rodent1 · rodent1 · Nov 12, 2024 · Nov 12, 2024 · Nov 12, 2024 · Nov 12, 2024
diff --git a/.github/workflows/flux-diff.yaml b/.github/workflows/flux-diff.yaml
@@ -36,6 +36,7 @@ jobs:
         uses: tj-actions/changed-files@v45
         with:
           files: kubernetes/**
+          files_ignore: kubernetes/shared/**
           dir_names: true
           dir_names_max_depth: 2
           matrix: true
@@ -93,13 +94,18 @@ jobs:
       - name: Generate Diff
         id: diff
         run: |
-          echo "diff<<EOF" >> $GITHUB_OUTPUT
-          cat diff.patch >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-          echo "### Diff" >> $GITHUB_STEP_SUMMARY
-          echo '```diff' >> $GITHUB_STEP_SUMMARY
-          cat diff.patch >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          cat diff.patch;
+          {
+            echo 'diff<<EOF'
+            cat diff.patch
+            echo EOF
+          } >> "$GITHUB_OUTPUT";
+          {
+            echo "### Diff"
+            echo '```diff'
+            cat diff.patch
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - if: ${{ steps.diff.outputs.diff != '' }}
         name: Add comment

diff --git a/.github/workflows/flux-image-test.yaml b/.github/workflows/flux-image-test.yaml
@@ -36,6 +36,7 @@ jobs:
         uses: tj-actions/changed-files@v45
         with:
           files: kubernetes/**
+          files_ignore: kubernetes/shared/**
           dir_names: true
           dir_names_max_depth: 2
           matrix: true

diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
@@ -11,9 +11,7 @@ jobs:
   labeler:
     name: Labeler
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - name: Generate Token
         uses: actions/create-github-app-token@v1

diff --git a/kubernetes/main/apps/kube-system/cilium/config/ip-pools.yaml b/kubernetes/main/apps/kube-system/cilium/config/ip-pools.yaml
@@ -13,12 +13,12 @@ spec:
 apiVersion: cilium.io/v2alpha1
 kind: CiliumLoadBalancerIPPool
 metadata:
-  name: networking-pool
+  name: network-pool
 spec:
   allowFirstLastIPs: "Yes"
   blocks:
     - start: 10.1.1.150
       stop: 10.1.1.160
   serviceSelector:
     matchLabels:
-      "io.kubernetes.service.namespace": "networking"
+      "io.kubernetes.service.namespace": "network"
diff --git a/kubernetes/main/apps/kube-system/coredns/app/helm-values.yaml b/kubernetes/main/apps/kube-system/coredns/app/helm-values.yaml
@@ -0,0 +1,51 @@
+---
+fullnameOverride: coredns
+replicaCount: 3
+k8sAppLabelOverride: kube-dns
+serviceAccount:
+  create: true
+service:
+  name: kube-dns
+  clusterIP: 10.43.0.10
+servers:
+  - zones:
+      - zone: .
+        scheme: dns://
+        use_tcp: true
+    port: 53
+    plugins:
+      - name: errors
+      - name: health
+        configBlock: |-
+          lameduck 5s
+      - name: ready
+      - name: log
+        configBlock: |-
+          class error
+      - name: prometheus
+        parameters: 0.0.0.0:9153
+      - name: kubernetes
+        parameters: cluster.local in-addr.arpa ip6.arpa
+        configBlock: |-
+          pods insecure
+          fallthrough in-addr.arpa ip6.arpa
+      - name: forward
+        parameters: . /etc/resolv.conf
+      - name: cache
+        parameters: 30
+      - name: loop
+      - name: reload
+      - name: loadbalance
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+tolerations:
+  - key: CriticalAddonsOnly
+    operator: Exists
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
diff --git a/kubernetes/main/apps/kube-system/coredns/app/helmrelease.yaml b/kubernetes/main/apps/kube-system/coredns/app/helmrelease.yaml
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: coredns
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: coredns
+      version: 1.36.1
+      sourceRef:
+        kind: HelmRepository
+        name: coredns
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: coredns-helm-values
diff --git a/kubernetes/main/apps/kube-system/coredns/app/kustomization.yaml b/kubernetes/main/apps/kube-system/coredns/app/kustomization.yaml
@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: coredns-helm-values
+    files:
+      - values.yaml=./helm-values.yaml
+configurations:
+  - kustomizeconfig.yaml
diff --git a/kubernetes/main/apps/kube-system/coredns/app/kustomizeconfig.yaml b/kubernetes/main/apps/kube-system/coredns/app/kustomizeconfig.yaml
@@ -0,0 +1,7 @@
+---
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
diff --git a/kubernetes/main/apps/kube-system/coredns/ks.yaml b/kubernetes/main/apps/kube-system/coredns/ks.yaml
@@ -0,0 +1,20 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app coredns
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/main/apps/kube-system/coredns/app
+  prune: false # never should be deleted
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  timeout: 5m
diff --git a/kubernetes/main/apps/kube-system/kustomization.yaml b/kubernetes/main/apps/kube-system/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./cilium/ks.yaml
+  # - ./coredns/ks.yaml
   - ./kubelet-csr-approver/ks.yaml
   - ./metrics-server/ks.yaml
   - ./spegel/ks.yaml
diff --git a/kubernetes/main/apps/media/audiobookshelf/app/helmrelease.yaml b/kubernetes/main/apps/media/audiobookshelf/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       audiobookshelf:

diff --git a/kubernetes/main/apps/media/audiobookshelf/ks.yaml b/kubernetes/main/apps/media/audiobookshelf/ks.yaml
@@ -12,6 +12,7 @@ spec:
       app.kubernetes.io/name: *app
   dependsOn:
     - name: external-secrets-stores
+    - name: volsync
   path: ./kubernetes/main/apps/media/audiobookshelf/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/bazarr/app/helmrelease.yaml b/kubernetes/main/apps/media/bazarr/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       bazarr:

diff --git a/kubernetes/main/apps/media/bazarr/ks.yaml b/kubernetes/main/apps/media/bazarr/ks.yaml
@@ -12,6 +12,7 @@ spec:
       app.kubernetes.io/name: *app
   dependsOn:
     - name: external-secrets-stores
+    - name: volsync
   path: ./kubernetes/main/apps/media/bazarr/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/jellyfin/app/helmrelease.yaml b/kubernetes/main/apps/media/jellyfin/app/helmrelease.yaml
@@ -27,8 +27,6 @@ spec:
       namespace: system
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       jellyfin:

diff --git a/kubernetes/main/apps/media/jellyfin/ks.yaml b/kubernetes/main/apps/media/jellyfin/ks.yaml
@@ -10,6 +10,8 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
   path: ./kubernetes/main/apps/media/jellyfin/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/overseerr/app/helmrelease.yaml b/kubernetes/main/apps/media/overseerr/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       overseerr:

diff --git a/kubernetes/main/apps/media/overseerr/ks.yaml b/kubernetes/main/apps/media/overseerr/ks.yaml
@@ -10,6 +10,8 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
   path: ./kubernetes/main/apps/media/overseerr/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/plex/app/helmrelease.yaml b/kubernetes/main/apps/media/plex/app/helmrelease.yaml
@@ -27,8 +27,6 @@ spec:
       namespace: system
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       plex:

diff --git a/kubernetes/main/apps/media/plex/ks.yaml b/kubernetes/main/apps/media/plex/ks.yaml
@@ -10,6 +10,8 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
   path: ./kubernetes/main/apps/media/plex/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/qbittorrent/app/helmrelease.yaml b/kubernetes/main/apps/media/qbittorrent/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       qbittorrent:

diff --git a/kubernetes/main/apps/media/qbittorrent/ks.yaml b/kubernetes/main/apps/media/qbittorrent/ks.yaml
@@ -10,6 +10,8 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
   path: ./kubernetes/main/apps/media/qbittorrent/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/recyclarr/app/helmrelease.yaml b/kubernetes/main/apps/media/recyclarr/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       recyclarr:

diff --git a/kubernetes/main/apps/media/recyclarr/ks.yaml b/kubernetes/main/apps/media/recyclarr/ks.yaml
@@ -12,6 +12,7 @@ spec:
       app.kubernetes.io/name: *app
   dependsOn:
     - name: external-secrets-stores
+    - name: volsync
   path: ./kubernetes/main/apps/media/recyclarr/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/tautulli/app/helmrelease.yaml b/kubernetes/main/apps/media/tautulli/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       tautulli:

diff --git a/kubernetes/main/apps/media/tautulli/ks.yaml b/kubernetes/main/apps/media/tautulli/ks.yaml
@@ -10,6 +10,8 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
   path: ./kubernetes/main/apps/media/tautulli/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/media/xteve/app/helmrelease.yaml b/kubernetes/main/apps/media/xteve/app/helmrelease.yaml
@@ -25,8 +25,6 @@ spec:
   dependsOn:
     - name: rook-ceph-cluster
       namespace: rook-ceph
-    - name: volsync
-      namespace: volsync-system
   values:
     controllers:
       xteve:

diff --git a/kubernetes/main/apps/media/xteve/ks.yaml b/kubernetes/main/apps/media/xteve/ks.yaml
@@ -10,6 +10,8 @@ spec:
   commonMetadata:
     labels:
       app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
   path: ./kubernetes/main/apps/media/xteve/app
   prune: true
   sourceRef:

diff --git a/kubernetes/main/apps/networking/cloudflared/app/dnsendpoint.yaml b/kubernetes/main/apps/networking/cloudflared/app/dnsendpoint.yaml
@@ -8,4 +8,4 @@ spec:
   endpoints:
     - dnsName: external.rodent.cc
       recordType: CNAME
-      targets: ["${CLUSTER_CLOUDFLARE_TUNNEL_ID}.cfargotunnel.com"]
+      targets: ["73f66c1e-1048-49b5-bba5-c535ca8162d9.cfargotunnel.com"]
diff --git a/kubernetes/main/apps/networking/cloudflared/app/externalsecret.yaml b/kubernetes/main/apps/networking/cloudflared/app/externalsecret.yaml
@@ -17,7 +17,7 @@ spec:
           {
             "AccountTag": "{{ .CLOUDFLARE_ACCOUNT_TAG }}",
             "TunnelSecret": "{{ .CLOUDFLARE_TUNNEL_SECRET }}",
-            "TunnelID": "${CLUSTER_CLOUDFLARE_TUNNEL_ID}"
+            "TunnelID": "73f66c1e-1048-49b5-bba5-c535ca8162d9"
           }
   dataFrom:
     - extract:

diff --git a/kubernetes/main/apps/networking/cloudflared/app/helmrelease.yaml b/kubernetes/main/apps/networking/cloudflared/app/helmrelease.yaml
@@ -24,7 +24,7 @@ spec:
       retries: 3
   dependsOn:
     - name: nginx-external
-      namespace: networking
+      namespace: network
   values:
     controllers:
       cloudflared:
@@ -49,7 +49,7 @@ spec:
               - --config
               - /etc/cloudflared/config/config.yaml
               - run
-              - "${CLUSTER_CLOUDFLARE_TUNNEL_ID}"
+              - "73f66c1e-1048-49b5-bba5-c535ca8162d9"
             probes:
               liveness: &probes
                 enabled: true

diff --git a/kubernetes/main/apps/networking/cloudflared/app/resources/config.yaml b/kubernetes/main/apps/networking/cloudflared/app/resources/config.yaml
@@ -4,7 +4,7 @@ originRequest:
 
 ingress:
   - hostname: rodent.cc
-    service: https://nginx-external-controller.networking.svc.cluster.local:443
+    service: https://nginx-external-controller.network.svc.cluster.local:443
   - hostname: "*.rodent.cc"
-    service: https://nginx-external-controller.networking.svc.cluster.local:443
+    service: https://nginx-external-controller.network.svc.cluster.local:443
   - service: http_status:404