oceanbox/platform
6
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Secure certificates after generation

Browse Source
This commit is contained in:
Jonas Juselius
2019-02-23 15:34:28 +01:00
parent cce9aa825b
commit 66d29be22c
19 changed files with 2098 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
kube0/build.nix Normal file
View File

@@ -0,0 +1,2 @@
with import <nixpkgs> {};
pkgs.callPackage ./certs.nix {}

36
kube0/certs.nix Normal file
View File

@@ -0,0 +1,36 @@
{ pkgs, ...}:
let
pki = pkgs.callPackage ../lib/pki.nix {};
in
{
initca = pki.initca;
ca = pki.ca;
apiserver = pki.apiserver ''
"10.253.18.100",
"10.0.0.1",
"127.0.0.1",
"kubernetes",
"kubernetes.default.svc",
"etcd0",
"fs0-2",
"k0-0"
'';
kube-proxy = pki.kube-proxy;
admin = pki.admin;
etcd = pki.etcd ''
"etcd0",
"etcd1",
"etcd2",
"10.253.18.100",
"10.253.18.101",
"10.253.18.102",
"127.0.0.1"
'';
k0-0 = pki.worker { name = "k0-0"; ip = "10.253.18.100"; };
k0-1 = pki.worker { name = "k0-1"; ip = "10.253.18.101"; };
k0-2 = pki.worker { name = "k0-2"; ip = "10.253.18.102"; };
k0-3 = pki.worker { name = "k0-3"; ip = "10.253.18.103"; };
k0-4 = pki.worker { name = "k0-4"; ip = "10.253.18.107"; };
k0-5 = pki.worker { name = "k0-5"; ip = "10.253.18.108"; };
}

77
kube0/deployment.nix Normal file
View File

@@ -0,0 +1,77 @@
with import <nixpkgs> {};
let
certs = pkgs.callPackage ./certs.nix {};
pki = pkgs.callPackage ../lib/pki.nix {};
cluster = callPackage ../lib/k8s.nix {
masterNode = "10.253.18.100";
etcdNodes = [ "etcd0" "etcd1" "etcd2" ];
clusterHosts = ''
10.253.18.100 k0-0 etcd0 kubernetes
10.253.18.101 k0-1 etcd1
10.253.18.102 k0-2 etcd2
10.253.18.103 k0-3
10.253.18.107 k0-4
10.253.18.108 k0-5
10.253.18.106 fs0-0 fs0-0.local
10.1.2.164 fs0-1 fs0-1.local
10.253.18.100 fs0-2 fs0-2.local
10.253.18.100 itp-registry registry.itpartner.no minio.itpartner.no
10.253.18.100 nuget.itpartner.no
10.253.18.109 k1-0
'';
certs = {
ca = certs.ca;
apiserver = pki.toSet certs.apiserver;
kube-proxy = pki.toSet certs.kube-proxy;
admin = pki.toSet certs.admin;
etcd = pki.toSet certs.etcd;
k0-0 = pki.toSet certs.k0-0;
k0-1 = pki.toSet certs.k0-1;
k0-2 = pki.toSet certs.k0-2;
k0-3 = pki.toSet certs.k0-3;
k0-4 = pki.toSet certs.k0-4;
k0-5 = pki.toSet certs.k0-5;
};
};
in
{
k0-0 = { ... }: {
require = [ (cluster.apiserver "10.253.18.100" "k0-0" "etcd0") ];
boot.kernelModules = [
"dm_snapshot"
"dm_mirror"
"dm_thin_pool"
];
# services.dnsmasq.enable = true;
fileSystems."/data" = {
device = "fs0-0:gv0";
fsType = "glusterfs";
};
fileSystems."/var/lib/docker-registry" = {
device = "fs0-0:docker-registry";
fsType = "nfs4";
};
environment.systemPackages = [ pkgs.lvm2 ];
networking.extraHosts = ''
10.253.18.100 itp-registry itp-registry.local
10.253.18.100 helm-registry helm-registry.local
10.253.18.100 gitlab.itpartner.no registry.itpartner.no minio.itpartner.no
10.253.18.100 nuget.local
10.253.18.100 dashboard.k0.local
10.253.18.100 gitlab.k0.local
10.253.18.100 baywash.k0.local
'';
systemd.services.gitlab-upgrade = {
description = "Upgrade gitlab by zapping pod";
startAt = "Sun 09:00:00";
script = "kubectl delete pods -n gitlab --all";
path = [ pkgs.kubectl ];
};
};
k0-1 = cluster.server "10.253.18.101" "k0-1" "etcd1";
k0-2 = cluster.server "10.253.18.102" "k0-2" "etcd2";
k0-3 = cluster.worker "10.253.18.103" "k0-3";
k0-4 = cluster.worker "10.253.18.107" "k0-4";
k0-5 = cluster.worker "10.253.18.108" "k0-5";
}