diff --git a/clusters/k3s/ip/ip-deployment.yml b/clusters/k3s/ip/ip-deployment.yml index ad0d6e7..9001aa4 100644 --- a/clusters/k3s/ip/ip-deployment.yml +++ b/clusters/k3s/ip/ip-deployment.yml @@ -7,7 +7,7 @@ spec: selector: matchLabels: app: ip - replicas: 3 + replicas: 1 template: metadata: labels: diff --git a/clusters/k3s/ip/ip-ingress-traefik-tls.yaml b/clusters/k3s/ip/ip-ingress-traefik-tls.yaml new file mode 100644 index 0000000..d06bea6 --- /dev/null +++ b/clusters/k3s/ip/ip-ingress-traefik-tls.yaml @@ -0,0 +1,25 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ip-ingress + namespace: ip + annotations: + kubernetes.io/ingress.class: traefik + cert-manager.io/cluster-issuer: letsencrypt-prod + traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd +spec: + rules: + - host: ip.vntx.net + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: ip-service + port: + number: 4000 + tls: + - secretName: ip-tls + hosts: + - ip.vntx.net diff --git a/clusters/k3s/traefik/dashboard-auth-middleware.yaml b/clusters/k3s/traefik/dashboard-auth-middleware.yaml new file mode 100644 index 0000000..08568aa --- /dev/null +++ b/clusters/k3s/traefik/dashboard-auth-middleware.yaml @@ -0,0 +1,7 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: dashboard-basic-auth +spec: + basicAuth: + secret: traefik-dashboard-auth-secret diff --git a/clusters/k3s/traefik/dashboard-auth-secret.yaml b/clusters/k3s/traefik/dashboard-auth-secret.yaml new file mode 100644 index 0000000..2a8d267 --- /dev/null +++ b/clusters/k3s/traefik/dashboard-auth-secret.yaml @@ -0,0 +1,23 @@ +# Note: in a kubernetes secret the string (e.g. generated by htpasswd) must be base64-encoded first. +# To create an encoded user:password pair, the following command can be used: +# htpasswd -nb user password | openssl base64 +# Or create a new file with the credentials you want and then convert it when your are done +# htpasswd -c auth username +# *enter and reenter password* +# htpasswd auth username2 +# *enter and reenter password* +# base64 auth +# copy and paste into below +# the |2 should stay regardless of how many users. It is yaml syntax. +# Below are username/passwords test/test and test2/test2 +# https://doc.traefik.io/traefik/middlewares/basicauth/ +apiVersion: v1 +kind: Secret +metadata: + name: traefik-dashboard-auth-secret + namespace: default +data: + users: |2 + Z3JhaGFtOiRhcHIxJGNiajQ2dHRHJEg3OVQ2UDl5QXJoa0t5V01UL0JLUi4K + + diff --git a/clusters/k3s/traefik/letsencrypt-prod.yaml b/clusters/k3s/traefik/letsencrypt-prod.yaml new file mode 100644 index 0000000..f6a0446 --- /dev/null +++ b/clusters/k3s/traefik/letsencrypt-prod.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-prod +spec: + acme: + email: graham@vntx.net + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-prod + solvers: + - http01: + ingress: + class: traefik + diff --git a/clusters/k3s/traefik/traefik-dashboard-ingress.yaml b/clusters/k3s/traefik/traefik-dashboard-ingress.yaml new file mode 100644 index 0000000..4ff4604 --- /dev/null +++ b/clusters/k3s/traefik/traefik-dashboard-ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: traefik-ingress + namespace: kube-system + annotations: + kubernetes.io/ingress.class: traefik + cert-manager.io/cluster-issuer: letsencrypt-prod + traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd + traefik.ingress.kubernetes.io/router.middlewares: default-dashboard-basic-auth@kubernetescrd +spec: + rules: + - host: traefik.vntx.net + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: traefik-dashboard + port: + number: 9000 + tls: + - secretName: traefik-tls + hosts: + - traefik.vntx.net diff --git a/clusters/k3s/traefik/traefik-dashboard-service.yaml b/clusters/k3s/traefik/traefik-dashboard-service.yaml new file mode 100644 index 0000000..aa4aa8e --- /dev/null +++ b/clusters/k3s/traefik/traefik-dashboard-service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: traefik-dashboard + namespace: kube-system + labels: + app.kubernetes.io/instance: traefik + app.kubernetes.io/name: traefik-dashboard +spec: + type: ClusterIP + ports: + - name: traefik + port: 9000 + targetPort: traefik + protocol: TCP + selector: + app.kubernetes.io/instance: traefik-kube-system + app.kubernetes.io/name: traefik + diff --git a/clusters/k3s/traefik/traefik-https-redirect-middleware.yaml b/clusters/k3s/traefik/traefik-https-redirect-middleware.yaml new file mode 100644 index 0000000..c122d38 --- /dev/null +++ b/clusters/k3s/traefik/traefik-https-redirect-middleware.yaml @@ -0,0 +1,9 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: redirect-https +spec: + redirectScheme: + scheme: https + permanent: true + diff --git a/clusters/k3s/whoami/whoami-deployment.yaml b/clusters/k3s/whoami/whoami-deployment.yaml new file mode 100644 index 0000000..c2349ea --- /dev/null +++ b/clusters/k3s/whoami/whoami-deployment.yaml @@ -0,0 +1,20 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: whoami +spec: + selector: + matchLabels: + app: whoami + replicas: 1 + template: + metadata: + labels: + app: whoami + spec: + containers: + - name: whoami + image: containous/whoami:v1.5.0 + ports: + - containerPort: 80 + diff --git a/clusters/k3s/whoami/whoami-ingress-tls.yaml b/clusters/k3s/whoami/whoami-ingress-tls.yaml new file mode 100644 index 0000000..6295c9b --- /dev/null +++ b/clusters/k3s/whoami/whoami-ingress-tls.yaml @@ -0,0 +1,24 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: whoami-tls-ingress + annotations: + kubernetes.io/ingress.class: traefik + cert-manager.io/cluster-issuer: letsencrypt-prod + traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd +spec: + rules: + - host: whoami.vntx.net + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: whoami + port: + number: 5678 + tls: + - secretName: whoami-tls + hosts: + - whoami.vntx.net diff --git a/clusters/k3s/whoami/whoami-ingress.yaml b/clusters/k3s/whoami/whoami-ingress.yaml new file mode 100644 index 0000000..4017821 --- /dev/null +++ b/clusters/k3s/whoami/whoami-ingress.yaml @@ -0,0 +1,24 @@ +kind: Ingress +apiVersion: networking.k8s.io/v1 +metadata: + name: whoami + +spec: + rules: + - http: + paths: + - path: /bar + pathType: Prefix + backend: + service: + name: whoami + port: + number: 5678 + - path: /foo + pathType: Prefix + backend: + service: + name: whoami + port: + number: 5678 + diff --git a/clusters/k3s/whoami/whoami-service.yaml b/clusters/k3s/whoami/whoami-service.yaml new file mode 100644 index 0000000..31d667a --- /dev/null +++ b/clusters/k3s/whoami/whoami-service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: whoami +spec: + type: ClusterIP + ports: + - port: 5678 + targetPort: 80 + selector: + app: whoami +