This is a mono repository for my home infrastructure and Kubernetes cluster. I try to adhere to Infrastructure as Code (IaC) and GitOps practices using the tools like Terraform, Kubernetes, Bazel, ArgoCD, Renovate and GitHub Actions.
-
Click to see the insides
- Motherboard: Dell 0NT78X
- CPU: 2x Intel Xenon E5-2697 v4 (18 cores, 2.30 Ghz)
- Memory: 16x 16Gb DDR4-2400 RDIMM (SK Hynix HMA82GR7AFR8N-UH)
- Network: 2x I350 Gigabit Network Connection
- Storage:
- Dell PowerEdge Raid Controller H330 (in HBA mode)
- 4x Seagate Exos X16 12TB 7.2k SATA 6Gbps (ST12000NM001G-2M)
- 2x Goodram CX400 1TB 2,5" Sata3 (SSDPR-CX400-01T-)
- 2x Samsung PM963 960GB SSD NVMe U.2 Gen 3
- Motherboard: Dell 0NT78X
My Kubernetes cluster is deployed with Talos on the Proxmox using the following Terraform modules:
- A module for creating Talos Kubernetes VM nodes on Proxmox: https://github.com/rszamszur/home-ops/tree/master/terraform/talos/nodes
- A module for configuring and initializing the Talos Kubernetes cluster: https://github.com/rszamszur/home-ops/tree/master/terraform/talos/k8s
Core Components:
- buildbarn: Distributed caching and build infrastructure for Bazel.
- coder: Provision remote development environments via Terraform.
- kube-prometheus-stack: Cluster monitoring with Grafana nad Prometheus using the Prometheus Operator.
- democratic-csi-iscsi: A csi storage for container orchestration systems.
- cert-manager: Creates SSL certificates for services in my cluster.
- ingress-nginx: Kubernetes ingress controller using NGINX as a reverse proxy and load balancer.
- local-path-provisioner: Dynamically provisioning persistent local storage.
- actions-runner-controller: Self-hosted Github runners.
Below is an explanation on how this repo is laid out. You'll notice that I use Kustomize heavily. I do this since I follow the DRY principal when it comes to YAML files.
cluster-XXX/ #1
├── bootstrap #2
│ ├── base
│ │ ├── argocd.Namespace.yaml
│ │ ├── kustomization.yaml
│ │ └── secrets
│ │ └── ...
│ └── overlays
│ └── default
│ └── kustomization.yaml
├── gitops-controller #3
│ ├── applications
│ │ ├── gitops-controller.Application.yaml
│ │ └── kustomization.yaml
│ ├── applicationsets
│ │ ├── core-components.ApplicationSet.yaml
│ │ ├── kustomization.yaml
│ │ └── workloads.ApplicationSet.yaml
│ ├── init
│ │ └── kustomization.yaml
│ ├── kustomization.yaml
│ └── projects
│ ├── kustomization.yaml
│ └── test-project.AppProject.yaml
├── core #4
│ ├── certificates
│ │ ├── cert-manager.Application.yaml
│ │ ├── cert-manager.Namespace.yaml
│ │ ├── cert-manager-webhook-ovh.Application.yaml
│ │ └── kustomization.yaml
│ ├── ingress-controller
│ │ └── kustomization.yaml
│ ├── monitoring
│ │ ├── airgradient-dashboard.ConfigMap.yaml
│ │ ├── airgradient-dashboard.json
│ │ ├── alert-manager.Certificate.yaml
│ │ ├── grafana-tls.Certificate.yaml
│ │ ├── kube-prometheus-stack.Application.yaml
│ │ ├── kube-prometheus-stack.Namespace.yaml
│ │ ├── kustomization.yaml
│ │ └── prometheus-tls.Certificate.yaml
│ └── ...
└── workloads #5
└── ...| # | Directory Name | Description |
|---|---|---|
| 1. | cluster-XXX |
This is the cluster name. This name should be unique to the specific cluster you're targeting. If you're using CAPI, this should be the name of your cluster, the output of kubectl get cluster |
| 2. | bootstrap |
This is where bootstrapping specifc configurations are stored. These are items that get the cluster/automation started. They are usually namespaces, CRD's or install manifests.base is where are the "common" YAML would live and overlays are configurations specific to the cluster.The kustomization.yaml file in default points base and to cluster-XXX/gitops-controller/. This configuration allows the gitops-controller to bootstrap a declarative deployment cycle, taking ownership of managing its own configuration and all other specified deployments. |
| 3. | gitops-controller |
This is where specific components for the GitOps Controller lives (in this case Argo CD). The directory structure is organized as follows:
Finally, the init directory is a special folder that contains all the necessary manifest files required to initialize any GitOps controller. |
| 4. | core |
This is where YAML for the core functionality of the cluster live. Here is where the Kubernetes administrator will put things that is necissary for the functionality of the cluster (like cluster configs or cluster workloads). This core directory gets deployed as an applicationset which can be found under cluster-XXX/gitops-controller/applicationsets/core-components-appset.yaml.To add a new "core functionality" workoad, one needs to add a directory with some yaml in the core directory. See the monitoring directory as an example. |
| 5. | workloads |
This is where the workloads for this cluster live. Similar to core, the workloads directory gets loaded as part of an ApplicationSet that is under cluster-XXX/gitops-controller/applicationsets/workloads-appset.yaml.This is where Devlopers/Release Engineers do the work. They just need to commit a directory with some YAML and the applicationset takes care of creating the workload. |
To see this in action, first get yourself a cluster (using minikube as an example)
minikube start --driver=dockerFirst apply secrets:
These cannot be applied with kubectl in the regular fashion due to be encrypted with age
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/argocd-ghcr-repo-secret.yaml.age | kubectl apply -f -
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/buildbuddy-db-mysql-secret.yaml.age | kubectl apply -f -
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/coder-db-postgresql-secret.yaml.age | kubectl apply -f -
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/coder-db-url-secret.yaml.age | kubectl apply -f -
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/democratic-csi-iscsi-driver-config-secret.yaml.age | kubectl apply -f -
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/gha-runner-home-ops-secret.yaml.age | kubectl apply -f -
age -d -i ~/.config/age/key.txt cluster-home/bootstrap/base/secrets/ovh-credentials-secret.yaml.age | kubectl apply -f -Then, just apply this repo:
until kubectl apply -k https://github.com/rszamszur/home-ops/cluster-home/bootstrap/overlays/default; do sleep 3; doneThis should give you the following applications:
$ kubectl get applications -n argocd
NAME SYNC STATUS HEALTH STATUS
argocd-ingress Synced Healthy
buildbarn Synced Healthy
cert-manager Synced Healthy
cert-manager-webhook-ovh Synced Healthy
certificates Synced Healthy
coder Synced Healthy
coder-db Synced Healthy
coder-v2 Synced Healthy
democratic-csi-iscsi Synced Healthy
fastapi-mvc-example Synced Healthy
gha-runner Synced Healthy
gha-runner-controller Synced Healthy
gitops-controller Synced Healthy
ingress-controller Synced Healthy
kube-prometheus-stack Synced Healthy
monitoring Synced Healthy
storage Synced HealthyBacked by 2 applicationsets:
$ kubectl get appsets -n argocd
NAME AGE
cluster 19m
workloads 19mTo see the Argo CD UI, you'll first need the password:
kubectl get secret/argocd-initial-admin-secret -n argocd -o jsonpath='{.data.password}' | base64 -d ; echoThen port-forward to see it in your browser (using admin as the username):
kubectl -n argocd port-forward service/argocd-server 8080:443