Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: use gateway-api #349

Merged
merged 11 commits into from
Jul 26, 2024
Merged

feat: use gateway-api #349

merged 11 commits into from
Jul 26, 2024

Conversation

volschin
Copy link
Owner

@volschin volschin commented Jul 19, 2024 •
edited
Loading

@volschin volschin linked an issue Jul 19, 2024 that may be closed by this pull request
feat: use gateway API instead of nginx #33
Closed
@volschin volschin force-pushed the gateway-api branch 2 times, most recently from 243e495 to 4247c27 Compare July 23, 2024 22:06
@volschin
Copy link
Owner Author

volschin commented Jul 24, 2024 •
edited
Loading

How to annotate for authelia?
How to modify for theme-park usage?

  1. needed
  1. open

@github-actions GitHub Actions
Copy link

github-actions bot commented Jul 26, 2024 •
edited
Loading 

--- kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

+++ kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

@@ -80,8 +80,8 @@

       enabled: true
       serviceMonitor:
         enabled: true
         trustCRDsExist: true
   valuesFrom:
   - kind: ConfigMap
-    name: cilium-helm-values-5bgbdk9558
+    name: cilium-helm-values-98mmb9b956
 
--- kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium ConfigMap: kube-system/cilium-helm-values-5bgbdk9558

+++ kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium ConfigMap: kube-system/cilium-helm-values-5bgbdk9558

@@ -1,75 +0,0 @@

----
-apiVersion: v1
-data:
-  values.yaml: |
-    ---
-    autoDirectNodeRoutes: true
-    bandwidthManager:
-      enabled: true
-      bbr: true
-    bpf:
-      masquerade: true
-      tproxy: true
-    cgroup:
-      automount:
-        enabled: false
-      hostRoot: /sys/fs/cgroup
-    cluster:
-      id: 1
-      name: "homelab"
-    cni:
-      exclusive: false
-    # NOTE: devices might need to be set if you have more than one active NIC on your hosts
-    # devices: eno+ eth+
-    endpointRoutes:
-      enabled: true
-    enableRuntimeDeviceDetection: true
-    hubble:
-      enabled: false
-    ipam:
-      mode: kubernetes
-    ipv4NativeRoutingCIDR: 10.69.0.0/16
-    k8sServiceHost: 127.0.0.1
-    k8sServicePort: 7445
-    kubeProxyReplacement: true
-    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
-    l2announcements:
-      enabled: true
-    gatewayAPI:
-      enabled: true
-    loadBalancer:
-      algorithm: maglev
-      mode: hybrid
-    localRedirectPolicy: true
-    operator:
-      replicas: 1
-      rollOutPods: true
-    rollOutCiliumPods: true
-    routingMode: native
-    securityContext:
-      capabilities:
-        ciliumAgent:
-          - CHOWN
-          - KILL
-          - NET_ADMIN
-          - NET_RAW
-          - IPC_LOCK
-          - SYS_ADMIN
-          - SYS_RESOURCE
-          - DAC_OVERRIDE
-          - FOWNER
-          - SETGID
-          - SETUID
-        cleanCiliumState:
-          - NET_ADMIN
-          - SYS_ADMIN
-          - SYS_RESOURCE
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/name: cilium
-    kustomize.toolkit.fluxcd.io/name: cilium
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: cilium-helm-values-5bgbdk9558
-  namespace: kube-system
-
--- kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium ConfigMap: kube-system/cilium-helm-values-98mmb9b956

+++ kubernetes/apps/kube-system/cilium/app Kustomization: flux-system/cilium ConfigMap: kube-system/cilium-helm-values-98mmb9b956

@@ -0,0 +1,77 @@

+---
+apiVersion: v1
+data:
+  values.yaml: |
+    ---
+    autoDirectNodeRoutes: true
+    bandwidthManager:
+      enabled: true
+      bbr: true
+    bpf:
+      masquerade: true
+      tproxy: true
+    cgroup:
+      automount:
+        enabled: false
+      hostRoot: /sys/fs/cgroup
+    cluster:
+      id: 1
+      name: "homelab"
+    cni:
+      exclusive: false
+    # NOTE: devices might need to be set if you have more than one active NIC on your hosts
+    # devices: eno+ eth+
+    endpointRoutes:
+      enabled: true
+    enableRuntimeDeviceDetection: true
+    hubble:
+      enabled: false
+    ipam:
+      mode: kubernetes
+    ipv4NativeRoutingCIDR: 10.69.0.0/16
+    k8sServiceHost: 127.0.0.1
+    k8sServicePort: 7445
+    kubeProxyReplacement: true
+    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
+    l2announcements:
+      enabled: true
+    gatewayAPI:
+      enabled: true
+    loadBalancer:
+      algorithm: maglev
+      mode: dsr
+    localRedirectPolicy: true
+    operator:
+      replicas: 1
+      rollOutPods: true
+    rollOutCiliumPods: true
+    routingMode: native
+    securityContext:
+      capabilities:
+        ciliumAgent:
+          - PERFMON
+          - BPF
+          - CHOWN
+          - KILL
+          - NET_ADMIN
+          - NET_RAW
+          - IPC_LOCK
+          - SYS_ADMIN
+          - SYS_RESOURCE
+          - DAC_OVERRIDE
+          - FOWNER
+          - SETGID
+          - SETUID
+        cleanCiliumState:
+          - NET_ADMIN
+          - SYS_ADMIN
+          - SYS_RESOURCE
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: cilium
+    kustomize.toolkit.fluxcd.io/name: cilium
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: cilium-helm-values-98mmb9b956
+  namespace: kube-system
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/cilium-gateway

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/cilium-gateway

@@ -0,0 +1,40 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: cilium-gateway
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: cilium-gateway
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 60m
+  path: ./kubernetes/apps/network/gateway/cilium
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+    - kind: ConfigMap
+      name: cluster-user-settings
+      optional: true
+    - kind: Secret
+      name: cluster-user-secrets
+      optional: true
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: network
+  timeout: 5m
+  wait: false
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/gateway-api-crds

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/gateway-api-crds

@@ -0,0 +1,40 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: gateway-api-crds
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: gateway-api-crds
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 60m
+  path: ./kubernetes/apps/network/gateway/gateway-api
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+    - kind: ConfigMap
+      name: cluster-user-settings
+      optional: true
+    - kind: Secret
+      name: cluster-user-secrets
+      optional: true
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: network
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps/network/gateway/cilium Kustomization: flux-system/cilium-gateway GatewayClass: network/cilium

+++ kubernetes/apps/network/gateway/cilium Kustomization: flux-system/cilium-gateway GatewayClass: network/cilium

@@ -0,0 +1,13 @@

+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    app.kubernetes.io/name: cilium-gateway
+    kustomize.toolkit.fluxcd.io/name: cilium-gateway
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: cilium
+  namespace: network
+spec:
+  controllerName: io.cilium/gateway-controller
+
--- kubernetes/apps/network/gateway/cilium Kustomization: flux-system/cilium-gateway Gateway: network/cilium-external

+++ kubernetes/apps/network/gateway/cilium Kustomization: flux-system/cilium-gateway Gateway: network/cilium-external

@@ -0,0 +1,37 @@

+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    external-dns.alpha.kubernetes.io/target: gateway...PLACEHOLDER..
+  labels:
+    app.kubernetes.io/name: cilium-gateway
+    kustomize.toolkit.fluxcd.io/name: cilium-gateway
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: cilium-external
+  namespace: network
+spec:
+  gatewayClassName: cilium
+  infrastructure:
+    annotations:
+      io.cilium/lb-ipam-ips: 192.168.2.20
+  listeners:
+  - allowedRoutes:
+      namespaces:
+        from: All
+    hostname: '*.'
+    name: http
+    port: 80
+    protocol: HTTP
+  - allowedRoutes:
+      namespaces:
+        from: All
+    hostname: '*...PLACEHOLDER..'
+    name: https
+    port: 443
+    protocol: HTTPS
+    tls:
+      certificateRefs:
+      - kind: Secret
+        name: wildcard-cert-tls
+
--- kubernetes/apps/network/gateway/cilium Kustomization: flux-system/cilium-gateway Gateway: network/cilium-internal

+++ kubernetes/apps/network/gateway/cilium Kustomization: flux-system/cilium-gateway Gateway: network/cilium-internal

@@ -0,0 +1,35 @@

+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    app.kubernetes.io/name: cilium-gateway
+    kustomize.toolkit.fluxcd.io/name: cilium-gateway
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: cilium-internal
+  namespace: network
+spec:
+  gatewayClassName: cilium
+  infrastructure:
+    annotations:
+      io.cilium/lb-ipam-ips: 192.168.2.21
+  listeners:
+  - allowedRoutes:
+      namespaces:
+        from: All
+    hostname: '*...PLACEHOLDER..'
+    name: http
+    port: 80
+    protocol: HTTP
+  - allowedRoutes:
+      namespaces:
+        from: All
+    hostname: '*...PLACEHOLDER..'
+    name: https
+    port: 443
+    protocol: HTTPS
+    tls:
+      certificateRefs:
+      - kind: Secret
+        name: wildcard-cert-tls
+

@github-actions GitHub Actions
Copy link 

--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

@@ -74,13 +74,13 @@

   bpf-lb-sock-terminate-pod-connections: 'false'
   nodeport-addresses: ''
   enable-health-check-nodeport: 'true'
   enable-health-check-loadbalancer-ip: 'false'
   node-port-bind-protection: 'true'
   enable-auto-protect-node-port-range: 'true'
-  bpf-lb-mode: hybrid
+  bpf-lb-mode: dsr
   bpf-lb-algorithm: maglev
   bpf-lb-acceleration: disabled
   enable-svc-source-range-check: 'true'
   enable-l2-neigh-discovery: 'true'
   arping-refresh-period: 30s
   k8s-require-ipv4-pod-cidr: 'false'
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -16,13 +16,13 @@

     rollingUpdate:
       maxUnavailable: 2
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 64d894172358f57d08b38ea7c79989cade7008b32b147bd634174f247146f236
+        cilium.io/cilium-configmap-checksum: a83319a8bb32b2a5a4775f3aa44eb104c50388f69d6f6f1d33ca974562b133eb
       labels:
         k8s-app: cilium
         app.kubernetes.io/name: cilium-agent
         app.kubernetes.io/part-of: cilium
     spec:
       securityContext:
@@ -139,12 +139,14 @@

         securityContext:
           seLinuxOptions:
             level: s0
             type: spc_t
           capabilities:
             add:
+            - PERFMON
+            - BPF
             - CHOWN
             - KILL
             - NET_ADMIN
             - NET_RAW
             - IPC_LOCK
             - SYS_ADMIN
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -20,13 +20,13 @@

       maxSurge: 25%
       maxUnavailable: 100%
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 64d894172358f57d08b38ea7c79989cade7008b32b147bd634174f247146f236
+        cilium.io/cilium-configmap-checksum: a83319a8bb32b2a5a4775f3aa44eb104c50388f69d6f6f1d33ca974562b133eb
         prometheus.io/port: '9963'
         prometheus.io/scrape: 'true'
       labels:
         io.cilium/app: operator
         name: cilium-operator
         app.kubernetes.io/part-of: cilium

@volschin volschin marked this pull request as ready for review July 26, 2024 11:39
@volschin volschin merged commit 70824cc into main Jul 26, 2024
7 checks passed
@volschin volschin deleted the gateway-api branch July 26, 2024 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

feat: use gateway API instead of nginx
1 participant
@volschin