Merge pull request k3s-io#433 from axivo/fix/cluster-improvements

fmunteanu · web-flow · commit df4088d10c74 · 2025-03-05T20:12:54.000-05:00
fix: cluster improvements
diff --git a/roles/argo-cd/templates/gateway.j2 b/roles/argo-cd/templates/gateway.j2
@@ -12,7 +12,8 @@ spec:
   listeners:
     - allowedRoutes:
         kinds:
-          - kind: HTTPRoute
+          - group: gateway.networking.k8s.io
+            kind: HTTPRoute
         namespaces:
           from: Same
       hostname: {{ argocd_map.gateway.server.hostname }}
@@ -21,7 +22,8 @@ spec:
       protocol: HTTP
     - allowedRoutes:
         kinds:
-          - kind: HTTPRoute
+          - group: gateway.networking.k8s.io
+            kind: HTTPRoute
         namespaces:
           from: Same
       hostname: {{ argocd_map.gateway.server.hostname }}
@@ -32,3 +34,4 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ externaldns_vars.cloudflare.prefix }}-{{ argocd_vars.kubernetes.server.gateway.service }}
+        mode: Terminate
diff --git a/roles/argo-cd/templates/http_route_insecure.j2 b/roles/argo-cd/templates/http_route_insecure.j2
@@ -17,7 +17,3 @@ spec:
             scheme: https
             statusCode: 301
           type: RequestRedirect
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
diff --git a/roles/cilium/templates/gateway.j2 b/roles/cilium/templates/gateway.j2
@@ -12,7 +12,8 @@ spec:
   listeners:
     - allowedRoutes:
         kinds:
-          - kind: HTTPRoute
+          - group: gateway.networking.k8s.io
+            kind: HTTPRoute
         namespaces:
           from: Same
       hostname: {{ cilium_map.gateway.hubble.ui.hostname }}
@@ -21,7 +22,8 @@ spec:
       protocol: HTTP
     - allowedRoutes:
         kinds:
-          - kind: HTTPRoute
+          - group: gateway.networking.k8s.io
+            kind: HTTPRoute
         namespaces:
           from: Same
       hostname: {{ cilium_map.gateway.hubble.ui.hostname }}
@@ -32,3 +34,4 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ externaldns_vars.cloudflare.prefix }}-{{ cilium_vars.kubernetes.hubble.ui.gateway.service }}
+        mode: Terminate
diff --git a/roles/cilium/templates/http_route_insecure.j2 b/roles/cilium/templates/http_route_insecure.j2
@@ -17,7 +17,3 @@ spec:
             scheme: https
             statusCode: 301
           type: RequestRedirect
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
diff --git a/roles/external-dns/templates/cluster_issuer.j2 b/roles/external-dns/templates/cluster_issuer.j2
@@ -14,3 +14,4 @@ spec:
             apiTokenSecretRef:
               key: {{ externaldns_map.cloudflare.api.token.key }}
               name: {{ externaldns_map.cloudflare.api.token.name }}
+          txtOwnerId: {{ k3s_map.cluster.label }}
diff --git a/roles/external-dns/templates/values.j2 b/roles/external-dns/templates/values.j2
@@ -1,3 +1,5 @@
+domainFilters:
+  - {{ externaldns_vars.cloudflare.host.domain }}
 env:
   - name: CF_API_TOKEN
     valueFrom:
@@ -40,3 +42,5 @@ sources:
   - gateway-udproute
   - ingress
   - service
+txtOwnerId: {{ k3s_map.cluster.label }}
+txtPrefix: _acme-challenge.
diff --git a/roles/helm/README.md b/roles/helm/README.md
@@ -27,10 +27,10 @@ See the related role variables listed below, defined into [main.yaml](./defaults
 | helm_vars.plugins[0].packages[0] | string | `"python3-jsonpatch"` |  |
 | helm_vars.plugins[0].repository.url | string | `"https://github.com/databus23/helm-diff"` |  |
 | helm_vars.plugins[0].version | string | `"v3.10.0"` |  |
-| helm_vars.release.distro.name | string | `"debian"` |  |
-| helm_vars.release.distro.url | string | `"https://helm.baltorepo.com"` |  |
-| helm_vars.release.key | string | `"helm-archive-keyring.gpg"` |  |
-| helm_vars.release.repository.channel | string | `"stable"` |  |
-| helm_vars.release.repository.key | string | `"signing.asc"` |  |
-| helm_vars.release.repository.url | string | `"https://baltocdn.com/helm"` |  |
-| helm_vars.release.version | string | `"v3.16.3-1"` |  |
+| helm_vars.release.helm.distro.name | string | `"debian"` |  |
+| helm_vars.release.helm.distro.url | string | `"https://helm.baltorepo.com"` |  |
+| helm_vars.release.helm.key | string | `"helm-archive-keyring.gpg"` |  |
+| helm_vars.release.helm.repository.channel | string | `"stable"` |  |
+| helm_vars.release.helm.repository.key | string | `"signing.asc"` |  |
+| helm_vars.release.helm.repository.url | string | `"https://baltocdn.com/helm"` |  |
+| helm_vars.release.helm.version | string | `"v3.16.3-1"` |  |
diff --git a/roles/helm/defaults/main.yaml b/roles/helm/defaults/main.yaml
@@ -11,12 +11,13 @@ helm_vars:
         url: https://github.com/databus23/helm-diff
       version: v3.10.0
   release:
-    distro:
-      name: debian
-      url: https://helm.baltorepo.com
-    key: helm-archive-keyring.gpg
-    repository:
-      channel: stable
-      key: signing.asc
-      url: https://baltocdn.com/helm
-    version: v3.16.3-1
+    helm:
+      distro:
+        name: debian
+        url: https://helm.baltorepo.com
+      key: helm-archive-keyring.gpg
+      repository:
+        channel: stable
+        key: signing.asc
+        url: https://baltocdn.com/helm
+      version: v3.16.3-1
diff --git a/roles/helm/tasks/facts.yaml b/roles/helm/tasks/facts.yaml
@@ -5,10 +5,10 @@
       directory:
         share: /usr/local/share/helm
       release:
-        channel: '{{ helm_vars.release.repository.url }}/{{ helm_vars.release.repository.channel }}'
-        key: '{{ helm_vars.release.repository.url }}/{{ helm_vars.release.repository.key }}'
-        url: '{{ helm_vars.release.distro.url }}/{{ helm_vars.release.repository.channel }}/{{ helm_vars.release.distro.name }}'
-        version: '{{ helm_vars.release.version[1:] }}'
+        channel: '{{ helm_vars.release.helm.repository.url }}/{{ helm_vars.release.helm.repository.channel }}'
+        key: '{{ helm_vars.release.helm.repository.url }}/{{ helm_vars.release.helm.repository.key }}'
+        url: '{{ helm_vars.release.helm.distro.url }}/{{ helm_vars.release.helm.repository.channel }}/{{ helm_vars.release.helm.distro.name }}'
+        version: '{{ helm_vars.release.helm.version[1:] }}'
   run_once: true
 
 - name: Set project fact
diff --git a/roles/helm/tasks/main.yaml b/roles/helm/tasks/main.yaml
@@ -37,7 +37,7 @@
 
     - name: Get file status
       ansible.builtin.stat:
-        path: /usr/share/keyrings/{{ helm_vars.release.key }}
+        path: /usr/share/keyrings/{{ helm_vars.release.helm.key }}
       changed_when: not gpg_key.stat.exists
       register: gpg_key
 
@@ -47,7 +47,7 @@
         - name: Download key
           ansible.builtin.get_url:
             url: '{{  helm_map.release.key }}'
-            dest: /tmp/{{ helm_vars.release.repository.key }}
+            dest: /tmp/{{ helm_vars.release.helm.repository.key }}
             owner: root
             group: root
             mode: '644'
@@ -58,13 +58,13 @@
 
         - name: Dearmor key
           ansible.builtin.command:
-            cmd: gpg --dearmor -o /usr/share/keyrings/{{ helm_vars.release.key }} /tmp/{{ helm_vars.release.repository.key }}
+            cmd: gpg --dearmor -o /usr/share/keyrings/{{ helm_vars.release.helm.key }} /tmp/{{ helm_vars.release.helm.repository.key }}
           changed_when: dearmor_key.rc == 0
           register: dearmor_key
 
         - name: Remove key
           ansible.builtin.file:
-            path: /tmp/{{ helm_vars.release.repository.key }}
+            path: /tmp/{{ helm_vars.release.helm.repository.key }}
             state: absent
 
         - name: Get architecture
@@ -77,10 +77,10 @@
           ansible.builtin.deb822_repository:
             architectures: '{{ architecture.stdout }}'
             components: main
-            name: helm-{{ helm_vars.release.repository.channel }}
-            signed_by: /usr/share/keyrings/{{ helm_vars.release.key }}
+            name: helm-{{ helm_vars.release.helm.repository.channel }}
+            signed_by: /usr/share/keyrings/{{ helm_vars.release.helm.key }}
             suites: all
-            uris: '{{  helm_map.release.channel }}/{{ helm_vars.release.distro.name }}/'
+            uris: '{{  helm_map.release.channel }}/{{ helm_vars.release.helm.distro.name }}/'
             enabled: true
             trusted: true
 
diff --git a/roles/helm/tasks/reset.yaml b/roles/helm/tasks/reset.yaml
@@ -50,10 +50,10 @@
             state: absent
           loop:
             - '{{ helm_map.directory.share }}'
-            - /etc/apt/sources.list.d/helm-{{ helm_vars.release.repository.channel }}.sources
+            - /etc/apt/sources.list.d/helm-{{ helm_vars.release.helm.repository.channel }}.sources
             - /etc/systemd/system/helm-cache.service
             - /etc/systemd/system/helm-cache.timer
-            - /usr/share/keyrings/{{ helm_vars.release.key }}
+            - /usr/share/keyrings/{{ helm_vars.release.helm.key }}
 
         - name: Reset systemd
           ansible.builtin.command:
diff --git a/roles/k3s/tasks/main.yaml b/roles/k3s/tasks/main.yaml
@@ -28,9 +28,9 @@
         group: root
         mode: '755'
 
-    - name: Set server configuration postinstall fact
+    - name: Set role postinstall fact
       ansible.builtin.set_fact:
-        k3s_config_postinstall: false
+        k3s_postinstall: false
 
     - name: Create configuration file
       ansible.builtin.template:
@@ -69,9 +69,9 @@
   notify: Restart service
   when: ansible_host in k3s_map.server.hosts
   block:
-    - name: Set server configuration postinstall fact
+    - name: Set role postinstall fact
       ansible.builtin.set_fact:
-        k3s_config_postinstall: true
+        k3s_postinstall: true
 
     - name: Update server configuration file
       ansible.builtin.template:
diff --git a/roles/k3s/tasks/postinstall.yaml b/roles/k3s/tasks/postinstall.yaml
diff --git a/roles/k3s/tasks/upgrade.yaml b/roles/k3s/tasks/upgrade.yaml
@@ -48,9 +48,9 @@
         path: '{{ k3s_project.cluster.config }}'
       register: k3s_file
 
-    - name: Set server configuration postinstall fact
+    - name: Set role postinstall fact
       ansible.builtin.set_fact:
-        k3s_config_postinstall: false
+        k3s_postinstall: false
 
     - name: Update configuration file
       ansible.builtin.template:
@@ -72,9 +72,9 @@
       ansible.builtin.import_tasks:
         file: configuration.yaml
 
-    - name: Set configuration postinstall fact
+    - name: Set role postinstall fact
       ansible.builtin.set_fact:
-        k3s_config_postinstall: true
+        k3s_postinstall: true
 
     - name: Update configuration file
       ansible.builtin.template:
diff --git a/roles/k3s/templates/config.j2 b/roles/k3s/templates/config.j2
@@ -2,7 +2,7 @@ data-dir: {{ k3s_map.node.directory.data }}
 {% if k3s_node.service | lower == 'server' %}
 bind-address: {{ k3s_node.ip }}
 cluster-domain: {{ k3s_vars.cluster.domain }}
-{% if k3s_map.server.ha is truthy and k3s_config_postinstall is falsy and ansible_host == k3s_map.server.default_host %}
+{% if k3s_map.server.ha is truthy and k3s_postinstall is falsy and ansible_host == k3s_map.server.default_host %}
 cluster-init: true
 {% endif %}
 disable:
@@ -36,7 +36,7 @@ node-taint:
   {{ k3s_resources.node.taint.server | to_nice_yaml | indent(2) }}
 {%- endif %}
 {% endif %}
-{% if k3s_map.server.ha is truthy and (k3s_config_postinstall is truthy or k3s_node.service | lower == 'agent') %}
+{% if k3s_map.server.ha is truthy and (k3s_postinstall is truthy or k3s_node.service | lower == 'agent') %}
 server: https://{{ k3s_vars.server.api.host }}:{{ k3s_vars.server.api.port }}
 {% elif
   (ansible_host != k3s_map.server.default_host and k3s_node.service | lower == 'server') or
diff --git a/roles/longhorn/README.md b/roles/longhorn/README.md
@@ -14,8 +14,8 @@ See the related role variables listed below, defined into [main.yaml](./defaults
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| longhorn_vars.kubernetes.default_settings.backup.enabled | bool | `true` |  |
-| longhorn_vars.kubernetes.default_settings.backup.target | string | `"cifs://192.168.1.8/backup"` | See [documentation](https://longhorn.io/docs/latest/references/settings/#backup-target), for details |
+| longhorn_vars.kubernetes.backup.enabled | bool | `true` |  |
+| longhorn_vars.kubernetes.backup.target | string | `"cifs://192.168.1.8/backup"` | See [documentation](https://longhorn.io/docs/latest/snapshots-and-backups/backup-and-restore/set-backup-target), for details |
 | longhorn_vars.kubernetes.default_settings.collect_usage_metrics | bool | `false` | See [documentation](https://longhorn.io/docs/latest/references/settings/#allow-collecting-longhorn-usage-metrics), for details |
 | longhorn_vars.kubernetes.default_settings.data_locality | string | `"strict-local"` | See [documentation](https://longhorn.io/docs/latest/references/settings/#allow-collecting-longhorn-usage-metrics), for details |
 | longhorn_vars.kubernetes.default_settings.log_level | string | `"Warn"` |  |
diff --git a/roles/longhorn/defaults/main.yaml b/roles/longhorn/defaults/main.yaml
@@ -1,11 +1,11 @@
 ---
 longhorn_vars:
   kubernetes:
+    backup:
+      enabled: true
+      # -- See [documentation](https://longhorn.io/docs/latest/snapshots-and-backups/backup-and-restore/set-backup-target), for details
+      target: cifs://192.168.1.8/backup
     default_settings:
-      backup:
-        enabled: true
-        # -- See [documentation](https://longhorn.io/docs/latest/references/settings/#backup-target), for details
-        target: cifs://192.168.1.8/backup
       # -- See [documentation](https://longhorn.io/docs/latest/references/settings/#allow-collecting-longhorn-usage-metrics), for details
       collect_usage_metrics: false
       # -- See [documentation](https://longhorn.io/docs/latest/references/settings/#allow-collecting-longhorn-usage-metrics), for details
diff --git a/roles/longhorn/tasks/main.yaml b/roles/longhorn/tasks/main.yaml
@@ -28,8 +28,8 @@
             kubeconfig: '{{ k3s_project.cluster.kubeconfig }}'
             wait: true
           when:
-            - longhorn_vars.kubernetes.default_settings.backup.enabled is truthy
-            - longhorn_vars.kubernetes.default_settings.backup.target[:4] | lower == 'cifs'
+            - longhorn_vars.kubernetes.backup.enabled is truthy
+            - longhorn_vars.kubernetes.backup.target[:4] | lower == 'cifs'
           no_log: true
 
         - name: Set chart postinstall fact
diff --git a/roles/longhorn/templates/gateway.j2 b/roles/longhorn/templates/gateway.j2
@@ -12,7 +12,8 @@ spec:
   listeners:
     - allowedRoutes:
         kinds:
-          - kind: HTTPRoute
+          - group: gateway.networking.k8s.io
+            kind: HTTPRoute
         namespaces:
           from: Same
       hostname: {{ longhorn_map.gateway.frontend.hostname }}
@@ -21,7 +22,8 @@ spec:
       protocol: HTTP
     - allowedRoutes:
         kinds:
-          - kind: HTTPRoute
+          - group: gateway.networking.k8s.io
+            kind: HTTPRoute
         namespaces:
           from: Same
       hostname: {{ longhorn_map.gateway.frontend.hostname }}
@@ -32,3 +34,4 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ externaldns_vars.cloudflare.prefix }}-{{ longhorn_vars.kubernetes.frontend.gateway.service }}
+        mode: Terminate
diff --git a/roles/longhorn/templates/http_route_insecure.j2 b/roles/longhorn/templates/http_route_insecure.j2
@@ -17,7 +17,3 @@ spec:
             scheme: https
             statusCode: 301
           type: RequestRedirect
-      matches:
-        - path:
-            type: PathPrefix
-            value: /
diff --git a/roles/longhorn/templates/values.j2 b/roles/longhorn/templates/values.j2
@@ -1,14 +1,15 @@
+{% if longhorn_vars.kubernetes.backup.enabled is truthy %}
+defaultBackupStore:
+  backupTarget: {{ longhorn_vars.kubernetes.backup.target }}
+{% if longhorn_vars.kubernetes.backup.target[:4] | lower == 'cifs' %}
+  backupTargetCredentialSecret: {{ longhorn_map.credentials.backup.secret }}
+{% endif %}
+{% endif %}
 defaultSettings:
   allowCollectingLonghornUsageMetrics: {{ longhorn_vars.kubernetes.default_settings.collect_usage_metrics | lower }}
   autoCleanupRecurringJobBackupSnapshot: true
   autoCleanupSnapshotWhenDeleteBackup: true
   autoCleanupSystemGeneratedSnapshot: true
-{% if longhorn_vars.kubernetes.default_settings.backup.enabled is truthy %}
-  backupTarget: {{ longhorn_vars.kubernetes.default_settings.backup.target }}
-{% if longhorn_vars.kubernetes.default_settings.backup.target[:4] | lower == 'cifs' %}
-  backupTargetCredentialSecret: {{ longhorn_map.credentials.backup.secret }}
-{% endif %}
-{% endif %}
   defaultDataLocality: {{ longhorn_vars.kubernetes.default_settings.data_locality }}
   defaultDataPath: {{ longhorn_map.directory.data }}
 {% if longhorn_vars.kubernetes.default_settings.volume.replicas < 2 %}
