feat: init

Signed-off-by: Mateusz Urbanek <[email protected]>

.editorconfig

@@ -0,0 +1,17 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+
+[*.md]
+indent_size = 4
+
+[*.{yaml,yml,tf,hcl}]
+indent_size = 2

.github/workflows/tofu.yaml

@@ -0,0 +1,25 @@
+name: tofu
+
+on:
+  push:
+    branches:
+    - "main"
+
+jobs:
+  lke:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: opentofu/setup-opentofu@v1
+    - env:
+        PG_CONN_STR: "${{ secrets.PG_CONN_STR }}"
+      run: |
+        tofu -chdir=./terraform/lke init -upgrade
+    - env:
+        PG_CONN_STR: "${{ secrets.PG_CONN_STR }}"
+        LINODE_TOKEN: "${{ secrets.LINODE_TOKEN }}"
+      run: |
+        tofu -chdir=./terraform/lke \
+          apply -auto-approve -input=false -lock=true -no-color \
+            -var=k8s_cluster_name=lke \
+            -var=kubeconfig=lke.yaml

.gitignore

@@ -0,0 +1,47 @@
+# Secrets
+*.Secret.yaml
+*.Secret.yml
+
+# Env files
+*.env
+
+# MacOS attributes files
+.DS_Store
+
+# Brewfile lock
+Brewfile.lock.json
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc

Brewfile

@@ -0,0 +1,3 @@
+tap "fluxcd/tap"
+brew "fluxcd/tap/flux"
+brew "opentofu"

LICENSE

@@ -0,0 +1,24 @@
+This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <https://unlicense.org>

README.md

@@ -0,0 +1,64 @@
+# Infra
+
+<p align="center">
+  <a href="http://fluxcd.io" target="_blank"><img src="./resources/flux.png" height="32px"></a>
+  <a href="https://www.mend.io/renovate/" target="_blank"><img src="./resources/renovate.png" height="32px"></a>
+  <a href="http://kured.dev" target="_blank"><img src="./resources/kured.png" height="32px"></a>
+  <a href="https://cluster-api.sigs.k8s.io" target="_blank"><img src="./resources/capi.svg" height="32px"></a>
+  <a href="http://k3s.io" target="_blank"><img src="./resources/k3s.png" height="32px"></a>
+  <a href="https://linode.com" target="_blank"><img src="./resources/linode.png" height="32px"></a>
+  </br><img src="./resources/kubernetes.png" alt="Kubernetes" width="256px"/></br>
+  <a href="http://cilium.io" target="_blank"><img src="./resources/cilium.png" height="32px"></a>
+  <a href="https://www.tigera.io/project-calico/" target="_blank"><img src="./resources/calico.png" height="32px"></a>
+  <a href="https://tailscale.com" target="_blank"><img src="./resources/tailscale.png" height="32px"></a>
+  <a href="http://tetragon.io" target="_blank"><img src="./resources/tetragon.png" height="32px"></a>
+  <a href="https://grafana.com/oss/grafana/" target="_blank"><img src="./resources/grafana.png" height="32px"></a>
+  <a href="https://prometheus.io" target="_blank"><img src="./resources/prometheus.png" height="32px"></a>
+</p>
+
+## Infrastructure as Code with GitOps using Flux and Renovate
+
+### Overview
+
+This repository contains the infrastructure code for managing a Kubernetes cluster using GitOps principles. The deployment and configuration are orchestrated with Flux and automated updates are handled by Renovate.
+
+### Getting Started
+
+1. Clone this repository:
+
+    ```bash
+    git clone <repository_url>
+    ```
+
+3. Create new cluster
+    * Create new cluster LKE using OpenTofu:
+
+        ```bash
+        export LINODE_TOKEN='your linode token'
+        tofu -chdir=./terraform/lke init -upgrade
+        tofu -chdir=./terraform/lke plan
+        tofu -chdir=./terraform/lke apply -var='k8s_cluster_name=<your cluster name>'
+        ```
+
+4. Set up Flux on your cluster using the provided script:
+
+    ```bash
+    export GITHUB_TOKEN='<your github token>'
+    ./scripts/flux.sh '<your cluster name>'
+    ```
+
+5. Customize your cluster configuration in the `clusters` directory.
+
+6. Apply changes to your cluster by committing and pushing to this repository.
+
+### Automated Updates
+
+Renovate is configured to automatically check for updates to dependencies. Refer to `renovate.json` for configuration details.
+
+### License
+
+This repository is licensed under the [The Unlicense](LICENSE). Feel free to modify and adapt it for your needs.
+
+### Contribution
+
+Feel free to contribute by opening issues or submitting pull requests. Your feedback and contributions are highly appreciated!

renovate.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base"
+  ],
+  "automerge": true,
+  "flux": {
+    "fileMatch": [
+      "clusters/.+\\.yaml$"
+    ]
+  }
+}

scripts/flux.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -e
+set -o pipefail
+
+X_NAME="${1:-kubernetes}"
+
+flux bootstrap github \
+    --token-auth \
+    --owner=anza-labs \
+    --repository=infra \
+    --branch=main \
+    --path="clusters/${X_NAME}" \
+    --personal

terraform/lke/linode.tf

@@ -0,0 +1,32 @@
+provider "linode" {}
+
+resource "linode_lke_cluster" "lke" {
+  k8s_version = var.k8s_version
+  label       = var.k8s_cluster_name
+  region      = var.k8s_cluster_region
+
+  tags = [
+    "prod",
+  ]
+
+  pool {
+    type  = "g6-standard-2"
+    count = 3
+  }
+}
+
+resource "null_resource" "kubeconfig" {
+  depends_on = [
+    linode_lke_cluster.lke,
+  ]
+
+  triggers = {
+    kubeconfig = md5(linode_lke_cluster.lke.kubeconfig)
+    output     = md5(var.kubeconfig)
+    script     = filemd5("./scripts/kubeconfig.sh")
+  }
+
+  provisioner "local-exec" {
+    command = "./scripts/kubeconfig.sh '${pathexpand(var.kubeconfig)}' '${linode_lke_cluster.lke.id}' '${linode_lke_cluster.lke.kubeconfig}'"
+  }
+}

terraform/lke/scripts/kubeconfig.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env -S bash
+
+set -eu
+set -o pipefail
+
+mkdir -p "$(dirname "$1")"
+
+# shellcheck disable=SC2094
+echo "$3" | base64 -d | sed "s/$2/-$(basename "$1")/g" > "$1"

terraform/lke/variables.tf

@@ -0,0 +1,19 @@
+variable "k8s_version" {
+  type    = string
+  default = "1.29"
+}
+
+variable "k8s_cluster_name" {
+  type    = string
+  default = "kubernetes"
+}
+
+variable "k8s_cluster_region" {
+  type    = string
+  default = "eu-central"
+}
+
+variable "kubeconfig" {
+  type    = string
+  default = "~/.kube/config"
+}

terraform/lke/versions.tf

@@ -0,0 +1,15 @@
+terraform {
+  backend "pg" {}
+
+  required_providers {
+    linode = {
+      source  = "linode/linode"
+      version = "2.23.1"
+    }
+
+    null = {
+      source  = "hashicorp/null"
+      version = "3.2.2"
+    }
+  }
+}