Moves setup files into embedded package.

2025-10-11 22:06:39 +00:00
parent 92032202f4
commit 89c6a7aa80
112 changed files with 337 additions and 0 deletions
--- a/internal/setup/cluster-services/traefik/README.md
+++ b/internal/setup/cluster-services/traefik/README.md
@@ -0,0 +1,31 @@
+# Traefik
+
+- https://doc.traefik.io/traefik/providers/kubernetes-ingress/
+
+Ingress RDs can be create for any service. The routes specificed in the Ingress are added automatically to the Traefik proxy.
+
+Traefik serves all incoming network traffic on ports 80 and 443 to their appropriate services based on the route.
+
+## Notes
+
+These kustomize templates were created with:
+
+```bash
+helm-chart-to-kustomize traefik/traefik traefik traefik values.yaml
+```
+
+With values.yaml being:
+
+```yaml
+ingressRoute:
+  dashboard:
+    enabled: true
+    matchRule: Host(`dashboard.localhost`)
+    entryPoints:
+      - web
+providers:
+  kubernetesGateway:
+    enabled: true
+gateway:
+  namespacePolicy: All
+```
--- a/internal/setup/cluster-services/traefik/install.sh
+++ b/internal/setup/cluster-services/traefik/install.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+# Ensure WILD_INSTANCE is set
+if [ -z "${WILD_INSTANCE}" ]; then
+    echo "❌ ERROR: WILD_INSTANCE is not set"
+    exit 1
+fi
+
+# Ensure WILD_CENTRAL_DATA is set
+if [ -z "${WILD_CENTRAL_DATA}" ]; then
+    echo "❌ ERROR: WILD_CENTRAL_DATA is not set"
+    exit 1
+fi
+
+# Ensure KUBECONFIG is set
+if [ -z "${KUBECONFIG}" ]; then
+    echo "❌ ERROR: KUBECONFIG is not set"
+    exit 1
+fi
+
+INSTANCE_DIR="${WILD_CENTRAL_DATA}/instances/${WILD_INSTANCE}"
+CLUSTER_SETUP_DIR="${INSTANCE_DIR}/setup/cluster-services"
+TRAEFIK_DIR="${CLUSTER_SETUP_DIR}/traefik"
+
+echo "🌐 === Setting up Traefik Ingress Controller ==="
+echo ""
+
+# Check MetalLB dependency
+echo "🔍 Verifying MetalLB is ready (required for Traefik LoadBalancer service)..."
+kubectl wait --for=condition=Ready pod -l component=controller -n metallb-system --timeout=60s 2>/dev/null || {
+    echo "⚠️  MetalLB controller not ready, but continuing with Traefik installation"
+    echo "💡 Note: Traefik LoadBalancer service may not get external IP without MetalLB"
+}
+
+# Install required CRDs first
+echo "📦 Installing Gateway API CRDs..."
+kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml
+
+echo "📦 Installing Traefik CRDs..."
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.4/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+
+echo "⏳ Waiting for CRDs to be established..."
+kubectl wait --for condition=established crd/gateways.gateway.networking.k8s.io --timeout=60s
+kubectl wait --for condition=established crd/gatewayclasses.gateway.networking.k8s.io --timeout=60s
+kubectl wait --for condition=established crd/ingressroutes.traefik.io --timeout=60s
+kubectl wait --for condition=established crd/middlewares.traefik.io --timeout=60s
+
+# Templates should already be compiled
+echo "📦 Using pre-compiled Traefik templates..."
+if [ ! -d "${TRAEFIK_DIR}/kustomize" ]; then
+    echo "❌ ERROR: Compiled templates not found at ${TRAEFIK_DIR}/kustomize"
+    echo "Templates should be compiled before deployment."
+    exit 1
+fi
+
+# Apply Traefik using kustomize
+echo "🚀 Deploying Traefik..."
+kubectl apply -k ${TRAEFIK_DIR}/kustomize
+
+# Wait for Traefik to be ready
+echo "⏳ Waiting for Traefik to be ready..."
+kubectl wait --for=condition=Available deployment/traefik -n traefik --timeout=120s
+
+echo ""
+echo "✅ Traefik installed successfully"
+echo ""
+echo "💡 To verify the installation:"
+echo "  kubectl get pods -n traefik"
+echo "  kubectl get svc -n traefik"
+echo ""
--- a/internal/setup/cluster-services/traefik/kustomize.template/internal-middleware.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/internal-middleware.yaml
@@ -0,0 +1,13 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: internal-only
+  namespace: kube-system
+spec:
+  ipWhiteList:
+    # Restrict to local private network ranges - adjust these to match your network
+    sourceRange:
+      - 127.0.0.1/32    # localhost
+      - 10.0.0.0/8      # Private network
+      - 172.16.0.0/12   # Private network
+      - 192.168.0.0/16  # Private network
--- a/internal/setup/cluster-services/traefik/kustomize.template/kustomization.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/kustomization.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- namespace.yaml
+- templates/deployment.yaml
+- templates/gatewayclass.yaml
+- templates/gateway.yaml
+- templates/ingressclass.yaml
+- templates/ingressroute.yaml
+- templates/rbac/clusterrolebinding.yaml
+- templates/rbac/clusterrole.yaml
+- templates/rbac/serviceaccount.yaml
+- templates/service.yaml
--- a/internal/setup/cluster-services/traefik/kustomize.template/namespace.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/deployment.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/deployment.yaml
@@ -0,0 +1,130 @@
+---
+# Source: traefik/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+      app.kubernetes.io/instance: traefik-traefik
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  minReadySeconds: 0
+  template: 
+    metadata:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: "/metrics"
+        prometheus.io/port: "9100"
+      labels:
+        app.kubernetes.io/name: traefik
+        app.kubernetes.io/instance: traefik-traefik
+        helm.sh/chart: traefik-36.1.0
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      serviceAccountName: traefik
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 60
+      hostNetwork: false
+      containers:
+      - image: docker.io/traefik:v3.4.1
+        imagePullPolicy: IfNotPresent
+        name: traefik
+        resources:
+        readinessProbe:
+          httpGet:
+            path: /ping
+            port: 8080
+            scheme: HTTP
+          failureThreshold: 1
+          initialDelaySeconds: 2
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 2
+        livenessProbe:
+          httpGet:
+            path: /ping
+            port: 8080
+            scheme: HTTP
+          failureThreshold: 3
+          initialDelaySeconds: 2
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 2
+        lifecycle:
+        ports:
+        - name: metrics
+          containerPort: 9100
+          protocol: TCP
+        - name: traefik
+          containerPort: 8080
+          protocol: TCP
+        - name: web
+          containerPort: 8000
+          protocol: TCP
+        - name: websecure
+          containerPort: 8443
+          protocol: TCP
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+          - name: data
+            mountPath: /data
+          - name: tmp
+            mountPath: /tmp
+        args:
+          - "--global.checkNewVersion"
+          - "--entryPoints.metrics.address=:9100/tcp"
+          - "--entryPoints.traefik.address=:8080/tcp"
+          - "--entryPoints.web.address=:8000/tcp"
+          - "--entryPoints.websecure.address=:8443/tcp"
+          - "--api.dashboard=true"
+          - "--ping=true"
+          - "--metrics.prometheus=true"
+          - "--metrics.prometheus.entrypoint=metrics"
+          - "--providers.kubernetescrd"
+          - "--providers.kubernetescrd.allowEmptyServices=true"
+          - "--providers.kubernetesingress"
+          - "--providers.kubernetesingress.allowEmptyServices=true"
+          - "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik"
+          - "--providers.kubernetesgateway"
+          - "--providers.kubernetesgateway.statusaddress.service.name=traefik"
+          - "--providers.kubernetesgateway.statusaddress.service.namespace=traefik"
+          - "--entryPoints.websecure.http.tls=true"
+          - "--log.level=INFO"
+          
+        env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+      securityContext:
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/gateway.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/gateway.yaml
@@ -0,0 +1,18 @@
+---
+# Source: traefik/templates/gateway.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: traefik-gateway
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: web
+      port: 8000
+      protocol: HTTP
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/gatewayclass.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/gatewayclass.yaml
@@ -0,0 +1,13 @@
+---
+# Source: traefik/templates/gatewayclass.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+spec:
+  controllerName: traefik.io/gateway-controller
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/ingressclass.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/ingressclass.yaml
@@ -0,0 +1,15 @@
+---
+# Source: traefik/templates/ingressclass.yaml
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  annotations:
+    ingressclass.kubernetes.io/is-default-class: "true"
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+  name: traefik
+spec:
+  controller: traefik.io/ingress-controller
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/ingressroute.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/ingressroute.yaml
@@ -0,0 +1,21 @@
+---
+# Source: traefik/templates/ingressroute.yaml
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+spec:
+  entryPoints:
+  - web
+  routes:
+  - match: Host(`dashboard.localhost`)
+    kind: Rule
+    services:
+      - kind: TraefikService
+        name: api@internal
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/rbac/clusterrole.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/rbac/clusterrole.yaml
@@ -0,0 +1,108 @@
+---
+# Source: traefik/templates/rbac/clusterrole.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik-traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - nodes
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - traefik.io
+    resources:
+      - ingressroutes
+      - ingressroutetcps
+      - ingressrouteudps
+      - middlewares
+      - middlewaretcps
+      - serverstransports
+      - serverstransporttcps
+      - tlsoptions
+      - tlsstores
+      - traefikservices
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - secrets
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - backendtlspolicies
+      - gatewayclasses
+      - gateways
+      - grpcroutes
+      - httproutes
+      - referencegrants
+      - tcproutes
+      - tlsroutes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - backendtlspolicies/status
+      - gatewayclasses/status
+      - gateways/status
+      - grpcroutes/status
+      - httproutes/status
+      - tcproutes/status
+      - tlsroutes/status
+    verbs:
+      - update
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/rbac/clusterrolebinding.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/rbac/clusterrolebinding.yaml
@@ -0,0 +1,19 @@
+---
+# Source: traefik/templates/rbac/clusterrolebinding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: traefik-traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-traefik
+subjects:
+  - kind: ServiceAccount
+    name: traefik
+    namespace: traefik
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/rbac/serviceaccount.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/rbac/serviceaccount.yaml
@@ -0,0 +1,14 @@
+---
+# Source: traefik/templates/rbac/serviceaccount.yaml
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: traefik
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+automountServiceAccountToken: false
--- a/internal/setup/cluster-services/traefik/kustomize.template/templates/service.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/templates/service.yaml
@@ -0,0 +1,27 @@
+---
+# Source: traefik/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: traefik
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+    helm.sh/chart: traefik-36.1.0
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+spec:
+  type: LoadBalancer
+  selector:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/instance: traefik-traefik
+  ports:
+  - port: 80
+    name: web
+    targetPort: web
+    protocol: TCP
+  - port: 443
+    name: websecure
+    targetPort: websecure
+    protocol: TCP
--- a/internal/setup/cluster-services/traefik/kustomize.template/traefik-service.yaml
+++ b/internal/setup/cluster-services/traefik/kustomize.template/traefik-service.yaml
@@ -0,0 +1,28 @@
+---
+# Traefik service configuration with static LoadBalancer IP
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: kube-system
+  annotations:
+    # Get a stable IP from MetalLB
+    metallb.universe.tf/address-pool: production
+    metallb.universe.tf/allow-shared-ip: traefik-lb
+  labels:
+    app.kubernetes.io/instance: traefik-kube-system
+    app.kubernetes.io/name: traefik
+spec:
+  type: LoadBalancer
+  loadBalancerIP: {{ .cluster.loadBalancerIp }}
+  selector:
+    app.kubernetes.io/instance: traefik-kube-system
+    app.kubernetes.io/name: traefik
+  ports:
+    - name: web
+      port: 80
+      targetPort: web
+    - name: websecure
+      port: 443
+      targetPort: websecure
+  externalTrafficPolicy: Local
--- a/internal/setup/cluster-services/traefik/wild-manifest.yaml
+++ b/internal/setup/cluster-services/traefik/wild-manifest.yaml
@@ -0,0 +1,10 @@
+name: traefik
+description: Cloud-native reverse proxy and ingress controller
+namespace: traefik
+category: infrastructure
+
+dependencies:
+  - metallb
+
+configReferences:
+  - cluster.loadBalancerIp