initial bootstrap: argocd, metallb, envoy-gateway, nfs-provisioner

bootstrap/apps/envoy-gateway-config.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: envoy-gateway-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+    targetRevision: main
+    path: manifests/envoy-gateway-config
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: envoy-gateway-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - SkipDryRunOnMissingResource=true

bootstrap/apps/envoy-gateway.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: envoy-gateway
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    - repoURL: https://charts.gateway.envoyproxy.io
+      chart: gateway-helm
+      targetRevision: "v1.7.1"
+      helm:
+        valueFiles:
+          - $values/manifests/envoy-gateway/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: envoy-gateway-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

bootstrap/apps/metallb-config.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metallb-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+    targetRevision: main
+    path: manifests/metallb-config
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: metallb-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true

bootstrap/apps/metallb.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metallb
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  sources:
+    - repoURL: https://metallb.github.io/metallb
+      chart: metallb
+      targetRevision: "0.14.9"
+      helm:
+        valueFiles:
+          - $values/manifests/metallb/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: metallb-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

bootstrap/apps/nfs-provisioner.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nfs-provisioner
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    - repoURL: https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
+      chart: nfs-subdir-external-provisioner
+      targetRevision: "4.0.18"
+      helm:
+        valueFiles:
+          - $values/manifests/nfs-provisioner/values.yaml
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-bootstrap.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: nfs-provisioner
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

manifests/argocd/httproute.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "argocd.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: argocd-server
+          port: 80

manifests/argocd/values.yaml

@@ -0,0 +1,23 @@
+nameOverride: argocd
+
+crds:
+  install: true
+  keep: true
+  annotations:
+    argocd.argoproj.io/sync-options: ServerSideApply=true
+
+global:
+  domain: argocd.fireflylab.local
+  image:
+    repository: quay.io/argoproj/argocd
+    pullPolicy: IfNotPresent
+  logging:
+    format: text
+    level: info
+
+configs:
+  params:
+    server.insecure: true   # TLS terminated at Envoy Gateway
+
+server:
+  replicas: 1

manifests/envoy-gateway-config/envoy-proxy.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: envoy-daemon-proxy
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDaemonSet:
+        container:
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 1024Mi
+      envoyService:
+        type: LoadBalancer
+        externalTrafficPolicy: Cluster

manifests/envoy-gateway-config/gateway.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: envoy-gateway
+  namespace: envoy-gateway-system
+spec:
+  gatewayClassName: envoy-gateway-class
+  infrastructure:
+    parametersRef:
+      group: gateway.envoyproxy.io
+      kind: EnvoyProxy
+      name: envoy-daemon-proxy
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: All

manifests/envoy-gateway-config/gatewayclass.yaml

@@ -0,0 +1,6 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: envoy-gateway-class
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller

manifests/envoy-gateway/values.yaml

@@ -0,0 +1,31 @@
+global:
+  images:
+    envoyGateway:
+      image: docker.io/envoyproxy/gateway:v1.7.1
+      pullPolicy: IfNotPresent
+    ratelimit:
+      image: docker.io/envoyproxy/ratelimit:c8765e89
+      pullPolicy: IfNotPresent
+
+deployment:
+  replicas: 1
+  envoyGateway:
+    resources:
+      limits:
+        memory: 1024Mi
+      requests:
+        cpu: 100m
+        memory: 256Mi
+
+service:
+  type: ClusterIP
+
+config:
+  envoyGateway:
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    provider:
+      type: Kubernetes
+    logging:
+      level:
+        default: info

manifests/metallb-config/ipaddresspool.yaml

@@ -0,0 +1,9 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: expensive
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.1.30/32
+  autoAssign: true

manifests/metallb-config/l2advertisement.yaml

@@ -0,0 +1,8 @@
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2-advertisement
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - expensive

manifests/metallb/values.yaml

@@ -0,0 +1,12 @@
+controller:
+  enabled: true
+  logLevel: info
+
+speaker:
+  enabled: true
+  logLevel: info
+  tolerateMaster: true
+
+crds:
+  enabled: true
+  validationFailurePolicy: Fail

manifests/nfs-provisioner/values.yaml

@@ -0,0 +1,23 @@
+nfs:
+  server: "<NFS_SERVER_IP>"   # TODO: replace with xpen NAS IP
+  path: "<NFS_PATH>"          # TODO: replace with NFS export path (e.g. /volume1/k8s)
+  mountOptions:
+    - nfsvers=4.1
+
+storageClass:
+  name: nfs-delete
+  defaultClass: true
+  reclaimPolicy: Delete
+  archiveOnDelete: false
+
+# Second StorageClass with Retain policy is created via extraObjects below
+extraObjects:
+  - apiVersion: storage.k8s.io/v1
+    kind: StorageClass
+    metadata:
+      name: nfs-retain
+    provisioner: cluster.local/nfs-subdir-external-provisioner
+    parameters:
+      archiveOnDelete: "false"
+    reclaimPolicy: Retain
+    volumeBindingMode: Immediate