10.253.18.109 k1-0 k1-0.itpartner.no k1-0.itpartner.intern
10.253.18.110 k1-1 k1-1.itpartner.no k1-1.itpartner.intern
10.253.18.111 k1-2 k1-2.itpartner.no k1-2.itpartner.intern
10.253.18.108 k1-3 k1-3.itpartner.no k1-3.itpartner.intern
10.253.18.107 k0-4 k1-4.itpartner.no k1-4.itpartner.intern
10.253.18.114 k2-0 k2-0.itpartner.no k2-0.itpartner.intern
10.253.18.115 k2-1 k2-1.itpartner.no k2-1.itpartner.intern
10.253.18.116 k2-2 k2-2.itpartner.no k2-2.itpartner.intern
10.253.18.117 k2-3 k2-3.itpartner.no k2-3.itpartner.intern
10.253.18.118 k2-4 k2-4.itpartner.no k2-4.itpartner.intern
10.253.18.103 k2-5 k2-5.itpartner.no k2-5.itpartner.intern
'';
adminAuthorizedKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiAS30ZO+wgfAqDE9Y7VhRunn2QszPHA5voUwo+fGOf jonas"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMWEYtm1u3HiK4q4J5su6iKWfFjLXt9CIlm9Z9BfJYVj jens@itpartner@Jens-HP3"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCk5EKXxo/KLogjqSxSf/GkQdZ30UxB3wXc5k6Y6RRKQ/5iJ+XyYTbuqYOUp30p54apZzbayU2icahE/upr754lQicQwJtOXW/Iut57VRhSpq4P+mKCIdT58xCUkAZYr8Aja8UjHlYeJgFvp023K/fqmwbapu8R1gh4bzXm7uU1XeJoYfuOb+Cb8NGMn1ICrw2aztA0yVOXZ7tyJd2qyr1+6PuM/Ca2nKN4wLIX2vwyN3vZjR15nkIaHQGlTaJlNk2NEG1YTxsIQ9axDjNtyL80kjUr5M8zxW6s0h3451zr1b21EetP1i+1POIjS9uWXv5iabF+1Qb1GaS4FAYzzpqNY+moLzY7Zqfi05MPsMYkNoZ1Kg5aj0IuZb0OM9i6ZJrFs9nYAGG0uLSUTfrs957f9nokFyILGYg5xY46YN3uQrqfZifvcR0KaEdxEKvnfq0qrNG3uYLR/OYm2yblRcNbWgDoQ1hH7qa9uJM2JrPM07s4sJGkqfAib8Hwz9+l7jMrL6KIGUOA4aX0B1KZaIKKiZa42WlgdbeA17aW3laIqS5mZCkI3pLMYZAxe+A6rQi+V8ZAvDSyOL/Vws3lboXaN5QLu17R8uCY7MkIAvRBiZSpdWNeX3JO5m6zexkxkrFlxyEBf+ott4ATSw+eMYMs8i5xQRqPjgO1cABWkUdGpw== martin.moe.carstens@itpartner.no"
];
acme_email = "innovasjon@itpartner.no";
grafana_smtp_user = "utvikling";
grafana_smtp_password = "S0m3rp0m@de#21!";
grafana_ldap_toml = ''
verbose_logging = true
[[servers]]
host = "itp-dc1.itpartner.intern"
port = 636
use_ssl = true
start_tls = false
ssl_skip_verify = true
bind_dn = "gitlab@itpartner.intern"
bind_password = "hipp hopp snipp snopp"
search_filter = "(&(objectClass=user)(objectClass=person)(|(sAMAccountName=%s)(mail=%s)))"
search_base_dns = ["DC=itpartner,DC=intern"]
'';
};
in
import ../../lib/k8s.nix {
inherit pkgs lib settings;
here = ./.;
}

89
clusters/kube0/deployment.nix
View File

@@ -1,89 +0,0 @@
with import <nixpkgs> {};
let
certs = pkgs.callPackage ./certs.nix {};
pki = pkgs.callPackage ../lib/pki.nix {};
cluster = callPackage ../lib/k8s.nix {
masterAddress = "10.253.18.100";
etcdNodes = [ "etcd0" "etcd1" "etcd2" ];
clusterHosts = ''
10.253.18.100 k0-0 etcd0 kubernetes
10.253.18.101 k0-1 etcd1
10.253.18.102 k0-2 etcd2
10.253.18.103 k0-3
10.253.18.107 k0-4
10.253.18.108 k0-5
10.253.18.106 fs0-0 fs0-0.local
10.1.2.164 fs0-1 fs0-1.local
10.253.18.100 fs0-2 fs0-2.local
10.253.18.100 itp-registry
10.253.18.100 nuget.itpartner.no
10.253.18.109 k1-0
'';
certs = {
ca = certs.ca;
apiserver = pki.toSet certs.apiserver;
kube-proxy = pki.toSet certs.kube-proxy;
admin = pki.toSet certs.admin;
etcd = pki.toSet certs.etcd;
k0-0 = pki.toSet certs.k0-0;
k0-1 = pki.toSet certs.k0-1;
k0-2 = pki.toSet certs.k0-2;
k0-3 = pki.toSet certs.k0-3;
k0-4 = pki.toSet certs.k0-4;
k0-5 = pki.toSet certs.k0-5;
};
};
in
{
k0-0 = { ... }:
let
apiserver = pki.toSet certs.apiserver;
in {
require = [ (cluster.apiserver "10.253.18.100" "k0-0" "etcd0") ];
boot.kernelModules = [
"dm_snapshot"
"dm_mirror"
"dm_thin_pool"
];
# services.dnsmasq.enable = true;
fileSystems."/data" = {
device = "fs0-0:gv0";
fsType = "glusterfs";
};
fileSystems."/var/lib/docker-registry" = {
device = "fs0-0:docker-registry";
fsType = "nfs4";
};
services.dockerRegistry = {
enable = true;
listenAddress = "0.0.0.0";
enableDelete = true;
enableGarbageCollect = true;
extraConfig = {
REGISTRY_HTTP_TLS_CERTIFICATE = "${apiserver.cert}";
REGISTRY_HTTP_TLS_KEY = "${apiserver.key}";
};
};
environment.systemPackages = [ pkgs.lvm2 ];
networking.extraHosts = ''
10.253.18.100 itp-registry itp-registry.local
10.253.18.100 helm-registry helm-registry.local
10.253.18.100 nuget.local
10.253.18.100 dashboard.k0.local
10.253.18.100 gitlab.k0.local
10.253.18.100 baywash.k0.local
'';
systemd.services.gitlab-upgrade = {
description = "Upgrade gitlab by zapping pod";
startAt = "Sun 09:00:00";
script = "kubectl delete pods -n gitlab --all";
path = [ pkgs.kubectl ];
};
};
k0-1 = cluster.server "10.253.18.101" "k0-1" "etcd1";
k0-2 = cluster.server "10.253.18.102" "k0-2" "etcd2";
k0-3 = cluster.worker "10.253.18.103" "k0-3";
k0-4 = cluster.worker "10.253.18.107" "k0-4";
k0-5 = cluster.worker "10.253.18.108" "k0-5";
}

21
clusters/kube0/k0-3.nix
View File

@@ -1,21 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, ... }:
{
imports = [ ];
boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "floppy" "sd_mod" "sr_mod" ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/6b3a3c7b-b8dc-4274-a189-21fbe4d8a488";
fsType = "ext4";
};
swapDevices = [ ];
nix.maxJobs = lib.mkDefault 1;
}

21
clusters/kube0/k0-4.nix
View File

@@ -1,21 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, ... }:
{
imports = [ ];
boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "floppy" "sd_mod" "sr_mod" ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/241cdf57-a2b5-482d-a522-01725badc859";
fsType = "ext4";
};
swapDevices = [ ];
nix.maxJobs = lib.mkDefault 1;
}

21
clusters/kube0/k0-5.nix
View File

@@ -1,21 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, ... }:
{
imports = [ ];
boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "floppy" "sd_mod" "sr_mod" ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/67441b95-19f2-484d-b57b-3f4b2a55f3cc";
fsType = "ext4";
};
swapDevices = [ ];
nix.maxJobs = lib.mkDefault 1;
}

7
clusters/kube0/registry-auth-secret.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
data:
.dockerconfigjson: eyJhdXRocyI6eyJodHRwczovL3JlZ2lzdHJ5Lml0cGFydG5lci5ubyI6eyJ1c2VybmFtZSI6ImpvbmFzIiwicGFzc3dvcmQiOiJTRldwLVk0bkVfdXpNZFJxeHp6SyIsImF1dGgiOiJhbTl1WVhNNlUwWlhjQzFaTkc1RlgzVjZUV1JTY1hoNmVrcz0ifX19
kind: Secret
metadata:
name: registry-auth
type: kubernetes.io/dockerconfigjson