From e46545f215613f85208fdfa964d98057df634f98 Mon Sep 17 00:00:00 2001 From: "azykov@mail.ru" Date: Tue, 21 Jul 2026 21:49:41 +0300 Subject: [PATCH] metallb --- .../base/apps/vaultwarden/secret.enc.yaml | 18 +++--- .../base/apps/zigbee2mqtt/secret.enc.yaml | 16 ++--- clusters/base/infra/metallb/config.yaml | 58 +++++++++++++++++++ clusters/base/infra/metallb/helmrelease.yaml | 15 +++++ .../base/infra/metallb/helmrepository.yaml | 8 +++ .../base/infra/metallb/kustomization.yaml | 6 ++ clusters/base/namespaces/metallb-system.yaml | 4 ++ clusters/home/infra/kustomization.yaml | 1 + clusters/home/infra/metallb.yaml | 14 +++++ clusters/home/namespaces/kustomization.yaml | 1 + 10 files changed, 124 insertions(+), 17 deletions(-) create mode 100644 clusters/base/infra/metallb/config.yaml create mode 100644 clusters/base/infra/metallb/helmrelease.yaml create mode 100644 clusters/base/infra/metallb/helmrepository.yaml create mode 100644 clusters/base/infra/metallb/kustomization.yaml create mode 100644 clusters/base/namespaces/metallb-system.yaml create mode 100644 clusters/home/infra/metallb.yaml diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml index 0422fcb..cc7c241 100644 --- a/clusters/base/apps/vaultwarden/secret.enc.yaml +++ b/clusters/base/apps/vaultwarden/secret.enc.yaml @@ -4,20 +4,20 @@ metadata: name: vaultwarden-secrets namespace: vaultwarden stringData: - #ENC[AES256_GCM,data:qUnV0fG+PWy9/FI5t+mLEtjueacG73pVHo6Idf7JDz7gFX1LOc3xfH62HCPei9DTxrbc7ElDWolQ,iv:S5xGUgETCwa8Q4D6soN6GsrE8feg/Ygi/aEu2pzo31M=,tag:wHX6Y6OjT7g3hdwVJlp8Hw==,type:comment] - ADMIN_TOKEN: ENC[AES256_GCM,data:mfWrbd1WVvWoPAiLhIxRSuQQap6vOnoDuX3bGizqAOEQ42BvkWeJTuXXNBBp54eZUNKUKF7oTW2saIO//mB8gznBDMt31tQb4xA3b/zg8Q2c4PcyEs7PVO0J168U4k7ItgKXtelrqvfn8eCpmcORuzjcSmj8NA==,iv:6O0I5OPgOZfhNs9q7u/Sk2+piE1kpU+3fm8xtVFfuQ4=,tag:6QSwMvBht9Jt2PYLGkEKKA==,type:str] + #ENC[AES256_GCM,data:YF3a2K8EwdcJh7cKD5/fqsdFPI6Vt7llxdIJXcYwaa9VH3O862a63JRGVtMmTtwumU8l6BYypjSF,iv:kiEzXbGc+XcWLAdBURoLabm8EaxDBrUD+kHW7yxiTYw=,tag:xEy9SzIjeBdb6MFHUJ98Sw==,type:comment] + ADMIN_TOKEN: ENC[AES256_GCM,data:iXPhYrwcOf1dSVw6eHCt4v56bjLYO2I6la7+2KsCLCMOx7Mpu7tOWd2FW64j5ie0ed3mPzIjpiK0VU2X+/4LWW8F65ACAv6VAoUncFJmmJHlUuWSy1e+YEQIEkV/UA2OzSmsL7AGBZVDJ/xA1HEygUq8j+7J/A==,iv:xV5KqSo023cXdC3eUXW57HjMTji0kb29Hma6UpFGn6Q=,tag:px9oHkCShAePuNfjpp5vzg==,type:str] sops: age: - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtQXFZcmpXbUNTYjI1ejFV - b1ZkbXlMallmMVl3cm5QU1h2NStBR3V3dWdRCnFhRHZRRlMrdWdpc2RIa0dqMTFz - SjdZeWFRTmxnaDRudFpISytTMi9VQW8KLS0tIFFEVjJyZTZKcVFRL3o5NHdET1di - YUJDNGIydjZOd3V4bFVxNGhZdXBGb00KOfs2+IxzbOS+Oca+jSvg1u7cbg6hV26t - 1oWYz6exTsQS6f5U99UWKCQn/OAf5UaqxvHl7mdwi+LL4Mij7dNzow== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZlgxMTZrZ09DT2RmSlBy + NHJzZzEvSDdjK25qdHVucGxobkZVVHdzb1Q0Cm5vWFhuMEdmVzh6ZTdnRmhzV2V3 + NkJTVHhVV2ZlZXoycnBxVWF0VVQzcmsKLS0tICtsWGNwaU53RklmOGlEbVYxckFC + cmgzUjJpZW1xSDhaUm5NdjkyR3RtNkUKr27npr66Fv/7s9GppK2gFkVVKT5/XDEb + DpE1Le+eTA5b4/tKOVrqqjXaq7i3TRphJ717gwoI7FBKzMW2CFdwtg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:19:08Z" - mac: ENC[AES256_GCM,data:+2Z+frO2M97uPCMWZ46/N7tb3sVZH+8avo1uW2JpUQKxuSIr5+zOQVZRBAw4VQ84RJzLHgGuYMJXv9mFg126b5J8t2i8Y7Oe3Qd5P61gKMrDRCuJ9g2VBgkV23A4Mmei7B0DzvTl9bykK0rSO3eQphIfWx5xTluw+QmaSfvlRxg=,iv:KDNkM/42tEck2Oab8gNm7OUfOzeg9BL+vJfRwFPgf/Q=,tag:Ps5ZToXcxbnwZ24yIp7GDA==,type:str] + lastmodified: "2026-08-26T10:19:13Z" + mac: ENC[AES256_GCM,data:r9Ke79qGnQVmxXVQEFIjs2z3Q+ZU+qqtCKilmCDUKmJ3uhsfq7vUwojr/yZaGZw6aYPgLXIGLjCM0XgQU7KUOh/AlRqdRK5WXrL8J4WKm5HdnerQs8GgOln0one69tEVJDaEe5yIGfEDFs7zw0qzt/j+tw3hX6+UgrPhPfJ6OAI=,iv:daAXrYdPePuyEXaLohZPqp6ssaT6P6vaUJAxf/yqbSQ=,tag:/XypbhMaO9qBVOLhIE/xlA==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml index bd4f04e..8819c2a 100644 --- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml +++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml @@ -4,19 +4,19 @@ metadata: name: zigbee2mqtt-secrets namespace: zigbee2mqtt stringData: - secret.yaml: ENC[AES256_GCM,data:3JkH3sL0f/19BS73OnfWUa0TSUNNv/uf1G4xZD/EsOwYfHgCRs5JZ9r8Au7+keiTR/UTrflRFc+0ATQfoC/BUWM9Ovr5SHWg9AEmLdOMcJLff6GySvoSNjOSoyoru71D7lWOBTtJ2jiglTQP4TcOzRD7Q9E3RivWgy1FJxc=,iv:vrr2dqCGytzkHaszi+HSuEZK/jKIgg38eYIInJYxXXk=,tag:F8KsoJ+1l1qPI1ikbzKD7Q==,type:str] + secret.yaml: ENC[AES256_GCM,data:eVradlSvDUUtfYxqYrGEGgZZiA2XqqCSEuw5K7CkDMmegg+vyg4JZeikIxpli6q64Y65cYzDgFrNOAdMcS8H1EGgtqUDWgzAOCplHM1iuAAGxmIlHXRFicm4K1ID+nGPtNy0oBR54qDVF/FOV6FixSVB2qgE58SXyR99AWM=,iv:eurGAnb4pc4zuGF4uSq0nomD38yy6yT63F5cH9NX5kA=,tag:BnC2t/m7FtNUN1VW8BOk0A==,type:str] sops: age: - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTHdFRlJzZDZON0o5eVNL - NHlPcE90bW1BZCs5OWFCZURmb2hiZmMyckhzCkJHdlhmbXVGVHVNZmNqOTRNaEhX - QTE2TmV1RW9icFVZV2FsOWtydzUzdG8KLS0tIGFTRXZ3ZWlPUkZRRWYzQWw0aUhK - VFg0aWxHcXlaTTBJYXMxMmNJVE5Nc0kKdhabjy0J4HYJAarwrq4QOm7sEmvqsVrf - qI9CWWOjMh3CtYvVQumzxYc56z2g0hbK5G+G5uEW8aPnQHdzkyZwww== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZWJEQkNDdjNTWEEvY1JO + ZHVPSWtDY2swZ0pDOUZ5cTZLbkJqaFI1dVRvCllWNUdOTU1DMm1sTGxpMlowRk9R + aWp0ajd1ZUNXeTJCQVBjbjBnSXpaSHcKLS0tIG96Z3Y2dHVFY2dHTTVKbnQ0VFFo + NDNDNXN0b2VIeDA3eUI3WWxrZ1FxUFkKaf51BQseBhByHqWUCMFJ5JQV+jk2V0/4 + ZrvJBSZO6DsVD1KNd5SdDaCcub4wRMj3UJnNxgvXhwrVkPF57ejoXg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:19:09Z" - mac: ENC[AES256_GCM,data:DV8SQUXaGX2Vf5qcc4maIyykI6tiiWgSWwpeFDh9UhxqJYSJPDdVvv5d623I8Fr25TbvKySxWa7BUOO7OLAnX3f9+lhfQsialjgYZeXtG/lHlPSPgCkjB8bEEt024ekG7KDYTrl+j1UN54UrreLmZFVHsbOOz+NNTQtflhWQoZs=,iv:dHorSqfNWaZ9muUV8RSWEntKVWrL+yma+DiKFWKvpTQ=,tag:OvXiXpZSKuUpu28DYDHrPA==,type:str] + lastmodified: "2026-08-26T10:19:13Z" + mac: ENC[AES256_GCM,data:Omc1MMSPRbIrrtoi7n4yh0MEZTQzqtAz+cDIa6Haku00NwwItRVgLz4AouyXActKkO4wrcI0Fop9yVjZPLX8kfbfAHyOeYmSGVN2gdWKUgTvaD9xW5NVh6bz6oLylt1Q0LIz2sFw3lMSqKyre/RZnaRuaWZG4D8r/1jl7n/wNnI=,iv:ifQHPE+OANQymzkdxYUlonbvOdBWoDJecqfSQ4f33/A=,tag:s0/9XPev4TsGSnbdV/J5pw==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/infra/metallb/config.yaml b/clusters/base/infra/metallb/config.yaml new file mode 100644 index 0000000..9a6a23f --- /dev/null +++ b/clusters/base/infra/metallb/config.yaml @@ -0,0 +1,58 @@ +# a general pool for everything but mqtt and public IP facing ingress controller +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: default-pool + namespace: metallb-system +spec: + addresses: + - 10.0.64.5-10.0.64.6 + # exclude 10.0.64.7, its in dmz-pool + # exclude 10.0.64.8, its in mqtt-pool + - 10.0.64.9-10.0.64.19 + autoAssign: true + serviceAllocation: + serviceSelectors: + - matchLabels: + loadBalancerPool: default +--- +# DMZ (not really, just for clarity) ip, will have ports forwarded from WAN router +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: dmz-pool + namespace: metallb-system +spec: + addresses: + - 10.0.64.7/32 + autoAssign: true + serviceAllocation: + serviceSelectors: + - matchLabels: + loadBalancerPool: dmz +--- +# reserve 10.0.64.8 (for historical reasons) for mqtt +# ! do not forget to label the mqtt service with "loadBalancerPool: mqtt" ! +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: mqtt-pool + namespace: metallb-system +spec: + addresses: + - 10.0.64.8/32 + serviceAllocation: + serviceSelectors: + - matchLabels: + loadBalancerPool: mqtt +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: default + namespace: metallb-system +spec: + ipAddressPools: + - default-pool + - dmz-pool + - mqtt-pool diff --git a/clusters/base/infra/metallb/helmrelease.yaml b/clusters/base/infra/metallb/helmrelease.yaml new file mode 100644 index 0000000..1d736d3 --- /dev/null +++ b/clusters/base/infra/metallb/helmrelease.yaml @@ -0,0 +1,15 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: metallb + namespace: metallb-system +spec: + interval: 10m + chart: + spec: + chart: metallb + version: "0.16.1" + sourceRef: + kind: HelmRepository + name: metallb + namespace: metallb-system diff --git a/clusters/base/infra/metallb/helmrepository.yaml b/clusters/base/infra/metallb/helmrepository.yaml new file mode 100644 index 0000000..96b6af3 --- /dev/null +++ b/clusters/base/infra/metallb/helmrepository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: metallb + namespace: metallb-system +spec: + interval: 1h + url: https://metallb.github.io/metallb diff --git a/clusters/base/infra/metallb/kustomization.yaml b/clusters/base/infra/metallb/kustomization.yaml new file mode 100644 index 0000000..ce00d11 --- /dev/null +++ b/clusters/base/infra/metallb/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - helmrelease.yaml + - config.yaml diff --git a/clusters/base/namespaces/metallb-system.yaml b/clusters/base/namespaces/metallb-system.yaml new file mode 100644 index 0000000..fe6f1d8 --- /dev/null +++ b/clusters/base/namespaces/metallb-system.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: metallb-system diff --git a/clusters/home/infra/kustomization.yaml b/clusters/home/infra/kustomization.yaml index 0424f58..315e371 100644 --- a/clusters/home/infra/kustomization.yaml +++ b/clusters/home/infra/kustomization.yaml @@ -4,3 +4,4 @@ resources: - longhorn/longhorn-system.yaml - longhorn/storage-classes.yaml - cert-manager/certificate-issuers.yaml + - metallb.yaml diff --git a/clusters/home/infra/metallb.yaml b/clusters/home/infra/metallb.yaml new file mode 100644 index 0000000..b3191dc --- /dev/null +++ b/clusters/home/infra/metallb.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: metallb + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/base/infra/metallb + prune: true + wait: true + retryInterval: 5s diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml index e45868c..3273773 100644 --- a/clusters/home/namespaces/kustomization.yaml +++ b/clusters/home/namespaces/kustomization.yaml @@ -6,3 +6,4 @@ resources: - ../../base/namespaces/pim.yaml - ../../base/namespaces/longhorn-system.yaml - ../../base/namespaces/auth.yaml + - ../../base/namespaces/metallb-system.yaml