feat(networking): bring back nginx

Signed-off-by: Steven Kreitzer <[email protected]>
buroa · Jan 18, 2024 · a70abfe · a70abfe
1 parent 2d3fb16
commit a70abfe
Show file tree

Hide file tree

Showing 51 changed files with 330 additions and 61 deletions.
diff --git a/README.md b/README.md
@@ -58,10 +58,11 @@ This semi hyper-converged cluster runs [Talos Linux](https://github.com/siderola
 
 - [actions-runner-controller](https://github.com/actions/actions-runner-controller): Self-hosted Github runners.
 - [cert-manager](https://github.com/cert-manager/cert-manager): Creates SSL certificates for services in my cluster.
-- [cilium](https://github.com/cilium/cilium): Internal Kubernetes container networking interface & ingress controller.
-- [cloudflared](https://github.com/cloudflare/cloudflared): Provides Cloudflare secure access to my ingresses.
+- [cilium](https://github.com/cilium/cilium): Internal Kubernetes container networking interface.
+- [cloudflared](https://github.com/cloudflare/cloudflared): Enables Cloudflare secure access to my ingresses.
 - [external-dns](https://github.com/kubernetes-sigs/external-dns): Automatically syncs ingress DNS records to a DNS provider.
 - [external-secrets](https://github.com/external-secrets/external-secrets): Managed Kubernetes secrets using [1Password Connect](https://github.com/1Password/connect).
+- [ingress-nginx](https://github.com/kubernetes/ingress-nginx): Kubernetes ingress controller using NGINX as a reverse proxy and load balancer.
 - [multus](https://github.com/k8snetworkplumbingwg/multus-cni): Multi-homed pod networking.
 - [rook](https://github.com/rook/rook): Distributed block storage for peristent storage.
 - [sops](https://github.com/getsops/sops): Managed secrets for Kubernetes and Terraform which are commited to Git.

diff --git a/kubernetes/apps/default/kromgo/app/helmrelease.yaml b/kubernetes/apps/default/kromgo/app/helmrelease.yaml
@@ -63,7 +63,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/status-code: "404"

diff --git a/kubernetes/apps/default/libreddit/app/helmrelease.yaml b/kubernetes/apps/default/libreddit/app/helmrelease.yaml
@@ -75,7 +75,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/path: *path

diff --git a/kubernetes/apps/default/nostr-relay/app/helmrelease.yaml b/kubernetes/apps/default/nostr-relay/app/helmrelease.yaml
@@ -68,7 +68,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           hajimari.io/enable: "false"

diff --git a/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml b/kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml
@@ -9,7 +9,7 @@ metadata:
     hajimari.io/enable: "false"
     external-dns.alpha.kubernetes.io/target: external.${PUBLIC_DOMAIN}
 spec:
-  ingressClassName: cilium
+  ingressClassName: external
   rules:
     - host: &host flux-webhook.${PUBLIC_DOMAIN}
       http:

diff --git a/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml b/kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml
@@ -29,7 +29,7 @@ spec:
       username: admin
     ingress:
       enabled: true
-      className: cilium
+      className: internal
       annotations:
         hajimari.io/icon: simple-icons:flux
       hosts:

diff --git a/kubernetes/apps/home/atuin/app/helmrelease.yaml b/kubernetes/apps/home/atuin/app/helmrelease.yaml
@@ -81,7 +81,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/enable: "false"
         hosts:

diff --git a/kubernetes/apps/home/hajimari/app/helmrelease.yaml b/kubernetes/apps/home/hajimari/app/helmrelease.yaml
@@ -42,7 +42,7 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: cilium
+        ingressClassName: internal
         annotations:
           hajimari.io/enable: "false"
         hosts:

diff --git a/kubernetes/apps/home/home-assistant/app/helmrelease.yaml b/kubernetes/apps/home/home-assistant/app/helmrelease.yaml
@@ -82,7 +82,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:home-assistant
           hajimari.io/url: https://hass.${PUBLIC_DOMAIN}

diff --git a/kubernetes/apps/home/miniflux/app/helmrelease.yaml b/kubernetes/apps/home/miniflux/app/helmrelease.yaml
@@ -99,7 +99,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/path: *path

diff --git a/kubernetes/apps/home/node-red/app/helmrelease.yaml b/kubernetes/apps/home/node-red/app/helmrelease.yaml
@@ -63,7 +63,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: cib:node-red
           hajimari.io/url: https://nr.${PUBLIC_DOMAIN}

diff --git a/kubernetes/apps/home/thelounge/app/helmrelease.yaml b/kubernetes/apps/home/thelounge/app/helmrelease.yaml
@@ -55,7 +55,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:forum
         hosts:

diff --git a/kubernetes/apps/home/zigbee2mqtt/app/helmrelease.yaml b/kubernetes/apps/home/zigbee2mqtt/app/helmrelease.yaml
@@ -92,7 +92,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:zigbee
           hajimari.io/url: https://zigbee.${PUBLIC_DOMAIN}

diff --git a/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml b/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml
@@ -78,24 +78,14 @@ spec:
         rollOutPods: true
         ingress:
           enabled: true
-          className: cilium
+          className: internal
           annotations:
             hajimari.io/icon: simple-icons:cilium
           hosts:
             - &host hubble.${PUBLIC_DOMAIN}
           tls:
             - hosts:
                 - *host
-    ingressController:
-      enabled: true
-      defaultSecretNamespace: kube-system
-      defaultSecretName: ingress-tls
-      loadbalancerMode: shared
-      service:
-        annotations:
-          io.cilium/lb-ipam-ips: ${INGRESS_LB_IP}
-        labels:
-          io.cilium/lb-ipam-layer2: "true"
     ipam:
       mode: kubernetes
     ipv4NativeRoutingCIDR: ${CLUSTER_POD_IP_CIDR}

diff --git a/kubernetes/apps/kube-system/cilium/app/kustomization.yaml b/kubernetes/apps/kube-system/cilium/app/kustomization.yaml
@@ -2,5 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./certificate.yaml
   - ./helmrelease.yaml
diff --git a/kubernetes/apps/kube-system/external-secrets/stores/onepassword/helmrelease.yaml b/kubernetes/apps/kube-system/external-secrets/stores/onepassword/helmrelease.yaml
@@ -125,7 +125,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/enable: "false"
         hosts:

diff --git a/kubernetes/apps/media/autobrr/app/helmrelease.yaml b/kubernetes/apps/media/autobrr/app/helmrelease.yaml
@@ -80,7 +80,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:bunny
         hosts:

diff --git a/kubernetes/apps/media/bazarr/app/helmrelease.yaml b/kubernetes/apps/media/bazarr/app/helmrelease.yaml
@@ -96,7 +96,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:subtitles-outline
         hosts:

diff --git a/kubernetes/apps/media/overseerr/app/helmrelease.yaml b/kubernetes/apps/media/overseerr/app/helmrelease.yaml
@@ -70,7 +70,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/path: *path

diff --git a/kubernetes/apps/media/plex/app/helmrelease.yaml b/kubernetes/apps/media/plex/app/helmrelease.yaml
@@ -75,11 +75,12 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/path: *path
           hajimari.io/icon: mdi:plex
+          nginx.ingress.kubernetes.io/backend-protocol: HTTPS
           external-dns.alpha.kubernetes.io/target: external.${PUBLIC_DOMAIN}
         hosts:
           - host: &host "{{ .Release.Name }}.${PUBLIC_DOMAIN}"

diff --git a/kubernetes/apps/media/prowlarr/app/helmrelease.yaml b/kubernetes/apps/media/prowlarr/app/helmrelease.yaml
@@ -86,7 +86,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:movie-search
         hosts:

diff --git a/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml b/kubernetes/apps/media/qbittorrent/app/helmrelease.yaml
@@ -114,7 +114,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:seedling
           hajimari.io/url: https://qb.${PUBLIC_DOMAIN}

diff --git a/kubernetes/apps/media/radarr/app/helmrelease.yaml b/kubernetes/apps/media/radarr/app/helmrelease.yaml
@@ -98,7 +98,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:filmstrip
         hosts:

diff --git a/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml b/kubernetes/apps/media/sabnzbd/app/helmrelease.yaml
@@ -94,7 +94,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:download
           hajimari.io/url: https://sab.${PUBLIC_DOMAIN}

diff --git a/kubernetes/apps/media/sonarr/app/helmrelease.yaml b/kubernetes/apps/media/sonarr/app/helmrelease.yaml
@@ -98,7 +98,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:television-classic
         hosts:

diff --git a/kubernetes/apps/media/tautulli/app/helmrelease.yaml b/kubernetes/apps/media/tautulli/app/helmrelease.yaml
@@ -83,7 +83,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/path: *path

diff --git a/kubernetes/apps/monitoring/exporters/blackbox-exporter/app/helmrelease.yaml b/kubernetes/apps/monitoring/exporters/blackbox-exporter/app/helmrelease.yaml
@@ -27,7 +27,7 @@ spec:
     pspEnabled: false
     ingress:
       enabled: true
-      className: cilium
+      className: internal
       annotations:
         hajimari.io/enable: "false"
       hosts:

diff --git a/kubernetes/apps/monitoring/gatus/app/helmrelease.yaml b/kubernetes/apps/monitoring/gatus/app/helmrelease.yaml
@@ -107,7 +107,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           gatus.io/path: *path

diff --git a/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml b/kubernetes/apps/monitoring/grafana/app/helmrelease.yaml
@@ -111,6 +111,14 @@ spec:
             editable: true
             options:
               path: /var/lib/grafana/dashboards/kubernetes
+          - name: nginx
+            orgId: 1
+            folder: Nginx
+            type: file
+            disableDeletion: false
+            editable: true
+            options:
+              path: /var/lib/grafana/dashboards/nginx
           - name: blocky
             orgId: 1
             folder: Blocky
@@ -309,6 +317,13 @@ spec:
           gnetId: 11454
           revision: 14
           datasource: Prometheus
+      nginx:
+        nginx:
+          url: https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/grafana/dashboards/nginx.json
+          datasource: Prometheus
+        nginx-request-handling-performance:
+          url: https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/grafana/dashboards/request-handling-performance.json
+          datasource: Prometheus
       blocky:
         blocky:
           # renovate: depName="blocky"
@@ -420,7 +435,7 @@ spec:
       enabled: true
     ingress:
       enabled: true
-      ingressClassName: cilium
+      ingressClassName: internal
       annotations:
         hajimari.io/appName: Grafana
         hajimari.io/icon: simple-icons:grafana

diff --git a/kubernetes/apps/monitoring/karma/app/helmrelease.yaml b/kubernetes/apps/monitoring/karma/app/helmrelease.yaml
@@ -75,7 +75,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/icon: mdi:recycle
         hosts:

diff --git a/kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml b/kubernetes/apps/monitoring/kube-prometheus-stack/app/helmrelease.yaml
@@ -30,7 +30,7 @@ spec:
     alertmanager:
       ingress:
         enabled: true
-        ingressClassName: cilium
+        ingressClassName: internal
         annotations:
           hajimari.io/appName: Alertmanager
           hajimari.io/icon: fluent:alert-16-filled
@@ -80,7 +80,7 @@ spec:
     prometheus:
       ingress:
         enabled: true
-        ingressClassName: cilium
+        ingressClassName: internal
         annotations:
           hajimari.io/appName: Prometheus
           hajimari.io/icon: simple-icons:prometheus

diff --git a/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml b/kubernetes/apps/monitoring/thanos/app/helmrelease.yaml
@@ -46,7 +46,7 @@ spec:
       ingress:
         enabled: true
         hostname: &host thanos.${PUBLIC_DOMAIN}
-        ingressClassName: cilium
+        ingressClassName: internal
         annotations:
           hajimari.io/appName: Thanos
           hajimari.io/icon: material-symbols:health-metrics

diff --git a/kubernetes/apps/networking/blocky/app/helmrelease.yaml b/kubernetes/apps/networking/blocky/app/helmrelease.yaml
@@ -78,7 +78,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: internal
         annotations:
           hajimari.io/enable: "false"
         hosts:

diff --git a/kubernetes/apps/networking/cloudflared/app/configs/config.yaml b/kubernetes/apps/networking/cloudflared/app/configs/config.yaml
@@ -1,10 +1,7 @@
 ---
-originRequest:
-  autoOriginServerName: true # Ref: https://github.com/cloudflare/cloudflared/pull/1160
-
 ingress:
   - hostname: ${PUBLIC_DOMAIN}
-    service: https://cilium-ingress.kube-system.svc.cluster.local:443
+    service: https://nginx-external-controller.networking.svc.cluster.local:443
   - hostname: "*.${PUBLIC_DOMAIN}"
-    service: https://cilium-ingress.kube-system.svc.cluster.local:443
+    service: https://nginx-external-controller.networking.svc.cluster.local:443
   - service: http_status:404
diff --git a/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml b/kubernetes/apps/networking/cloudflared/app/helmrelease.yaml
@@ -32,9 +32,8 @@ spec:
         containers:
           main:
             image:
-              # TODO: move to semver once available
-              repository: ghcr.io/buroa/cloudflared
-              tag: develop@sha256:3d101d8e548135d1e416fc9ed43971feb3022300cd1f683070a61fd9e8506269
+              repository: docker.io/cloudflare/cloudflared
+              tag: 2024.1.3@sha256:8124930145ba79535f2a9fb83bb9fb0abbeb8fdab94f4d72ae34deeeaee8774d
             args:
               - tunnel
               - --config

diff --git a/kubernetes/apps/networking/echo-server/app/helmrelease.yaml b/kubernetes/apps/networking/echo-server/app/helmrelease.yaml
@@ -75,7 +75,7 @@ spec:
     ingress:
       main:
         enabled: true
-        className: cilium
+        className: external
         annotations:
           gatus.io/enabled: "true"
           hajimari.io/enable: "false"