Update README.md
This commit is contained in:
parent
5a719720ae
commit
56b6cb7290
1 changed files with 348 additions and 2 deletions
350
README.md
350
README.md
|
|
@ -1,3 +1,349 @@
|
|||
# Homelab-on-Kubernetes
|
||||
# Pi Cluster - Kubernetes on Talos Linux
|
||||
|
||||
Dumping ground for working files for Kubernetes.
|
||||
## Prerequisites
|
||||
- `talosctl` installed
|
||||
- `kubectl` installed
|
||||
- `helm` installed
|
||||
- DNS record for `controlplane.cdb-online.co.uk` pointing to VIP `10.0.1.11`
|
||||
|
||||
---
|
||||
|
||||
## 1. Generate Configuration
|
||||
|
||||
### Generate secrets only
|
||||
```bash
|
||||
talosctl gen secrets -o secrets.yaml
|
||||
```
|
||||
|
||||
### Generate full config using secrets
|
||||
```bash
|
||||
talosctl gen config pi-cluster https://controlplane.cdb-online.co.uk:6443 \
|
||||
--with-secrets secrets.yaml \
|
||||
--config-patch @patches/t1-vip-patch.yaml \
|
||||
--output-dir ./
|
||||
```
|
||||
|
||||
> `secrets.yaml` contains your cluster CA, tokens, and keys. Keep this safe and never commit it to git.
|
||||
|
||||
---
|
||||
|
||||
## 2. Validate Config
|
||||
```bash
|
||||
talosctl validate --config controlplane.yaml --mode metal
|
||||
talosctl validate --config worker.yaml --mode metal
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 3. Apply Configuration
|
||||
|
||||
### Controlplane nodes (one at a time)
|
||||
```bash
|
||||
talosctl apply-config --nodes 10.0.1.12 --endpoints 10.0.1.12 --file controlplane.yaml
|
||||
talosctl apply-config --nodes 10.0.1.13 --endpoints 10.0.1.13 --file controlplane.yaml
|
||||
talosctl apply-config --nodes 10.0.1.14 --endpoints 10.0.1.14 --file controlplane.yaml
|
||||
```
|
||||
|
||||
### Worker nodes
|
||||
```bash
|
||||
talosctl apply-config --nodes 10.0.1.21 --endpoints 10.0.1.21 --file worker.yaml
|
||||
talosctl apply-config --nodes 10.0.1.22 --endpoints 10.0.1.22 --file worker.yaml
|
||||
talosctl apply-config --nodes 10.0.1.23 --endpoints 10.0.1.23 --file worker.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 4. Bootstrap etcd
|
||||
Only run this ONCE on the first controlplane node:
|
||||
```bash
|
||||
talosctl bootstrap --nodes 10.0.1.12 --endpoints 10.0.1.12
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 5. Watch Cluster Come Up
|
||||
```bash
|
||||
talosctl health --nodes 10.0.1.12 --endpoints 10.0.1.12
|
||||
```
|
||||
|
||||
Wait for VIP `10.0.1.11` to appear before proceeding:
|
||||
```bash
|
||||
ping 10.0.1.11
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 6. Export Kubeconfig
|
||||
|
||||
### One time export
|
||||
```bash
|
||||
talosctl --nodes controlplane.cdb-online.co.uk \
|
||||
--endpoints controlplane.cdb-online.co.uk \
|
||||
kubeconfig ~/.kube/config
|
||||
```
|
||||
|
||||
### Make it permanent - add to ~/.bashrc or ~/.zshrc
|
||||
```bash
|
||||
echo 'export KUBECONFIG=~/.kube/config' >> ~/.bashrc
|
||||
source ~/.bashrc
|
||||
```
|
||||
|
||||
### Verify kubectl is working
|
||||
```bash
|
||||
kubectl cluster-info
|
||||
kubectl get nodes
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. Install MetalLB
|
||||
```bash
|
||||
kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.15.3/config/manifests/metallb-native.yaml
|
||||
```
|
||||
|
||||
Wait for MetalLB to be ready:
|
||||
```bash
|
||||
kubectl wait --namespace metallb-system \
|
||||
--for=condition=ready pod \
|
||||
--selector=app=metallb \
|
||||
--timeout=90s
|
||||
```
|
||||
|
||||
Apply IP pool:
|
||||
```bash
|
||||
kubectl apply -f metallb/metallb.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 8. Deploy Applications
|
||||
```bash
|
||||
# Create namespaces and storage
|
||||
kubectl apply -f deployments/grav-www-paulcdb-com.yaml
|
||||
kubectl apply -f deployments/grav-www-cdb-online-co-uk.yaml
|
||||
kubectl apply -f deployments/grav-www-holyislandarc-club.yaml
|
||||
kubectl apply -f deployments/vaultwarden.yaml
|
||||
kubectl apply -f deployments/uptimekuma.yaml
|
||||
kubectl apply -f deployments/pairdrop.yaml
|
||||
kubectl apply -f deployments/it-tools.yaml
|
||||
kubectl apply -f deployments/forgejo.yaml
|
||||
kubectl apply -f deployments/changedetection.yaml
|
||||
```
|
||||
|
||||
Watch pods come up:
|
||||
```bash
|
||||
kubectl get pods -A -w
|
||||
```
|
||||
|
||||
Check services have IPs:
|
||||
```bash
|
||||
kubectl get svc -A | grep LoadBalancer
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 9. Install Monitoring (kube-prometheus-stack)
|
||||
```bash
|
||||
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
|
||||
helm repo update
|
||||
|
||||
helm install kube-prometheus-stack prometheus-community/kube-prometheus-stack \
|
||||
--namespace monitoring \
|
||||
--create-namespace \
|
||||
--values monitoring/kube-prometheus-values.yaml
|
||||
```
|
||||
|
||||
Watch monitoring come up:
|
||||
```bash
|
||||
kubectl get pods -n monitoring -w
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 10. Updating Talos
|
||||
|
||||
### Bump version in controlplane.yaml and worker.yaml
|
||||
```yaml
|
||||
machine:
|
||||
install:
|
||||
image: ghcr.io/siderolabs/installer:v1.14.0
|
||||
```
|
||||
|
||||
### Apply to controlplane nodes one at a time
|
||||
```bash
|
||||
talosctl apply-config --nodes 10.0.1.12 --endpoints 10.0.1.12 --file controlplane.yaml
|
||||
# Wait for node to come back before doing the next one
|
||||
talosctl apply-config --nodes 10.0.1.13 --endpoints 10.0.1.13 --file controlplane.yaml
|
||||
talosctl apply-config --nodes 10.0.1.14 --endpoints 10.0.1.14 --file controlplane.yaml
|
||||
```
|
||||
|
||||
### Apply to worker nodes
|
||||
```bash
|
||||
talosctl apply-config --nodes 10.0.1.21 --endpoints 10.0.1.21 --file worker.yaml
|
||||
talosctl apply-config --nodes 10.0.1.22 --endpoints 10.0.1.22 --file worker.yaml
|
||||
talosctl apply-config --nodes 10.0.1.23 --endpoints 10.0.1.23 --file worker.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 11. Updating Containers
|
||||
|
||||
### Restart a deployment to pull latest image
|
||||
```bash
|
||||
kubectl rollout restart deployment <name> -n <namespace>
|
||||
```
|
||||
|
||||
### Apply updated yaml with new version
|
||||
```bash
|
||||
kubectl apply -f deployments/<name>.yaml
|
||||
```
|
||||
|
||||
### Check rollout status
|
||||
```bash
|
||||
kubectl rollout status deployment <name> -n <namespace>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 12. Using Secrets in Deployments
|
||||
|
||||
### Create a secret
|
||||
```bash
|
||||
kubectl create secret generic <name> \
|
||||
--from-literal=KEY=value \
|
||||
--namespace <namespace>
|
||||
```
|
||||
|
||||
### Reference in deployment yaml
|
||||
```yaml
|
||||
env:
|
||||
- name: MY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: <secret-name>
|
||||
key: KEY
|
||||
```
|
||||
|
||||
### View existing secrets
|
||||
```bash
|
||||
kubectl get secrets -n <namespace>
|
||||
kubectl describe secret <name> -n <namespace>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 13. Useful Commands
|
||||
|
||||
### Talos
|
||||
```bash
|
||||
# Dashboard
|
||||
talosctl dashboard --nodes 10.0.1.12 --endpoints 10.0.1.12
|
||||
|
||||
# Logs
|
||||
talosctl logs etcd --nodes 10.0.1.12 --endpoints 10.0.1.12
|
||||
|
||||
# Service status
|
||||
talosctl service etcd --nodes 10.0.1.12 --endpoints 10.0.1.12
|
||||
|
||||
# Node health
|
||||
talosctl health --nodes 10.0.1.12 --endpoints 10.0.1.12
|
||||
```
|
||||
|
||||
### Kubernetes
|
||||
```bash
|
||||
# Get all pods
|
||||
kubectl get pods -A
|
||||
|
||||
# Get all services
|
||||
kubectl get svc -A
|
||||
|
||||
# Describe a pod
|
||||
kubectl describe pod <pod-name> -n <namespace>
|
||||
|
||||
# Pod logs
|
||||
kubectl logs -n <namespace> -l app=<name>
|
||||
kubectl logs -n <namespace> -l app=<name> --previous
|
||||
|
||||
# Restart deployment
|
||||
kubectl rollout restart deployment <name> -n <namespace>
|
||||
|
||||
# Watch pods
|
||||
kubectl get pods -A -w
|
||||
|
||||
# Get events
|
||||
kubectl get events -n <namespace> --sort-by='.lastTimestamp'
|
||||
```
|
||||
|
||||
### MetalLB
|
||||
```bash
|
||||
# Check IP pools
|
||||
kubectl get ipaddresspools -n metallb-system
|
||||
|
||||
# Check advertisements
|
||||
kubectl get l2advertisements -n metallb-system
|
||||
|
||||
# Annotate service with shared IP
|
||||
kubectl annotate svc <name> -n <namespace> metallb.io/address-pool=metallb-ips --overwrite
|
||||
kubectl annotate svc <name> -n <namespace> metallb.io/loadBalancerIPs=10.0.1.100 --overwrite
|
||||
kubectl annotate svc <name> -n <namespace> metallb.io/allow-shared-ip=shared-web --overwrite
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Caddy Reverse Proxy Example
|
||||
```
|
||||
www.paulcdb.com {
|
||||
reverse_proxy 10.0.1.100:8100
|
||||
}
|
||||
vault.paulcdb.com {
|
||||
reverse_proxy 10.0.1.100:8600
|
||||
}
|
||||
status.paulcdb.com {
|
||||
reverse_proxy 10.0.1.100:3001
|
||||
}
|
||||
git.paulcdb.com {
|
||||
reverse_proxy 10.0.1.100:3000
|
||||
}
|
||||
drop.paulcdb.com {
|
||||
reverse_proxy 10.0.1.100:3000
|
||||
}
|
||||
```
|
||||
---
|
||||
|
||||
## File Structure
|
||||
```
|
||||
pi-cluster/
|
||||
├── README.md
|
||||
├── secrets.yaml # NEVER COMMIT - add to .gitignore
|
||||
├── controlplane.yaml
|
||||
├── worker.yaml
|
||||
├── patches/
|
||||
│ └── t1-vip-patch.yaml
|
||||
├── metallb/
|
||||
│ └── metallb.yaml
|
||||
├── monitoring/
|
||||
│ └── kube-prometheus-values.yaml
|
||||
└── deployments/
|
||||
├── grav-www-paulcdb-com.yaml
|
||||
├── grav-www-cdb-online-co-uk.yaml
|
||||
├── grav-www-holyislandarc-club.yaml
|
||||
├── vaultwarden.yaml
|
||||
├── uptimekuma.yaml
|
||||
├── pairdrop.yaml
|
||||
├── it-tools.yaml
|
||||
├── forgejo.yaml
|
||||
├── changedetection.yaml
|
||||
└── spoolman.yaml
|
||||
```
|
||||
---
|
||||
|
||||
## Important Notes
|
||||
- Never commit `secrets.yaml` to git — add it to `.gitignore`
|
||||
- Always apply controlplane updates one node at a time to maintain etcd quorum
|
||||
- Only run `bootstrap` once on initial cluster setup
|
||||
- All services sharing `10.0.1.100` must have the `metallb.io/allow-shared-ip: shared-web` annotation
|
||||
- MetalLB pool name is `metallb-ips`
|
||||
- NFS server is at `10.0.1.5`
|
||||
|
||||
## Add secrets.yaml to .gitignore before pushing to Forgejo:
|
||||
echo "secrets.yaml" >> .gitignore
|
||||
Loading…
Add table
Reference in a new issue