talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity
1,291 Commits 9 Branches 0 Tags
d2c01c12239d43b479b8e01b147dc01a194114a1
Commit Graph

69 Commits

Author SHA1 Message Date
Tom Alexander
d2c01c1223 Switch to the experimental gateway CRDs for TCPRoute support. 2026-05-05 22:43:44 -04:00
Tom Alexander
f62f6bed00 Add oauth2 proxy secrets. 2026-05-05 22:43:43 -04:00
Tom Alexander
efc4d0f12e Add dex secrets. 2026-05-05 22:43:43 -04:00
Tom Alexander
f0e539f5ef Enable the firewall. 2026-05-05 22:43:43 -04:00
Tom Alexander
abd795d8ae Add gitea secrets. 2026-05-05 22:43:43 -04:00
Tom Alexander
2d3c03e042 Add generation for in-repo secrets. 2026-05-05 22:43:43 -04:00
Tom Alexander
a44e972701 Enforce cilium network policies. 2026-05-05 22:43:43 -04:00
Tom Alexander
7619c482ef Downgrade to gateway 1.4.1. 
1.5 came out recently, so no gateway providers support it.
 2026-05-05 22:43:42 -04:00
Tom Alexander
3ea1b59d59 Update packages in kubernetes/keys. 2026-05-05 22:43:42 -04:00
Tom Alexander
4457d35a63 Fix network for updated nix. 2026-05-05 22:43:42 -04:00
Tom Alexander
dddf80273a Fix proxy auth tls 2026-05-05 22:43:42 -04:00
Tom Alexander
9751784e76 Generate certificates for the aggregation layer. 2026-05-05 22:43:42 -04:00
Tom Alexander
1195bf2aa5 Add a note for the cilium connectivity test. 2026-05-05 22:43:42 -04:00
Tom Alexander
b6b5d5bd0f Temporarily disable the firewall for debugging. 2026-05-05 22:43:41 -04:00
Tom Alexander
893922959a Enable gateway support. 2026-05-05 22:43:41 -04:00
Tom Alexander
1fc4dd8f72 Enable hubble. 2026-05-05 22:43:41 -04:00
Tom Alexander
4b1a5c56ab Temporarily drop flux interval to 1 minute during early development. 
This is to reduce waiting time.
 2026-05-05 22:43:41 -04:00
Tom Alexander
af478c9731 Install deferred manifests. 2026-05-05 22:43:41 -04:00
Tom Alexander
81e9386b9b Add a custom nftables firewall config. 2026-05-05 22:43:41 -04:00
Tom Alexander
c89b5031c7 Enable the firewall. 
Now that we have networking working, I can enable the firewall and confirm nothing breaks.
 2026-05-05 22:43:41 -04:00
Tom Alexander
9378bc3343 Fix CoreDNS IPv4 connectivity. 2026-05-05 22:43:40 -04:00
Tom Alexander
61cd0acc5e Increase timeout for coredns cache. 2026-05-05 22:43:40 -04:00
Tom Alexander
646fc44d8f More changes to try to fix coredns. 2026-05-05 22:43:40 -04:00
Tom Alexander
5d094246de Move the kubelet yaml config into nix. 2026-05-05 22:43:40 -04:00
Tom Alexander
8158b06e2d Implement a generic helm templater package. 2026-05-05 22:43:40 -04:00
Tom Alexander
423d429d0e Switch to generating the coredns manifests via nix. 2026-05-05 22:43:40 -04:00
Tom Alexander
de5f2ec54d Use CoreDNS for in-cluster DNS requests and caching. 2026-05-05 22:43:39 -04:00
Tom Alexander
5871c72491 Enable native routing. 2026-05-05 22:43:39 -04:00
Tom Alexander
ab179f2f49 Build the cilium manifest automatically in nix. 2026-05-05 22:43:39 -04:00
Tom Alexander
91cfb2a9c4 Allow pods to directly speak to the public internet on their own public IPv6 addresses. 2026-05-05 22:43:39 -04:00
Tom Alexander
dfd43da93a Enable ipv4 and tunnel routing. 2026-05-05 22:43:39 -04:00
Tom Alexander
8a54291834 Switch to kubernetes ipam mode. 2026-05-05 22:43:39 -04:00
Tom Alexander
ed786cf926 Fix service cluster ip range. 
Kubernetes only allows a /112 for service ip range.
 2026-05-05 22:43:38 -04:00
Tom Alexander
0f09d38212 Fix trailing line break in kubernetes encryption config. 2026-05-05 22:43:38 -04:00
Tom Alexander
0215812ee9 Move the yaml functions to their own file. 2026-05-05 22:43:38 -04:00
Tom Alexander
d26b3d5ebf Introduce functions to generate yaml. 
The toYAML function is just an alias to toJSON which is technically fine since YAML is a superset of JSON, but these new functions will generate actual YAML.
 2026-05-05 22:43:38 -04:00
Tom Alexander
2861fddf6f Add missing cidr declarations. 2026-05-05 22:43:38 -04:00
Tom Alexander
0e8393762d Fix DNS resolution. 2026-05-05 22:43:38 -04:00
Tom Alexander
45cc48b3b5 Apply the git repo to the cluster. 2026-05-05 22:43:38 -04:00
Tom Alexander
0a112a931a Trust flux's ssh key in the yaml git repo. 2026-05-05 22:43:37 -04:00
Tom Alexander
3b3f27bd59 Generic secrets for ssh keys. 2026-05-05 22:43:37 -04:00
Tom Alexander
f19d018a34 Generic secrets for pgp keys. 2026-05-05 22:43:37 -04:00
Tom Alexander
d277ca5634 Generate kubernetes secrets for ssh keys. 2026-05-05 22:43:37 -04:00
Tom Alexander
1f02259850 Install CoreDNS. 2026-05-05 22:43:37 -04:00
Tom Alexander
9382057b47 Generate pgp keys for sops. 2026-05-05 22:43:37 -04:00
Tom Alexander
586198586b Generate ssh keys for flux bootstrap. 2026-05-05 22:43:36 -04:00
Tom Alexander
2efe37993a Move the cluster bootstrap into the keys flake. 
Bootstrapping the cluster needs access to secrets, so I am moving it into the keys flake.
 2026-05-05 22:43:36 -04:00
Tom Alexander
61583f9eff Set up flux. 2026-05-05 22:43:36 -04:00
Tom Alexander
54782da612 Add a bootstrap role. 2026-05-05 22:43:36 -04:00
Tom Alexander
4d499c0210 Add a bootstrap role to load manifests into the cluster. 2026-05-05 22:43:36 -04:00