149 lines
4.9 KiB
Markdown
149 lines
4.9 KiB
Markdown
# dumpnet-argo
|
|
|
|
GitOps cluster management for dumpnet — a single-node Talos/Kubernetes cluster on AWS, managed via ArgoCD.
|
|
|
|
## Architecture
|
|
|
|
- **Talos Linux** on EC2 (t3.medium) — immutable, API-driven OS
|
|
- **ArgoCD** — GitOps continuous delivery
|
|
- **ingress-nginx** — ingress controller (hostNetwork mode)
|
|
- **App of Apps** pattern — all workloads defined in `manifests/`
|
|
- **Terraform** — cluster infrastructure and bootstrap
|
|
- **SOPS + age** — secret encryption for sensitive cluster files
|
|
|
|
## Prerequisites
|
|
|
|
- `terraform`
|
|
- `kubectl`
|
|
- `talosctl`
|
|
- `sops` + `age`
|
|
- AWS CLI configured (`aws configure`)
|
|
|
|
## Secrets Setup (first time only)
|
|
|
|
Sensitive files (`talosconfig`, `controlplane.yaml`, `worker.yaml`) are **gitignored** and never stored in the repo in any form. They are managed as follows:
|
|
|
|
- **Cluster credentials** (kubeconfig, talosconfig, ArgoCD password) → stored in AWS Secrets Manager at `dumpnet/cluster`
|
|
- **Talos machine configs** → encrypted with SOPS + age, stored outside the repo
|
|
- **Age private key** → lives at `~/.age/key.txt` — **back this up securely**
|
|
|
|
To decrypt Talos configs to `/tmp` for one-off `talosctl` use:
|
|
```bash
|
|
make decrypt
|
|
# files appear at /tmp/controlplane.yaml, /tmp/worker.yaml, /tmp/talosconfig
|
|
# they are not persisted after reboot
|
|
```
|
|
|
|
## First-Time Setup
|
|
|
|
### 1. Clone and init
|
|
|
|
```bash
|
|
git clone https://forge.keane.sh/ian/dumpnet-argo.git
|
|
cd dumpnet-argo
|
|
make init
|
|
```
|
|
|
|
### 2. Configure variables
|
|
|
|
```bash
|
|
cp terraform/terraform.tfvars.example terraform/terraform.tfvars
|
|
# edit terraform/terraform.tfvars with your hosted_zone_id
|
|
```
|
|
|
|
### 3. Spin up the cluster
|
|
|
|
```bash
|
|
make apply
|
|
```
|
|
|
|
This will:
|
|
- Allocate an EIP
|
|
- Create a dedicated subnet and security group
|
|
- Launch a Talos EC2 instance (t3.medium) with machine config as user-data
|
|
- Associate the EIP (no auto-assigned public IP)
|
|
- Apply the machine configuration via Talos API
|
|
- Bootstrap etcd
|
|
- Retrieve the kubeconfig
|
|
- Create the `ingress-nginx` namespace with privileged pod security
|
|
- Install ArgoCD via Helm with a generated admin password
|
|
- Create Route53 DNS records pointing to the EIP
|
|
- Store all credentials in AWS Secrets Manager (`dumpnet/cluster`)
|
|
|
|
### 4. Post-apply bootstrap (one-time)
|
|
|
|
```bash
|
|
make post-apply
|
|
```
|
|
|
|
This script:
|
|
- Fetches kubeconfig and talosconfig from Secrets Manager
|
|
- Waits for the node to be ready
|
|
- Imports the ingress-nginx namespace into Terraform state
|
|
- Applies the ArgoCD App of Apps
|
|
|
|
### 5. Get ArgoCD password
|
|
|
|
```bash
|
|
make argocd-password
|
|
```
|
|
|
|
Then log in at https://argocd.dumpnet.chat — ArgoCD will finish deploying ingress-nginx and metrics-server automatically.
|
|
|
|
## Day-to-Day
|
|
|
|
- **Add a new app**: add a manifest to `manifests/` and values to `charts/` — ArgoCD picks it up on next sync
|
|
- **Add a DNS record**: add the subdomain to `dns_records` in `terraform/terraform.tfvars` and run `make apply`
|
|
- **Cluster access**: `make kubeconfig` or `make talosconfig` (pulls from Secrets Manager)
|
|
- **Emergency talosctl access**: `make decrypt` to get configs in `/tmp`
|
|
|
|
## Makefile Reference
|
|
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `make apply` | Create/update cluster infrastructure |
|
|
| `make plan` | Preview infrastructure changes |
|
|
| `make destroy` | Tear down everything |
|
|
| `make post-apply` | One-time bootstrap after fresh cluster creation |
|
|
| `make bootstrap` | Apply App of Apps only |
|
|
| `make kubeconfig` | Pull kubeconfig from Secrets Manager |
|
|
| `make talosconfig` | Pull talosconfig from Secrets Manager |
|
|
| `make argocd-password` | Print ArgoCD admin password |
|
|
| `make decrypt` | Decrypt Talos configs to /tmp |
|
|
|
|
## Repo Structure
|
|
|
|
```
|
|
dumpnet-argo/
|
|
├── Makefile # top-level commands
|
|
├── scripts/
|
|
│ └── post-apply.sh # one-time bootstrap after fresh cluster
|
|
├── apps/
|
|
│ └── apps.yaml # ArgoCD App of Apps root
|
|
├── manifests/ # ArgoCD Application manifests
|
|
│ ├── argocd.yaml
|
|
│ ├── ingress-nginx.yaml
|
|
│ └── metrics-server.yaml
|
|
├── charts/ # Helm values per app
|
|
│ ├── argocd/
|
|
│ │ └── values.yaml
|
|
│ └── ingress-nginx/
|
|
│ └── values.yaml
|
|
└── terraform/ # cluster infrastructure
|
|
├── main.tf
|
|
├── versions.tf
|
|
├── variables.tf
|
|
├── security_group.tf
|
|
├── network.tf
|
|
├── namespaces.tf
|
|
├── argocd.tf
|
|
├── dns.tf
|
|
└── outputs.tf
|
|
```
|
|
|
|
## Notes
|
|
|
|
- The control plane taint is disabled via `allowSchedulingOnControlPlanes: true` in the Talos machine config — no manual taint removal needed
|
|
- The `ingress-nginx` namespace is created by Terraform with `pod-security.kubernetes.io/enforce=privileged` to allow hostNetwork mode
|
|
- ArgoCD manages itself after initial Helm install — future upgrades go through the repo
|
|
- Sensitive files are gitignored entirely — there is no encrypt/commit workflow, only decrypt-to-tmp when needed
|