commit c44c2f6736fbcc8a8e329e5672c6011a19f20652 Author: duynguyen Date: Sun Jun 14 16:00:21 2026 +0700 initial bootstrap: argocd, metallb, envoy-gateway, nfs-provisioner diff --git a/bootstrap/apps/envoy-gateway-config.yaml b/bootstrap/apps/envoy-gateway-config.yaml new file mode 100644 index 0000000..18c5d88 --- /dev/null +++ b/bootstrap/apps/envoy-gateway-config.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: envoy-gateway-config + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + project: default + source: + repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git + targetRevision: main + path: manifests/envoy-gateway-config + destination: + server: https://kubernetes.default.svc + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - SkipDryRunOnMissingResource=true diff --git a/bootstrap/apps/envoy-gateway.yaml b/bootstrap/apps/envoy-gateway.yaml new file mode 100644 index 0000000..437b542 --- /dev/null +++ b/bootstrap/apps/envoy-gateway.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: envoy-gateway + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + project: default + sources: + - repoURL: https://charts.gateway.envoyproxy.io + chart: gateway-helm + targetRevision: "v1.7.1" + helm: + valueFiles: + - $values/manifests/envoy-gateway/values.yaml + - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: envoy-gateway-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/bootstrap/apps/metallb-config.yaml b/bootstrap/apps/metallb-config.yaml new file mode 100644 index 0000000..35446c5 --- /dev/null +++ b/bootstrap/apps/metallb-config.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-config + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + project: default + source: + repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git + targetRevision: main + path: manifests/metallb-config + destination: + server: https://kubernetes.default.svc + namespace: metallb-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - SkipDryRunOnMissingResource=true diff --git a/bootstrap/apps/metallb.yaml b/bootstrap/apps/metallb.yaml new file mode 100644 index 0000000..4738a67 --- /dev/null +++ b/bootstrap/apps/metallb.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + project: default + sources: + - repoURL: https://metallb.github.io/metallb + chart: metallb + targetRevision: "0.14.9" + helm: + valueFiles: + - $values/manifests/metallb/values.yaml + - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: metallb-system + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/bootstrap/apps/nfs-provisioner.yaml b/bootstrap/apps/nfs-provisioner.yaml new file mode 100644 index 0000000..ff0a6bd --- /dev/null +++ b/bootstrap/apps/nfs-provisioner.yaml @@ -0,0 +1,28 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: nfs-provisioner + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + project: default + sources: + - repoURL: https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/ + chart: nfs-subdir-external-provisioner + targetRevision: "4.0.18" + helm: + valueFiles: + - $values/manifests/nfs-provisioner/values.yaml + - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git + targetRevision: main + ref: values + destination: + server: https://kubernetes.default.svc + namespace: nfs-provisioner + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/manifests/argocd/httproute.yaml b/manifests/argocd/httproute.yaml new file mode 100644 index 0000000..8634482 --- /dev/null +++ b/manifests/argocd/httproute.yaml @@ -0,0 +1,19 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: argocd + namespace: argocd +spec: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway-system + hostnames: + - "argocd.fireflylab.local" + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: argocd-server + port: 80 diff --git a/manifests/argocd/values.yaml b/manifests/argocd/values.yaml new file mode 100644 index 0000000..b9ab66f --- /dev/null +++ b/manifests/argocd/values.yaml @@ -0,0 +1,23 @@ +nameOverride: argocd + +crds: + install: true + keep: true + annotations: + argocd.argoproj.io/sync-options: ServerSideApply=true + +global: + domain: argocd.fireflylab.local + image: + repository: quay.io/argoproj/argocd + pullPolicy: IfNotPresent + logging: + format: text + level: info + +configs: + params: + server.insecure: true # TLS terminated at Envoy Gateway + +server: + replicas: 1 diff --git a/manifests/envoy-gateway-config/envoy-proxy.yaml b/manifests/envoy-gateway-config/envoy-proxy.yaml new file mode 100644 index 0000000..767d084 --- /dev/null +++ b/manifests/envoy-gateway-config/envoy-proxy.yaml @@ -0,0 +1,20 @@ +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: EnvoyProxy +metadata: + name: envoy-daemon-proxy + namespace: envoy-gateway-system +spec: + provider: + type: Kubernetes + kubernetes: + envoyDaemonSet: + container: + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 1024Mi + envoyService: + type: LoadBalancer + externalTrafficPolicy: Cluster diff --git a/manifests/envoy-gateway-config/gateway.yaml b/manifests/envoy-gateway-config/gateway.yaml new file mode 100644 index 0000000..4c7b541 --- /dev/null +++ b/manifests/envoy-gateway-config/gateway.yaml @@ -0,0 +1,19 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: envoy-gateway + namespace: envoy-gateway-system +spec: + gatewayClassName: envoy-gateway-class + infrastructure: + parametersRef: + group: gateway.envoyproxy.io + kind: EnvoyProxy + name: envoy-daemon-proxy + listeners: + - name: http + port: 80 + protocol: HTTP + allowedRoutes: + namespaces: + from: All diff --git a/manifests/envoy-gateway-config/gatewayclass.yaml b/manifests/envoy-gateway-config/gatewayclass.yaml new file mode 100644 index 0000000..cc7681d --- /dev/null +++ b/manifests/envoy-gateway-config/gatewayclass.yaml @@ -0,0 +1,6 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: GatewayClass +metadata: + name: envoy-gateway-class +spec: + controllerName: gateway.envoyproxy.io/gatewayclass-controller diff --git a/manifests/envoy-gateway/values.yaml b/manifests/envoy-gateway/values.yaml new file mode 100644 index 0000000..5743c57 --- /dev/null +++ b/manifests/envoy-gateway/values.yaml @@ -0,0 +1,31 @@ +global: + images: + envoyGateway: + image: docker.io/envoyproxy/gateway:v1.7.1 + pullPolicy: IfNotPresent + ratelimit: + image: docker.io/envoyproxy/ratelimit:c8765e89 + pullPolicy: IfNotPresent + +deployment: + replicas: 1 + envoyGateway: + resources: + limits: + memory: 1024Mi + requests: + cpu: 100m + memory: 256Mi + +service: + type: ClusterIP + +config: + envoyGateway: + gateway: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + provider: + type: Kubernetes + logging: + level: + default: info diff --git a/manifests/metallb-config/ipaddresspool.yaml b/manifests/metallb-config/ipaddresspool.yaml new file mode 100644 index 0000000..ff52e1c --- /dev/null +++ b/manifests/metallb-config/ipaddresspool.yaml @@ -0,0 +1,9 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: expensive + namespace: metallb-system +spec: + addresses: + - 192.168.1.30/32 + autoAssign: true diff --git a/manifests/metallb-config/l2advertisement.yaml b/manifests/metallb-config/l2advertisement.yaml new file mode 100644 index 0000000..26130d9 --- /dev/null +++ b/manifests/metallb-config/l2advertisement.yaml @@ -0,0 +1,8 @@ +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: l2-advertisement + namespace: metallb-system +spec: + ipAddressPools: + - expensive diff --git a/manifests/metallb/values.yaml b/manifests/metallb/values.yaml new file mode 100644 index 0000000..a1a1d42 --- /dev/null +++ b/manifests/metallb/values.yaml @@ -0,0 +1,12 @@ +controller: + enabled: true + logLevel: info + +speaker: + enabled: true + logLevel: info + tolerateMaster: true + +crds: + enabled: true + validationFailurePolicy: Fail diff --git a/manifests/nfs-provisioner/values.yaml b/manifests/nfs-provisioner/values.yaml new file mode 100644 index 0000000..67054e6 --- /dev/null +++ b/manifests/nfs-provisioner/values.yaml @@ -0,0 +1,23 @@ +nfs: + server: "" # TODO: replace with xpen NAS IP + path: "" # TODO: replace with NFS export path (e.g. /volume1/k8s) + mountOptions: + - nfsvers=4.1 + +storageClass: + name: nfs-delete + defaultClass: true + reclaimPolicy: Delete + archiveOnDelete: false + +# Second StorageClass with Retain policy is created via extraObjects below +extraObjects: + - apiVersion: storage.k8s.io/v1 + kind: StorageClass + metadata: + name: nfs-retain + provisioner: cluster.local/nfs-subdir-external-provisioner + parameters: + archiveOnDelete: "false" + reclaimPolicy: Retain + volumeBindingMode: Immediate