diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml index 1aef2d7c..bb229883 100644 --- a/.github/workflows/pipeline.yml +++ b/.github/workflows/pipeline.yml @@ -7,56 +7,15 @@ on: - main workflow_dispatch: -env: - HELM_EXPERIMENTAL_OCI: true - jobs: - conform: - runs-on: ubuntu-latest - name: Conform - - steps: - - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - with: - fetch-depth: 0 - - - uses: siderolabs/conform@v0.1.0-alpha.27 - with: - token: ${{ secrets.GITHUB_TOKEN }} - lint: runs-on: ubuntu-latest - name: Lint Charts - strategy: - max-parallel: 12 - matrix: - python-version: ["3.11"] - helm-version: ["3.13.0"] - yamale-version: ["4.0.4"] - directory: - - applications - - core - - home-assistant - - infrastructure - - library + name: Lint steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: yokawasa/action-setup-kube-tools@v0.9.3 - with: - setup-tools: helm - helm: ${{ matrix.helm-version }} - - - uses: actions/setup-python@v4 - with: - python-version: ${{ matrix.python-version }} - - - uses: helm/chart-testing-action@v2.4.0 - with: - yamale_version: ${{ matrix.yamale-version }} - - - name: Lint all charts - run: ct lint --all --chart-dirs ${{ matrix.directory }}/charts --config ${{ github.workspace }}/ct.yml + - run: | + yamllint . diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 09895cdb..9cb0d72d 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -4,9 +4,6 @@ name: Pull Request on: pull_request: -env: - HELM_EXPERIMENTAL_OCI: true - jobs: conform: runs-on: ubuntu-latest @@ -23,46 +20,12 @@ jobs: lint: runs-on: ubuntu-latest - name: Lint Charts - strategy: - max-parallel: 12 - matrix: - python-version: ["3.11"] - helm-version: ["3.13.0"] - yamale-version: ["4.0.4"] - directory: - - applications - - core - - home-assistant - - infrastructure - - library + name: Lint steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 with: fetch-depth: 0 - - uses: yokawasa/action-setup-kube-tools@v0.9.3 - with: - setup-tools: helm - helm: ${{ matrix.helm-version }} - - - uses: actions/setup-python@v4 - with: - python-version: ${{ matrix.python-version }} - - - uses: helm/chart-testing-action@v2.4.0 - with: - yamale_version: ${{ matrix.yamale-version }} - - - name: List changed charts - id: list-changed - run: | - changed=$(ct list-changed --chart-dirs ${{ matrix.directory }}/charts --config ${{ github.workspace }}/ct.yml) - if [[ -n "$changed" ]]; then - echo "changed=true" >> ${GITHUB_OUTPUT} - fi - - - name: Lint changed charts - if: steps.list-changed.outputs.changed == 'true' - run: ct lint --chart-dirs ${{ matrix.directory }}/charts --config ${{ github.workspace }}/ct.yml + - run: | + yamllint . diff --git a/.gitignore b/.gitignore index 153d7e00..ad9a8323 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ TODO.md !**/secret-*.enc.yml !**/secret-generator.yaml !**/secret-generator.yml +local.env diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5f0ca0cc..6b314408 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -7,7 +7,7 @@ repos: stages: - commit-msg - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.4.0 + rev: v4.5.0 hooks: - id: check-json - id: check-merge-conflict @@ -17,12 +17,12 @@ repos: - id: destroyed-symlinks - id: detect-aws-credentials args: [ - "--allow-missing-credentials" + "--allow-missing-credentials" ] - id: detect-private-key - id: trailing-whitespace args: [ - "--markdown-linebreak-ext=md" + "--markdown-linebreak-ext=md" ] # - id: no-commit-to-branch # args: [ diff --git a/.sops.yaml b/.sops.yaml index a63090b9..e78446a5 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,3 +1,4 @@ +--- creation_rules: - - unencrypted_regex: "^(apiVersion|metadata|kind|type)$" + - encrypted_regex: ^(data|stringData)$ gcp_kms: projects/tuxnet-385112/locations/europe/keyRings/infrastructure-encryption/cryptoKeys/infrastructure-encryption diff --git a/.versionrc.json b/.versionrc.json deleted file mode 100644 index 495359c2..00000000 --- a/.versionrc.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "releaseCommitMessageFormat": "chore(release): release {{currentTag}} [skip ci] [release]", - "tagPrefix": "v", - "bumpFiles": [], - "packageFiles": [], - "header": "# Changelog\n\n" -} diff --git a/.yamllint b/.yamllint new file mode 100644 index 00000000..d51cb28a --- /dev/null +++ b/.yamllint @@ -0,0 +1,14 @@ +--- +extends: default + +ignore: + - secret-*.enc.yml + +rules: + line-length: + max: 300 + comments: + min-spaces-from-content: 1 + truthy: + ignore: + - .github/ diff --git a/README.md b/README.md index 38934607..c6cfc21e 100644 --- a/README.md +++ b/README.md @@ -1,48 +1,36 @@ # Homelab: Kubernetes Home Cluster - Applications -[![Build status](https://img.shields.io/github/actions/workflow/status/muhlba91/homelab-kubernetes-home-applications/pipeline.yml?style=for-the-badge)](https://github.com/muhlba91/homelab-kubernetes-home-applications/actions/workflows/pipeline.yml) -[![License](https://img.shields.io/github/license/muhlba91/homelab-kubernetes-home-applications?style=for-the-badge)](LICENSE.md) +[![Build status](https://img.shields.io/github/actions/workflow/status/muhlba91/homelab-home-cluster-applications/pipeline.yml?style=for-the-badge)](https://github.com/muhlba91/homelab-home-cluster-applications/actions/workflows/pipeline.yml) +[![License](https://img.shields.io/github/license/muhlba91/homelab-home-cluster-applications?style=for-the-badge)](LICENSE.md) -This repository contains applications deployed on the `home-cluster` via [ArgoCD](https://argo-cd.readthedocs.io/en/stable/) using [GitOps](https://opengitops.dev). +This repository contains applications deployed on the `home-cluster` via [Flux](https://fluxcd.io) using [GitOps](https://opengitops.dev). --- ## Bootstrapping -A Kubernetes cluster needs to be bootstrapped with the [Cilium CNI](https://cilium.io) and ArgoCD with an `Application` pointing to this repository. +A Kubernetes cluster needs to be bootstrapped with the [Cilium CNI](https://cilium.io) and Flux pointing to this repository. -For [ksops](https://github.com/viaduct-ai/kustomize-sops) and ArgoCD to decrypt the initial secrets for configuring the [External Secrets Operator](http://external-secrets.io) using [Doppler](http://doppler.com), a [Google Cloud Service Account](https://cloud.google.com/docs/authentication#service-accounts) with access to the correct KMS key needs to be set in the `argocd` namespace. You can check out [`infrastructure/charts/argocd/values.yaml`](infrastructure/charts/argocd/values.yaml) on how this secret is passed to ArgoCD. +For [ksops](https://github.com/viaduct-ai/kustomize-sops) and ArgoCD to decrypt the initial secrets for configuring the [External Secrets Operator](http://external-secrets.io) using [Doppler](http://doppler.com), a [Google Cloud Service Account](https://cloud.google.com/docs/authentication#service-accounts) with access to the correct KMS key needs to be set in the `flux` namespace. -ArgoCD will then manage Cilium, itself, and all applications as defined in this repository. +***Attention:*** some applications will be automatically deployed, others not (yet). --- -## ArgoCD App-of-Apps +## App-of-Apps -The repository layout follows ArgoCD's [app-of-apps pattern](https://argo-cd.readthedocs.io/en/stable/operator-manual/cluster-bootstrapping/). +The repository follows the app-of-apps pattern. -The first ArgoCD `Application` being defined needs to reference [`app-of-apps/values.yaml`](app-of-apps/values.yaml) and the environment specific `values-.yaml` files. +The first Flux `Kustomization` being defined needs to reference [`app-of-apps/`](app-of-apps/). -These are bootstrapping the main ArgoCD projects and applications, referring to the respective `/applications/values[-].yaml` files: +These are bootstrapping the main Flux applications, referring to the respective `/applications/` kosutomizations: -- [`infrastructure`](#infrastructure): core cluster infrastructure, like Cilium and ArgoCD -- [`core`](#core-applications): core applications, like [cert-manager](http://cert-manager.io) and [traefik](https://traefik.io) +- [`infrastructure`](#infrastructure): core cluster infrastructure +- [`core`](#core-applications): core applications - [`applications`](#user-applications): (user) applications running on the cluster/network - [`home-assistant`](#home-assistant): [Home Assistant](http://home-assistant.io) related applications -Each of these applications follows the app-of-apps pattern again using subcharts defined in the respective `charts` directory. - -### Additional Helm Value Files - -In addition to the included `values[-