update

.vscode/launch.json

@@ -2,21 +2,21 @@
     "version": "0.2.0",
     "configurations": [
         {
-            "name": "Bootstrap Local",
+            "name": "🚀 Bootstrap Local",
             "preLaunchTask": "bootstrap-local",
             "request": "attach",
             "type": "node",
             "timeout": 1
         },
         {
-            "name": "Destroy Local",
+            "name": "🔥 Destroy Local",
             "preLaunchTask": "destroy-local",
             "request": "attach",
             "type": "node",
             "timeout": 1
         },
         {
-            "name": "Validate Manifests",
+            "name": "✅ Validate Manifests",
             "preLaunchTask": "validate-manifests",
             "request": "attach",
             "type": "node",

k8s/apps/base/gitops-dashboard/release.yaml

@@ -15,6 +15,13 @@ spec:
   values:
     adminUser:
       create: true
+      username: admin
+      passwordHash: $2a$12$6twAYNqxU3Pz3PqVYTJN9uE5LaMDj3R1.TgLvalUoKeLnzKsFkK3i
     ingress:
       enabled: true
-      className: traefik-ingress
+      className: traefik-ingress
+      hosts:
+        - host: gitops.${domain}
+          paths:
+            - path: /
+              pathType: ImplementationSpecific

k8s/apps/overlays/local/kustomization.yaml

@@ -1,11 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../base/gitops-dashboard
-
-patches:
-  - path: patches/gitops-dashboard-patch.yaml
-    target:
-      kind: HelmRelease
-      name: gitops-dashboard
-      namespace: flux-system
+  - ../../base/gitops-dashboard

k8s/clusters/local/apps.yaml

@@ -13,4 +13,7 @@ spec:
     name: flux-system
   path: ./k8s/apps/overlays/local
   prune: true
-  wait: true
+  wait: true
+  postBuild:
+    substitute:
+      domain: "local"

k8s/clusters/local/configs.yaml

@@ -12,4 +12,10 @@ spec:
     name: flux-system
   path: ./k8s/configs/overlays/local
   prune: true
-  wait: true
+  wait: true
+  postBuild:
+    substitute:
+      domain: "local"
+      cluster_issuer_certificate_name: "selfsigned-cluster-issuer"
+      basic_auth_username: "admin"
+      basic_auth_password: "admin"

k8s/clusters/local/infrastructure.yaml

@@ -12,4 +12,6 @@ spec:
   path: ./k8s/infrastructure/overlays/local
   prune: true
   wait: true
-
+  postBuild:
+    substitute:
+      domain: "local"

k8s/configs/base/certificates/cluster-issuer-certificate.yaml

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: cluster-issuer-certificate
+  namespace: traefik-ingress
+spec:
+  secretName: cluster-issuer-certificate-tls
+  dnsNames:
+    - "${domain}"
+    - "*.${domain}"
+  issuerRef:
+    name: ${cluster_issuer_certificate_name}
+    kind: ClusterIssuer

k8s/configs/base/cluster-issuers/letsencrypt-cloudflare-cluster-issuer.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: cloudflare-letsencrypt-cluster-issuer
+  namespace: traefik-ingress
+spec:
+  acme:
+    server: ${letsencrypt_server}
+    email: ${letsencrypt_email}
+    privateKeySecretRef:
+      name: cloudflare-letsencrypt-cluster-issuer-key
+    solvers:
+      - dns01:
+          cloudflare:
+            email: ${cloudflare_email}
+            apiTokenSecretRef:
+              name: cloudflare-dns-api-key-secret
+              key: api-token

k8s/configs/base/cluster-issuers/selfsigned-local.yaml → k8s/configs/base/cluster-issuers/selfsigned-cluster-issuer.yaml

@@ -1,6 +1,6 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: selfsigned-local
+  name: selfsigned-cluster-issuer
 spec:
   selfSigned: {}

k8s/configs/base/middlewares/basic-auth.yaml → k8s/configs/base/middlewares/basic-auth-middleware.yaml

@@ -1,8 +1,8 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
-  name: basic-auth
+  name: basic-auth-middleware
   namespace: traefik-ingress
 spec:
   basicAuth:
-    secret: admin:$$2y$$05$$GdZ9cv6XpHWQyz77u1ixMu5qjcS.0Ni.mrvn7TWpKmTYA1wM4p1HW
+    secret: basic-auth-secret

k8s/configs/base/secrets/basic-auth-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: basic-auth-secret
+  namespace: traefik-ingress
+type: kubernetes.io/basic-auth
+stringData:
+  username: admin
+  password: admin
+

k8s/configs/base/secrets/cloudflare-api-key-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-dns-api-key-secret
+  namespace: traefik-ingress
+type: Opaque
+stringData:
+  api-token: cloudflare_api_token

k8s/configs/overlays/local/kustomization.yaml

@@ -1,12 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../base/cluster-issuers/selfsigned-local.yaml
-  - ../../base/certificates/certificate-local.yaml
-
-patches:
-  - path: patches/certificate-local-patch.yaml
-    target:
-      kind: Certificate
-      name: certificate-local
-      namespace: traefik-ingress
+  - ../../base/certificates/cluster-issuer-certificate.yaml
+  - ../../base/cluster-issuers/selfsigned-cluster-issuer.yaml
+  - ../../base/middlewares/basic-auth-middleware.yaml
+  - ../../base/secrets/basic-auth-secret.yaml

k8s/infrastructure/base/traefik-ingress/release.yaml

@@ -21,5 +21,13 @@ spec:
       dashboard:
         entryPoints:
           - websecure
+        matchRule: Host(`traefik.${domain}`)
+        middlewares:
+          - name: basic-auth-middleware
+            namespace: traefik-ingress
+    tlsStore:
+      default:
+        defaultCertificate:
+          secretName: cluster-issuer-certificate-tls