bundles/traefik/files/kube.yaml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

# TODO: how to handle services going away (e.g. during update/backup)
apiVersion: v1
kind: Pod
metadata:
  name: traefik
  labels:
    traefik.enable: true
    traefik.http.routers.traefik-metrics.entrypoints: metrics
    traefik.http.routers.traefik-metrics.rule: Path(`/metrics/traefik`)
    traefik.http.routers.traefik-metrics.middlewares: replacepath-bare
    traefik.http.routers.traefik-metrics.service: prometheus@internal
    # common middleware
    ## metrics
    traefik.http.middlewares.replacepath-bare.replacepath.path: /
    traefik.http.middlewares.replacepath-metrics.replacepath.path: /metrics
    ## authelia
    traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader: true
    traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders: Remote-User,Remote-Groups,Remote-Email,Remote-Name
% if node.name == "inazuma":
    traefik.http.middlewares.authelia.forwardAuth.address: http://authelia:9091/api/authz/forward-auth
% elif node.name == "shimakaze":
    traefik.http.middlewares.authelia.forwardAuth.address: http://inazuma:9091/api/authz/forward-auth
% endif
% if node.name == "inazuma--TODO":
    ## tsauth
    traefik.http.middlewares.tsauth.forwardAuth.trustForwardHeader: true
    traefik.http.middlewares.tsauth.forwardAuth.authResponseHeaders: ^Tailscale-
    traefik.http.middlewares.tsauth.forwardAuth.address: http://localhost:3000
% endif
spec:
  restartPolicy: Never
  dnsPolicy: Default
  containers:
    - name: traefik
      image: docker.io/library/traefik:v3.4.3
      args:
        - --log.level=info
        - --accesslog=true
        - --accesslog.format=json
        - --accesslog.filepath=/data/access.log
        - --accesslog.bufferingsize=0
        - --accesslog.fields.headers.defaultmode=drop
        - --accesslog.fields.headers.names.User-Agent=keep
        - --api.dashboard=true
        - --api.insecure=true
        - --metrics.prometheus=true
        - --metrics.prometheus.manualrouting=true
        # providers
        - --providers.file.directory=/etc/traefik
        - --providers.file.watch=true
        - --providers.docker=true
        - --providers.docker.exposedByDefault=false
        # entrypoints
        - --entrypoints.metrics.address=:9010
        - --entrypoints.traefik.address=:4000
        - --entrypoints.http.address=:80
        - --entrypoints.https.address=:443
        # certs
        - --certificatesresolvers.le.acme.email=r+acme@gnzler.io
        - --certificatesresolvers.le.acme.storage=/data/acme.json
        # - --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
        # http challenge doesn't work for tailscale endpoints
        # - --certificatesresolvers.le.acme.httpchallenge.entrypoint=http
        - --certificatesresolvers.le.acme.dnschallenge.provider=cloudflare
        - --certificatesresolvers.ts.tailscale=true
      envFrom:
        - secretRef:
            name: traefik
      volumeMounts:
        - name: traefik-data
          mountPath: /data
        - name: traefik-file-provider
          mountPath: /etc/traefik
          readOnly: true
        - mountPath: /var/run/docker.sock:z
          name: podmansock
          readOnly: true
        - mountPath: /var/run/tailscale/tailscaled.sock:z
          name: tailscaledsock
      ports:
        - containerPort: 80
          hostPort: 80
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          protocol: TCP
        - containerPort: 4000
          hostPort: 4000
          protocol: TCP
        - containerPort: 9010
          hostPort: 9010
          protocol: TCP

      # TODO: investigate, not useful on it's own because:
      #       httpGet translates to a curl invocation inside the container, puts
      #       a requirement on the container
      #       https://github.com/containers/podman/blob/v4.8.3/pkg/specgen/generate/kube/kube.go#L647

      # livenessProbe:
      #   httpGet:
      #     path: /ping # needs --ping=true
      #     port: 4000
      #   initialDelaySeconds: 2
      #   periodSeconds: 20
      resources:
        limits:
          cpu: 1000m
          memory: 512Mi
        requests:
          cpu: 10m
          memory: 75Mi
% if node.name == "inazuma--TODO":
    - name: tsauth
      image: docker.io/library/busybox:stable-uclibc
      command:
        - /tsauth
      volumeMounts:
        - name: tsauthbin
          mountPath: /tsauth
          readOnly: true
        - mountPath: /var/run/tailscale/tailscaled.sock:z
          name: tailscaledsock
% endif
  volumes:
  - name: traefik-data
    hostPath:
      path: /var/lib/traefik
      type: DirectoryOrCreate
  - name: traefik-file-provider
    hostPath:
      path: /etc/traefik
      type: DirectoryOrCreate
  - name: podmansock
    hostPath:
      path: /run/podman/podman.sock
      type: File
  - name: tailscaledsock
    hostPath:
      path: /run/tailscale/tailscaled.sock
      type: File
% if node.name == "inazuma--TODO":
  - name: tsauthbin
    hostPath:
      path: /home/robert/tsauth
      type: File
% endif