micqdf
b1dae28aa5
Replace Hetzner infrastructure and cloud-provider assumptions with Proxmox VM clones, kube-vip API HA, and NFS-backed storage. Update bootstrap, Flux addons, CI workflows, and docs to target the new private Proxmox baseline while preserving the existing Tailscale, Doppler, Flux, Rancher, and B2 backup flows.
111 lines
2.9 KiB
Django/Jinja
111 lines
2.9 KiB
Django/Jinja
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kube-vip
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: system:kube-vip-role
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["services/status"]
|
|
verbs: ["update"]
|
|
- apiGroups: [""]
|
|
resources: ["services", "endpoints"]
|
|
verbs: ["list", "get", "watch", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["list", "get", "watch", "update", "patch"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["list", "get", "watch", "update", "create"]
|
|
- apiGroups: ["discovery.k8s.io"]
|
|
resources: ["endpointslices"]
|
|
verbs: ["list", "get", "watch", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: system:kube-vip-binding
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: system:kube-vip-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kube-vip
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: kube-vip
|
|
namespace: kube-system
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: kube-vip
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: kube-vip
|
|
spec:
|
|
serviceAccountName: kube-vip
|
|
hostNetwork: true
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
- key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
containers:
|
|
- name: kube-vip
|
|
image: ghcr.io/kube-vip/kube-vip:{{ kube_vip_version }}
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- manager
|
|
env:
|
|
- name: vip_arp
|
|
value: "true"
|
|
- name: port
|
|
value: "6443"
|
|
- name: vip_interface
|
|
value: {{ kube_vip_interface | quote }}
|
|
- name: vip_subnet
|
|
value: "32"
|
|
- name: cp_enable
|
|
value: "true"
|
|
- name: cp_namespace
|
|
value: kube-system
|
|
- name: vip_ddns
|
|
value: "false"
|
|
- name: vip_leaderelection
|
|
value: "true"
|
|
- name: vip_leaseduration
|
|
value: "5"
|
|
- name: vip_renewdeadline
|
|
value: "3"
|
|
- name: vip_retryperiod
|
|
value: "1"
|
|
- name: address
|
|
value: {{ kube_vip_address | quote }}
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
- SYS_TIME
|