Tom Alexander
a4b20c1ead
Enable the firewall.
2026-07-06 18:12:12 -04:00
Tom Alexander
b593fdc8a7
Add gitea secrets.
2026-07-06 18:12:12 -04:00
Tom Alexander
8f5f59ee87
Add generation for in-repo secrets.
2026-07-06 18:12:12 -04:00
Tom Alexander
fc32a42750
Enforce cilium network policies.
2026-07-06 18:12:12 -04:00
Tom Alexander
1d3d178fc8
Downgrade to gateway 1.4.1.
...
1.5 came out recently, so no gateway providers support it.
2026-07-06 18:12:12 -04:00
Tom Alexander
e54f272a69
Update packages in kubernetes/keys.
2026-07-06 18:12:12 -04:00
Tom Alexander
e09e659d91
Fix network for updated nix.
2026-07-06 18:12:12 -04:00
Tom Alexander
3cc0fb1d3f
Fix proxy auth tls
2026-07-06 18:12:11 -04:00
Tom Alexander
92727aa1f7
Generate certificates for the aggregation layer.
2026-07-06 18:12:11 -04:00
Tom Alexander
2a319deea0
Add a note for the cilium connectivity test.
2026-07-06 18:12:11 -04:00
Tom Alexander
d6f089bdb4
Temporarily disable the firewall for debugging.
2026-07-06 18:12:11 -04:00
Tom Alexander
cce4f98125
Enable gateway support.
2026-07-06 18:12:11 -04:00
Tom Alexander
612158c3e1
Enable hubble.
2026-07-06 18:12:11 -04:00
Tom Alexander
1ed3832730
Temporarily drop flux interval to 1 minute during early development.
...
This is to reduce waiting time.
2026-07-06 18:12:10 -04:00
Tom Alexander
f3b969642c
Install deferred manifests.
2026-07-06 18:12:10 -04:00
Tom Alexander
23d9bbb8a1
Add a custom nftables firewall config.
2026-07-06 18:12:10 -04:00
Tom Alexander
9e729a8cc6
Enable the firewall.
...
Now that we have networking working, I can enable the firewall and confirm nothing breaks.
2026-07-06 18:12:10 -04:00
Tom Alexander
3169822726
Fix CoreDNS IPv4 connectivity.
2026-07-06 18:12:10 -04:00
Tom Alexander
9b5fbadc44
Increase timeout for coredns cache.
2026-07-06 18:12:10 -04:00
Tom Alexander
ab1b2a70f3
More changes to try to fix coredns.
2026-07-06 18:12:10 -04:00
Tom Alexander
4061d14651
Move the kubelet yaml config into nix.
2026-07-06 18:12:09 -04:00
Tom Alexander
361ec69a8b
Implement a generic helm templater package.
2026-07-06 18:12:09 -04:00
Tom Alexander
f545376aec
Switch to generating the coredns manifests via nix.
2026-07-06 18:12:09 -04:00
Tom Alexander
dc80c06ee9
Use CoreDNS for in-cluster DNS requests and caching.
2026-07-06 18:12:09 -04:00
Tom Alexander
5d58d550d3
Enable native routing.
2026-07-06 18:12:09 -04:00
Tom Alexander
51e027ba67
Build the cilium manifest automatically in nix.
2026-07-06 18:12:09 -04:00
Tom Alexander
37efcdb367
Allow pods to directly speak to the public internet on their own public IPv6 addresses.
2026-07-06 18:12:08 -04:00
Tom Alexander
01d230bde6
Enable ipv4 and tunnel routing.
2026-07-06 18:12:08 -04:00
Tom Alexander
383acd4fd2
Switch to kubernetes ipam mode.
2026-07-06 18:12:08 -04:00
Tom Alexander
7df824da6a
Fix service cluster ip range.
...
Kubernetes only allows a /112 for service ip range.
2026-07-06 18:12:08 -04:00
Tom Alexander
efbfe865e0
Fix trailing line break in kubernetes encryption config.
2026-07-06 18:12:08 -04:00
Tom Alexander
2314bef2ad
Move the yaml functions to their own file.
2026-07-06 18:12:08 -04:00
Tom Alexander
8e9bd9acc1
Introduce functions to generate yaml.
...
The toYAML function is just an alias to toJSON which is technically fine since YAML is a superset of JSON, but these new functions will generate actual YAML.
2026-07-06 18:12:08 -04:00
Tom Alexander
d924aa3a81
Add missing cidr declarations.
2026-07-06 18:12:07 -04:00
Tom Alexander
2bbf44e528
Fix DNS resolution.
2026-07-06 18:12:07 -04:00
Tom Alexander
c289f46cc5
Apply the git repo to the cluster.
2026-07-06 18:12:07 -04:00
Tom Alexander
88b1c36c0d
Trust flux's ssh key in the yaml git repo.
2026-07-06 18:12:07 -04:00
Tom Alexander
dbd82b998d
Generic secrets for ssh keys.
2026-07-06 18:12:07 -04:00
Tom Alexander
1700c42926
Generic secrets for pgp keys.
2026-07-06 18:12:07 -04:00
Tom Alexander
3c20fd49f0
Generate kubernetes secrets for ssh keys.
2026-07-06 18:12:06 -04:00
Tom Alexander
903c1c1f41
Install CoreDNS.
2026-07-06 18:12:06 -04:00
Tom Alexander
158c622840
Generate pgp keys for sops.
2026-07-06 18:12:06 -04:00
Tom Alexander
ceb627bb35
Generate ssh keys for flux bootstrap.
2026-07-06 18:12:06 -04:00
Tom Alexander
a3f1dff351
Move the cluster bootstrap into the keys flake.
...
Bootstrapping the cluster needs access to secrets, so I am moving it into the keys flake.
2026-07-06 18:12:06 -04:00
Tom Alexander
46c8f5e0ce
Set up flux.
2026-07-06 18:12:06 -04:00
Tom Alexander
3760bca64b
Add a bootstrap role.
2026-07-06 18:12:05 -04:00
Tom Alexander
3396a4f482
Add a bootstrap role to load manifests into the cluster.
2026-07-06 18:12:05 -04:00
Tom Alexander
773db6e567
Fix launching of containers.
2026-07-06 18:12:05 -04:00
Tom Alexander
6010867796
Create a debugging role.
2026-07-06 18:12:05 -04:00
Tom Alexander
e9db45fb61
Some networking fixes.
2026-07-06 18:12:05 -04:00
