Initial commit: Turbo Mothership bare metal management cluster

- k0s bootstrap with Cilium and OpenEBS
- ArgoCD apps for infra, CAPI, Tinkerbell, and Netris
- Ansible playbooks for virtual baremetal lab and Netris switches
- CAPI provider manifests for k0smotron and Tinkerbell

apps/bm/tinkerbell.yaml

@@ -0,0 +1,54 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tinkerbell
+  namespace: argo
+spec:
+  project: default
+  source:
+    repoURL: ghcr.io/tinkerbell/charts
+    targetRevision: v0.22.0
+    chart: tinkerbell
+    helm:
+      values: |
+        publicIP: 172.16.81.254
+        artifactsFileServer: http://172.16.81.254:7173
+        trustedProxies:
+          - 10.244.0.0/24
+        deployment:
+          init:
+            sourceInterface: br-mgmt
+          hostNetwork: true
+          strategy:
+            type: Recreate
+            rollingUpdate: null
+          envs:
+            rufio:
+              metricsAddr: 172.16.81.254:9090
+              probeAddr: 172.16.81.254:9091
+            smee:
+              dhcpBindInterface: br-mgmt
+              ipxeHttpScriptBindAddr: 172.16.81.254
+              syslogBindAddr: 172.16.81.254
+              tftpServerBindAddr: 172.16.81.254
+            tinkController:
+              metricsAddr: 172.16.81.254:9092
+              probeAddr: 172.16.81.254:9093
+            tinkServer:
+              bindAddr: 172.16.81.254
+              metricsAddr: 172.16.81.254:9094
+              probeAddr: 172.16.81.254:9095
+            tootles:
+              bindAddr: 172.16.81.254
+            secondstar:
+              bindAddr: 172.16.81.254
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: tinkerbell
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/capi/cluster-api-operator.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-api-operator
+  namespace: argo
+spec:
+  project: default
+  source:
+    repoURL: https://kubernetes-sigs.github.io/cluster-api-operator
+    targetRevision: 0.15.1
+    chart: cluster-api-operator
+    helm:
+      values: |
+        cert-manager:
+          enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: capi
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/capi/cluster-api-providers.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: capi-providers
+  namespace: argo
+spec:
+  project: default
+  source:
+    path: manifests/capi-stack
+    repoURL: "ssh://git@git.weystrom.dev:2222/pbhv/apps.git"
+    targetRevision: HEAD
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: capi
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/infra-apps.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: infra
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.weystrom.dev/argodent/turbo-mothership.git
+    path: apps/infra
+    targetRevision: HEAD
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/infra/argocd.yaml

@@ -0,0 +1,57 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://argoproj.github.io/argo-helm
+    chart: argo-cd
+    targetRevision: "9.1.6"
+    helm:
+      releaseName: turbo
+      valuesObject:
+        fullnameOverride: turbo-argocd
+        global:
+          domain: argo.turbo.weystrom.dev
+        configs:
+          params:
+            server.insecure: true
+          cm:
+            admin.enabled: true
+        server:
+          ingress:
+            enabled: true
+            ingressClassName: nginx
+            annotations:
+              nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+              nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
+              cert-manager.io/cluster-issuer: "letsencrypt-prod"
+            extraTls:
+              - hosts:
+                  - argo.turbo.weystrom.dev
+                secretName: argocd-ingress-http
+          ingressGrpc:
+            enabled: true
+            ingressClassName: nginx
+            hostname: argo-grpc.turbo.weystrom.dev
+            annotations:
+              nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
+              cert-manager.io/cluster-issuer: "letsencrypt-prod"
+            extraTls:
+              - hosts:
+                  - argo-grpc.turbo.weystrom.dev
+                secretName: argocd-ingress-grpc
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/infra/cert-manager.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://charts.jetstack.io
+    chart: cert-manager
+    targetRevision: "1.19.2"
+    helm:
+      releaseName: turbo
+      valuesObject:
+        fullnameOverride: turbo-certmgr
+        crds:
+          enabled: true
+        ingressShim:
+          defaultIssuerName: letsencrypt-prod
+          defaultIssuerKind: ClusterIssuer
+          defaultIssuerGroup: cert-manager.io
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/infra/cilium.yaml

@@ -0,0 +1,35 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://helm.cilium.io/
+    chart: cilium
+    targetRevision: "1.18.4"
+    helm:
+      releaseName: cilium
+      valuesObject:
+        cluster:
+          name: local
+        k8sServiceHost: 65.109.94.180
+        k8sServicePort: 6443
+        kubeProxyReplacement: true
+        operator:
+          replicas: 1
+        routingMode: tunnel
+        tunnelProtocol: vxlan
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
+      - ServerSideApply=true

apps/infra/ingress-nginx.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://kubernetes.github.io/ingress-nginx
+    chart: ingress-nginx
+    targetRevision: "4.14.1"
+    helm:
+      releaseName: turbo
+      valuesObject:
+        fullnameOverride: turbo-ingress
+        controller:
+          admissionWebhooks:
+            enabled: false
+          service:
+            externalIPs:
+              - 65.109.94.180
+            type: ClusterIP
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/infra/openebs.yaml

@@ -0,0 +1,48 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: openebs
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://openebs.github.io/openebs
+    chart: openebs
+    targetRevision: "4.2.0"
+    helm:
+      releaseName: openebs
+      valuesObject:
+        preUpgradeHook:
+          enabled: false
+        localpv-provisioner:
+          localpv:
+            basePath: /var/openebs/local
+        engines:
+          replicated:
+            mayastor:
+              enabled: false
+          local:
+            zfs:
+              enabled: false
+            rawfile:
+              enabled: false
+            lvm:
+              enabled: false
+        loki:
+          enabled: false
+        minio:
+          enabled: false
+        alloy:
+          enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openebs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/infra/sealed-secrets.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sealed-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    chart: sealed-secrets
+    targetRevision: "2.17.9"
+    helm:
+      releaseName: turbo
+      valuesObject:
+        fullnameOverride: turbo-sealedsecrets
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
+      - ServerSideApply=true

apps/netris-apps.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: netris
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.weystrom.dev/argodent/turbo-mothership.git
+    path: apps/netris
+    targetRevision: HEAD
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/netris/netris-controller.yaml

@@ -0,0 +1,37 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: netris-controller
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://netrisai.github.io/charts
+    chart: netris-controller
+    targetRevision: "*"
+    helm:
+      releaseName: netris-controller
+      valuesObject:
+        ingress:
+          hosts:
+            - netris.turbo.weystrom.dev
+          tls:
+            - secretName: netris-tls
+              hosts:
+                - netris.turbo.weystrom.dev
+          annotations:
+            cert-manager.io/cluster-issuer: letsencrypt-prod
+        haproxy:
+          enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: netris-controller
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

apps/netris/netris-operator.yaml

@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: netris-operator
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://netrisai.github.io/charts
+    chart: netris-operator
+    targetRevision: "*"
+    helm:
+      releaseName: netris-operator
+      valuesObject:
+        controller:
+          host: https://netris.turbo.weystrom.dev
+          login: netris
+          password: newNet0ps
+          insecure: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: netris-operator
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true