automatically deploy traefik

apps/adguard/deployment.yaml

@@ -28,7 +28,7 @@ spec:
         env:
         - name: TZ
           value: Europe/Berlin
-        image: adguard/adguardhome:v0.107.7
+        image: adguard/adguardhome:v0.107.41
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

apps/adguard/ingress.yaml

@@ -1,42 +1,15 @@
-# apiVersion: traefik.containo.us/v1alpha1
-# kind: Middleware
-# metadata:
-#   name: authentik-auth
-#   namespace: adguard
-# spec:
-#   forwardAuth:
-#     address: https://adguard.kluster.moll.re/outpost.goauthentik.io/auth/traefik
-#     trustForwardHeader: true
-#     authResponseHeaders:
-#       - X-authentik-username
-#       - X-authentik-groups
-#       - X-authentik-email
-#       - X-authentik-name
-#       - X-authentik-uid
-#       - X-authentik-jwt
-#       - X-authentik-meta-jwks
-#       - X-authentik-meta-outpost
-#       - X-authentik-meta-provider
-#       - X-authentik-meta-app
-#       - X-authentik-meta-version
-
-# ---
-
 apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
+kind: IngressRouteTCP
 metadata:
-  name: adguard-ingress
+  name: adguard-tls-ingress
   namespace: adguard
 spec:
   entryPoints:
-    - websecure
+    - dnsovertls
   routes:
-    - match: Host(`adguard.kluster.moll.re`)
+    - match: HostSNI(`adguard.kluster.moll.re`)
-      kind: Rule
-      # middlewares:
-      #   - name: authentik-auth
       services:
-        - name: adguard-home
+        - name: adguard-adguard-home-dns-tcp
-          port: 3000
+          port: 53
   tls:
     certResolver: default-tls

infrastructure/traefik-system/config.values.yaml

@@ -1,2 +0,0 @@
-name: traefik
-chart: traefik/traefik

infrastructure/traefik-system/configmap.yaml

@@ -2,7 +2,6 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: traefik-config
-  namespace: traefik-system
 data:
   traefik.toml: |
     [ping]
@@ -69,6 +68,8 @@ data:
         address = ":9100"
       [entryPoints.traefik]
         address = ":9000"
+      [entryPoints.dnsovertls] # route dns over https to other pods but provide own certificate
+        address = ":853"
 
     [metrics]
       [metrics.influxDB2]

infrastructure/traefik-system/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - namespace.yaml
+  - pvc.yaml
+  - configmap.yaml
+
+namespace: traefik-system
+
+helmCharts:
+  - name: traefik
+    releaseName: traefik
+    version: 26.0.0
+    valuesFile: values.yaml
+    repo: https://helm.traefik.io/traefik
+  # - name: telegraf
+  #   releaseName: telegraf?
+  #   version: "?"
+  #   valuesFile: telegraf.values.yaml
+  #   repo: https://helm.influxdata.com/

infrastructure/traefik-system/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

infrastructure/traefik-system/pvc.yaml

@@ -1,13 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  namespace: traefik-system
   name: traefik-certificate
 spec:
-  # storageClassName: fast
   capacity:
     storage: "10Mi"
-  # volumeMode: Filesystem
   accessModes:
     - ReadWriteOnce
   nfs:
@@ -17,10 +14,8 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  namespace: traefik-system
   name: traefik-certificate
 spec:
-  # storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:

infrastructure/traefik-system/telegraf.config.values.yaml

@@ -1,2 +0,0 @@
-name: telegraf-traefik
-chart: influxdata/telegraf

infrastructure/traefik-system/values.yaml

@@ -1,11 +1,3 @@
-# Default values for Traefik
-image:
-  name: traefik
-  # defaults to appVersion
-  tag: ""
-  pullPolicy: IfNotPresent
-
-
 #
 # Configure the deployment
 #
@@ -158,12 +150,6 @@ volumes: []
   #     name: traefik-config
 
   
-# - name: public-cert
-#   mountPath: "/certs"
-#   type: secret
-# - name: '{{ printf "%s-configs" .Release.Name }}'
-#   mountPath: "/config"
-#   type: configMap
 
 # Additional volumeMounts to add to the Traefik container
 additionalVolumeMounts:
@@ -192,24 +178,17 @@ additionalArguments: []
 env:
   - name: TZ
     value: "Europe/Berlin"
-# - name: SOME_VAR
-#   value: some-var-value
-# - name: SOME_VAR_FROM_CONFIG_MAP
-#   valueFrom:
-#     configMapRef:
-#       name: configmap-name
-#       key: config-key
-# - name: SOME_SECRET
-#   valueFrom:
-#     secretKeyRef:
-#       name: secret-name
-#       key: secret-key
-
 
 
 
 # Configure ports
-ports: {} # leave unconfigured to use the values from the toml file
+ports:
+  # add a new one, the other ones are kept the same.
+  dnsovertls:
+    port: 853
+    expose: true
+    exposedPort: 853
+    protocol: TCP
 
 
 envFrom: []

kluster-deployments/kustomization.yaml

@@ -5,10 +5,14 @@ namespace: argocd
 
 
 resources:
+  # infrastructure
   - projects.yaml
   - nfs/
   - backup/
   - argocd-imageupdate/
+  - traefik/
+
+  # simple apps
   - whoami/
   - journal/
   - immich/

kluster-deployments/traefik/application.yaml

@@ -0,0 +1,19 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik-application
+  namespace: argocd
+
+spec:
+  project: infrastructure
+  source:
+    repoURL: https://github.com/moll-re/k3s-infra.git
+    targetRevision: main
+    path: infrastructure/traefik-system
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

kluster-deployments/traefik/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - application.yaml