k3s: wipe netbird/traefik manifests, back to bare k3s
This commit is contained in:
+1
-14
@@ -1,22 +1,9 @@
|
||||
{
|
||||
networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ];
|
||||
networking.firewall.allowedUDPPorts = [ 3479 ];
|
||||
networking.firewall.allowedTCPPorts = [ 6443 80 443 ];
|
||||
|
||||
services.k3s = {
|
||||
enable = true;
|
||||
role = "server";
|
||||
extraFlags = "--write-kubeconfig-mode 644";
|
||||
manifests = {
|
||||
traefik-namespace = { source = ./traefik/namespace.yaml; };
|
||||
traefik-rbac = { source = ./traefik/rbac.yaml; };
|
||||
traefik-pvc = { source = ./traefik/pvc.yaml; };
|
||||
traefik-deployment = { source = ./traefik/deployment.yaml; };
|
||||
traefik-service = { source = ./traefik/service.yaml; };
|
||||
netbird-namespace = { source = ./netbird/namespace.yaml; };
|
||||
netbird-config = { source = ./netbird/config.yaml; };
|
||||
netbird-server = { source = ./netbird/server.yaml; };
|
||||
netbird-dashboard = { source = ./netbird/dashboard.yaml; };
|
||||
netbird-ingress = { source = ./netbird/ingress.yaml; };
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: netbird-server-config
|
||||
namespace: netbird
|
||||
data:
|
||||
config.yaml.tpl: |
|
||||
server:
|
||||
listenAddress: ":80"
|
||||
exposedAddress: "https://netbird.archfox.org:443"
|
||||
metricsPort: 9090
|
||||
healthcheckAddress: ":9000"
|
||||
logLevel: "info"
|
||||
logFile: "console"
|
||||
stunPorts:
|
||||
- 3479
|
||||
tls:
|
||||
certFile: ""
|
||||
keyFile: ""
|
||||
letsencrypt:
|
||||
enabled: false
|
||||
dataDir: ""
|
||||
domains: []
|
||||
email: ""
|
||||
awsRoute53: false
|
||||
authSecret: "__AUTH_SECRET__"
|
||||
dataDir: "/var/lib/netbird/"
|
||||
disableAnonymousMetrics: false
|
||||
disableGeoliteUpdate: false
|
||||
auth:
|
||||
issuer: "https://netbird.archfox.org/oauth2"
|
||||
localAuthDisabled: false
|
||||
signKeyRefreshEnabled: true
|
||||
dashboardRedirectURIs:
|
||||
- "https://netbird.archfox.org/nb-auth"
|
||||
- "https://netbird.archfox.org/nb-silent-auth"
|
||||
cliRedirectURIs:
|
||||
- "http://localhost:53000/"
|
||||
store:
|
||||
engine: "sqlite"
|
||||
dsn: ""
|
||||
encryptionKey: ""
|
||||
reverseProxy:
|
||||
trustedHTTPProxies:
|
||||
- "10.0.1.45/32"
|
||||
@@ -1,56 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: dashboard
|
||||
namespace: netbird
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: dashboard
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: dashboard
|
||||
spec:
|
||||
containers:
|
||||
- name: dashboard
|
||||
image: netbirdio/dashboard:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
env:
|
||||
- name: NETBIRD_MGMT_API_ENDPOINT
|
||||
value: "https://netbird.archfox.org"
|
||||
- name: NETBIRD_MGMT_GRPC_API_ENDPOINT
|
||||
value: "https://netbird.archfox.org"
|
||||
- name: AUTH_AUDIENCE
|
||||
value: "netbird-dashboard"
|
||||
- name: AUTH_CLIENT_ID
|
||||
value: "netbird-dashboard"
|
||||
- name: AUTH_CLIENT_SECRET
|
||||
value: ""
|
||||
- name: AUTH_AUTHORITY
|
||||
value: "https://netbird.archfox.org/oauth2"
|
||||
- name: USE_AUTH0
|
||||
value: "false"
|
||||
- name: AUTH_SUPPORTED_SCOPES
|
||||
value: "openid profile email groups"
|
||||
- name: AUTH_REDIRECT_URI
|
||||
value: "/nb-auth"
|
||||
- name: AUTH_SILENT_REDIRECT_URI
|
||||
value: "/nb-silent-auth"
|
||||
- name: LETSENCRYPT_DOMAIN
|
||||
value: "none"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: dashboard
|
||||
namespace: netbird
|
||||
spec:
|
||||
selector:
|
||||
app: dashboard
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: netbird
|
||||
namespace: netbird
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
routes:
|
||||
- match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`))
|
||||
kind: Rule
|
||||
services:
|
||||
- name: netbird-server
|
||||
port: 80
|
||||
scheme: h2c
|
||||
- match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
|
||||
kind: Rule
|
||||
services:
|
||||
- name: netbird-server
|
||||
port: 80
|
||||
- match: Host(`netbird.archfox.org`)
|
||||
kind: Rule
|
||||
priority: 1
|
||||
services:
|
||||
- name: dashboard
|
||||
port: 80
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: netbird
|
||||
@@ -1,95 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: netbird-server
|
||||
namespace: netbird
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: netbird-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: netbird-server
|
||||
spec:
|
||||
initContainers:
|
||||
- name: render-config
|
||||
image: busybox
|
||||
env:
|
||||
- name: AUTH_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: netbird-relay-auth
|
||||
key: authSecret
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
sed "s|__AUTH_SECRET__|$AUTH_SECRET|g" /tpl/config.yaml.tpl > /etc/netbird/config.yaml
|
||||
volumeMounts:
|
||||
- name: config-tpl
|
||||
mountPath: /tpl
|
||||
- name: config-rendered
|
||||
mountPath: /etc/netbird
|
||||
containers:
|
||||
- name: netbird-server
|
||||
image: netbirdio/netbird-server:latest
|
||||
args: ["--config", "/etc/netbird/config.yaml"]
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 3479
|
||||
protocol: UDP
|
||||
- containerPort: 33073
|
||||
env:
|
||||
- name: NETBIRD_STORE_ENCRYPTION_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: netbird-encryption
|
||||
key: encryptionKey
|
||||
volumeMounts:
|
||||
- name: config-rendered
|
||||
mountPath: /etc/netbird
|
||||
- name: data
|
||||
mountPath: /var/lib/netbird
|
||||
volumes:
|
||||
- name: config-tpl
|
||||
configMap:
|
||||
name: netbird-server-config
|
||||
- name: config-rendered
|
||||
emptyDir: {}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: netbird-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: netbird-data
|
||||
namespace: netbird
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: netbird-server
|
||||
namespace: netbird
|
||||
spec:
|
||||
selector:
|
||||
app: netbird-server
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: grpc-compat
|
||||
port: 33073
|
||||
targetPort: 33073
|
||||
- name: stun
|
||||
port: 3479
|
||||
targetPort: 3479
|
||||
protocol: UDP
|
||||
@@ -1,35 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
serviceAccountName: traefik
|
||||
containers:
|
||||
- name: traefik
|
||||
image: traefik:v3.4
|
||||
args:
|
||||
- --log.level=INFO
|
||||
- --api.dashboard=true
|
||||
- --entrypoints.web.address=:80
|
||||
- --providers.kubernetescrd=true
|
||||
- --providers.kubernetesingress=true
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 80
|
||||
volumeMounts:
|
||||
- name: acme-storage
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: acme-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: traefik-acme
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: traefik
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: traefik-acme
|
||||
namespace: traefik
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 128Mi
|
||||
@@ -1,41 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: traefik
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["traefik.io"]
|
||||
resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares",
|
||||
"middlewaretcps", "tlsoptions", "tlsstores", "traefikservices",
|
||||
"serverstransports", "serverstransporttcps"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: traefik
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: traefik
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: traefik
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: web
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: websecure
|
||||
port: 443
|
||||
targetPort: 443
|
||||
Reference in New Issue
Block a user