diff --git a/inventories/group_vars/control_plane/headscale.yaml b/inventories/group_vars/control_plane/headscale.yaml index acb584d8..6e226b45 100644 --- a/inventories/group_vars/control_plane/headscale.yaml +++ b/inventories/group_vars/control_plane/headscale.yaml @@ -1,6 +1,4 @@ --- -headscale_tls: no - # only hexadecimal passwords are allowed and need to be prefixed with "privkey:" # should be 64 characters long headscale_private_key: privkey:38f1186d8c9d468379f1143282ae37f4259cb617b7aa52de223d90f605983c58 @@ -11,3 +9,13 @@ headscale_db_password: a-secure-password headscale_db_resources: {} headscale_ipv6_prefix: fd7a:115c:a1e0::/48 + +headscale_ingress_enabled: false + +headscale_httproute_enabled: true +headscale_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +headscale_httproute_hostnames: + - headscale.{{ metal_control_plane_gateway_dns }} diff --git a/inventories/group_vars/control_plane/logging.yaml b/inventories/group_vars/control_plane/logging.yaml index 438cbb73..d61537d9 100644 --- a/inventories/group_vars/control_plane/logging.yaml +++ b/inventories/group_vars/control_plane/logging.yaml @@ -1,5 +1,5 @@ --- -logging_ingress_loki_tls: no +logging_ingress_enabled: false logging_ingress_dns: "loki.{{ metal_control_plane_ingress_dns }}" logging_alloy_enabled: true @@ -7,8 +7,19 @@ logging_alloy_enabled: true logging_alloy_service_monitor_enabled: false logging_alloy_loki_write_endpoints: - - url: "http://{{ logging_ingress_dns }}:8080/loki/api/v1/push" + - url: "http://loki.{{ metal_control_plane_gateway_dns }}/loki/api/v1/push" + basic_auth: + username: promtail + password: "{{ logging_ingress_loki_basic_auth_password }}" logging_promtail_enabled: false logging_alloy_cluster_label: "mini-lab" + +logging_httproute_enabled: true +logging_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http + +logging_ingress_loki_basic_auth_password: thisissecure789 diff --git a/inventories/group_vars/control_plane/metal_db.yaml b/inventories/group_vars/control_plane/metal_db.yaml index d3f482e4..77639ef5 100644 --- a/inventories/group_vars/control_plane/metal_db.yaml +++ b/inventories/group_vars/control_plane/metal_db.yaml @@ -1,9 +1,7 @@ --- metal_db_backup_restore_sidecar_provider: local -metal_db_expose_frontend: yes - metal_db_resources: {} metal_db_storage_size: 100Mi -metal_db_backup_restore_sidecar_object_max_keep: 10 \ No newline at end of file +metal_db_backup_restore_sidecar_object_max_keep: 10 diff --git a/inventories/group_vars/control_plane/monitoring.yaml b/inventories/group_vars/control_plane/monitoring.yaml index 0e2c0095..a49648ec 100644 --- a/inventories/group_vars/control_plane/monitoring.yaml +++ b/inventories/group_vars/control_plane/monitoring.yaml @@ -1,14 +1,43 @@ --- -monitoring_ingress_grafana_tls: no - monitoring_grafana_github_oauth: enabled: false monitoring_grafana_extra_secret_mounts: [] monitoring_thanos_receive_enabled: true -monitoring_thanos_receive_ingress_enabled: true monitoring_thanos_receive_size: 5Gi monitoring_prometheus_core_dns_enabled: true event_exporter_enabled: false + +monitoring_prometheus_ingress_enabled: false +monitoring_grafana_ingress_enabled: false +monitoring_alertmanager_ingress_enabled: false +monitoring_thanos_receive_ingress_enabled: false + +monitoring_prometheus_httproute_enabled: true +monitoring_prometheus_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +monitoring_grafana_httproute_enabled: true +monitoring_grafana_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +monitoring_alertmanager_httproute_enabled: true +monitoring_alertmanager_httproute_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http +monitoring_thanos_receive_httproute_enabled: true +monitoring_thanos_receive_parent_refs: +- name: metal-control-plane + namespace: "{{ metal_control_plane_namespace }}" + sectionName: http + +monitoring_alertmanager_deploy_envoy_gateway_basic_auth: true +monitoring_alertmanager_ingress_basic_auth_password: thisissecure123 + +monitoring_thanos_deploy_envoy_gateway_basic_auth: true +monitoring_thanos_receive_ingress_basic_auth_password: thisissecure456 diff --git a/inventories/group_vars/control_plane/zitadel.yaml b/inventories/group_vars/control_plane/zitadel.yaml index d9c6a269..644bfade 100644 --- a/inventories/group_vars/control_plane/zitadel.yaml +++ b/inventories/group_vars/control_plane/zitadel.yaml @@ -6,6 +6,7 @@ zitadel_port: 8080 zitadel_skip_verify_tls: true zitadel_insecure: true +zitadel_enabled_ingress: false zitadel_httproute_enabled: true zitadel_httproute_parent_refs: - name: metal-control-plane diff --git a/inventories/group_vars/partition/alloy.yaml b/inventories/group_vars/partition/alloy.yaml index bd8dba8e..2ce91308 100644 --- a/inventories/group_vars/partition/alloy.yaml +++ b/inventories/group_vars/partition/alloy.yaml @@ -1,2 +1,5 @@ alloy_loki_write_endpoints: - - url: "http://loki.{{ metal_control_plane_ingress_dns }}:8080/loki/api/v1/push" + - url: "http://loki.{{ metal_control_plane_gateway_dns }}/loki/api/v1/push" + basic_auth: + username: promtail + password: thisissecure789 diff --git a/inventories/group_vars/partition/prometheus.yaml b/inventories/group_vars/partition/prometheus.yaml index 8c39ce1d..550ef4e9 100644 --- a/inventories/group_vars/partition/prometheus.yaml +++ b/inventories/group_vars/partition/prometheus.yaml @@ -20,7 +20,10 @@ prometheus_ipmi_exporter_targets: prometheus_blackbox_exporter_metal_api_probe_url: "{{ metal_partition_metal_api_protocol }}://{{ metal_partition_metal_api_addr }}:{{ metal_partition_metal_api_port }}{{ metal_partition_metal_api_basepath }}v1/version" prometheus_remote_write: - - url: "http://thanos-receive.{{ metal_control_plane_ingress_dns }}:8080/api/v1/receive" + - url: "http://thanos-receive.{{ metal_control_plane_gateway_dns }}/api/v1/receive" + basic_auth: + username: thanos-receive + password: thisissecure456 prometheus_hosts_content: | 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml index d0f1a4d3..ad203ba6 100644 --- a/roles/gateway/tasks/main.yml +++ b/roles/gateway/tasks/main.yml @@ -11,10 +11,12 @@ - name: Deploy Envoy GatewayClass kubernetes.core.k8s: definition: "{{ lookup('file', 'gatewayclass.yaml') | from_yaml }}" + apply: true - name: Deploy metal-control-plane EnvoyProxy kubernetes.core.k8s: definition: "{{ lookup('template', 'envoyproxy.yaml') | from_yaml }}" + apply: true - name: Deploy metal-api certificate secret kubernetes.core.k8s: @@ -28,7 +30,9 @@ data: tls.crt: "{{ lookup('file', 'certs/metal-api/server.pem') | b64encode }}" tls.key: "{{ lookup('file', 'certs/metal-api/server-key.pem') | b64encode }}" + apply: true - name: Deploy metal-control-plane Gateway kubernetes.core.k8s: definition: "{{ lookup('template', 'gateway.yaml') | from_yaml }}" + apply: true