feat: add metallb

2026-08-24 13:23:19 +02:00 · 2026-08-24 13:23:19 +02:00 · 1eab068977
commit 1eab068977
parent bd0c392b57
30 changed files with 107 additions and 24 deletions
--- a/.gitignore
+++ b/.gitignore
@ -23,3 +23,4 @@ k8s/charts/README.md
 opencode.json
 *.pyc
 .venv/
+METALLB.md
--- a/README.md
+++ b/README.md
@ -19,3 +19,8 @@ helm upgrade argo-cd argo/argo-cd -n argo-cd -f k8s/helm/argo-cd/values.yaml
 ```bash
 scripts/users.py add -u catalin -n cătălin -e catalin@roboces.dev
 ```
+
+## MetalLB and reserved VIPs
+
+- traefik VIP: 192.168.1.127
+- adguard dns VIP: 192.168.1.125
--- a/k8s/argo-apps/adguard.yaml
+++ b/k8s/argo-apps/adguard.yaml
@ -41,6 +41,10 @@ spec:
          service:
            dns:
              type: LoadBalancer
+              port: 53
+              annotations:
+                metallb.universe.tf/address-pool: adguard-dns-pool
+              loadBalancerIP: 192.168.1.125
            web:
-              type: LoadBalancer
+              type: ClusterIP
              port: 8006
--- a/k8s/argo-apps/audiobookshelf.yaml
+++ b/k8s/argo-apps/audiobookshelf.yaml
@ -16,7 +16,7 @@ spec:
      helm:
        valuesObject:
          service:
-            type: LoadBalancer
+            type: ClusterIP
            port: 8081
          ingress:
            enabled: true
--- a/k8s/argo-apps/authelia.yaml
+++ b/k8s/argo-apps/authelia.yaml
@ -28,7 +28,7 @@ spec:
                cpu: 1
                memory: 1024Mi
          service:
-            type: LoadBalancer
+            type: ClusterIP
            port: 9091
          ingress:
            enabled: true
--- a/k8s/argo-apps/authentik.yaml
+++ b/k8s/argo-apps/authentik.yaml
@ -63,7 +63,7 @@ spec:
              enabled: true
              minAvailable: 1
            service:
-              type: LoadBalancer
+              type: ClusterIP
              servicePortHttp: 9001
              servicePortHttps: 9444
              annotations:
@ -72,7 +72,7 @@ spec:
            metrics:
              enabled: true
              service:
-                type: LoadBalancer
+                type: ClusterIP
              serviceMonitor:
                enabled: false
            ingress:
--- a/k8s/argo-apps/dokuwiki.yaml
+++ b/k8s/argo-apps/dokuwiki.yaml
@ -26,7 +26,7 @@ spec:
                drop:
                  - all
            service:
-              type: LoadBalancer
+              type: ClusterIP
              port: 8004
            ingress:
              enabled: true
--- a/k8s/argo-apps/forgejo.yaml
+++ b/k8s/argo-apps/forgejo.yaml
@ -20,7 +20,7 @@ spec:
          replicaCount: 1
          service:
            http:
-              type: LoadBalancer
+              type: ClusterIP
            ssh:
              type: NodePort
          ingress:
--- a/k8s/argo-apps/helm-rustical.yaml
+++ b/k8s/argo-apps/helm-rustical.yaml
@ -25,7 +25,7 @@ spec:
              targetCPUUtilizationPercentage: 80
              targetMemoryUtilizationPercentage: 80
            service:
-              type: LoadBalancer
+              type: ClusterIP
              port: 8001
              targetPort: 4000
            ingress:
--- a/k8s/argo-apps/immich.yaml
+++ b/k8s/argo-apps/immich.yaml
@ -27,7 +27,7 @@ spec:
                drop:
                  - all
            service:
-              type: LoadBalancer
+              type: ClusterIP
            config:
              database:
                hostname: "192.168.1.3"
@ -96,7 +96,7 @@ spec:
            machineLearning:
              enabled: true
              service:
-                type: LoadBalancer
+                type: ClusterIP
            secret:
              enabled: true
              existingSecretName: "immich-secrets"
--- a/k8s/argo-apps/lldap.yaml
+++ b/k8s/argo-apps/lldap.yaml
@ -17,7 +17,7 @@ spec:
        valuesObject:
          lldap:
            service:
-              type: LoadBalancer
+              type: ClusterIP
              httpPort: 17170
              ldapPort: 3890
            ingress:
--- a/k8s/argo-apps/metallb.yaml
+++ b/k8s/argo-apps/metallb.yaml
@ -0,0 +1,25 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metallb
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: metallb-system
+    server: https://kubernetes.default.svc
+  sources:
+    - repoURL: https://metallb.github.io/metallb
+      chart: metallb
+      targetRevision: 0.16.*
+      helm:
+        valuesObject:
+          crds:
+            enabled: true
+    - repoURL: https://git.roboces.dev/catalin/fukuops.git
+      path: k8s/services/metallb
+      targetRevision: main
+  project: management
+  syncPolicy:
+    automated: {}
--- a/k8s/argo-apps/miniflux.yaml
+++ b/k8s/argo-apps/miniflux.yaml
@ -27,7 +27,7 @@ spec:
                drop:
                  - all
            service:
-              type: LoadBalancer
+              type: ClusterIP
            ingress:
              enabled: true
              className: "traefik"
--- a/k8s/argo-apps/oxicloud.yaml
+++ b/k8s/argo-apps/oxicloud.yaml
@ -22,7 +22,7 @@ spec:
              accessMode: ReadWriteMany
              size: 50Gi
            service:
-              type: LoadBalancer
+              type: ClusterIP
            config:
              server:
                port: 8086
--- a/k8s/argo-apps/pgadmin.yaml
+++ b/k8s/argo-apps/pgadmin.yaml
@ -19,7 +19,7 @@ spec:
          image:
            tag: "9.7"
          service:
-            type: LoadBalancer
+            type: ClusterIP
            port: 8010
          ingress:
            enabled: true
--- a/k8s/argo-apps/portainer.yaml
+++ b/k8s/argo-apps/portainer.yaml
@ -19,7 +19,7 @@ spec:
      helm:
        valuesObject:
          service:
-            type: LoadBalancer
+            type: NodePort
            httpPort: 9002
            httpsPort: 9445
            edgePort: 8005
--- a/k8s/argo-apps/vault-sm.yaml
+++ b/k8s/argo-apps/vault-sm.yaml
@ -18,14 +18,14 @@ spec:
          api:
            enabled: true
            service:
-              type: LoadBalancer
+              type: ClusterIP
            persistence:
              storageClass: truenas-nfs-csi
              accessMode: ReadWriteMany
          dashboard:
            enabled: true
            service:
-              type: LoadBalancer
+              type: ClusterIP
              port: 8007
          ingress:
            enabled: true
--- a/k8s/argo-apps/vaultwarden.yaml
+++ b/k8s/argo-apps/vaultwarden.yaml
@ -34,7 +34,7 @@ spec:
                drop:
                  - all
            service:
-              type: LoadBalancer
+              type: ClusterIP
            ingress:
              enabled: true
              className: "traefik"
--- a/k8s/charts/_template/values.yaml
+++ b/k8s/charts/_template/values.yaml
@ -7,7 +7,7 @@ chart:
    tag: ""

  service:
-    type: LoadBalancer
+    type: ClusterIP
    port: 80
    targetPort: 80

--- a/k8s/charts/dokuwiki/values.yaml
+++ b/k8s/charts/dokuwiki/values.yaml
@ -12,7 +12,7 @@ dokuwiki:
  securityContext: {}

  service:
-    type: LoadBalancer
+    type: ClusterIP
    port: 8004
    targetPort: 8080

--- a/k8s/charts/lldap/values.yaml
+++ b/k8s/charts/lldap/values.yaml
@ -7,7 +7,7 @@ lldap:
    tag: "stable"

  service:
-    type: LoadBalancer
+    type: ClusterIP
    httpPort: 17170
    ldapPort: 3890

--- a/k8s/charts/oxicloud/values.yaml
+++ b/k8s/charts/oxicloud/values.yaml
@ -8,7 +8,7 @@ oxicloud:
    tag: ""

  service:
-    type: LoadBalancer
+    type: ClusterIP
    port: 8086

  ingress:
--- a/k8s/charts/vaultwarden/values.yaml
+++ b/k8s/charts/vaultwarden/values.yaml
@ -12,7 +12,7 @@ vaultwarden:
  securityContext: {}

  service:
-    type: LoadBalancer
+    type: ClusterIP
    port: 8008
    targetPort: 80

--- a/k8s/helm/argo-cd/values.yaml
+++ b/k8s/helm/argo-cd/values.yaml
@ -8,7 +8,7 @@ configs:

 server:
  service:
-    type: LoadBalancer
+    type: ClusterIP
    servicePortHttp: 8002
    servicePortHttps: 8003

--- a/k8s/services/argo/project-management.yaml
+++ b/k8s/services/argo/project-management.yaml
@ -18,6 +18,8 @@ spec:
          server: https://kubernetes.default.svc
        - namespace: argo-workflows
          server: https://kubernetes.default.svc
+        - namespace: metallb-system
+          server: https://kubernetes.default.svc
    clusterResourceWhitelist:
        - group: '*'
          kind: '*'
@ -26,3 +28,4 @@ spec:
        - https://democratic-csi.github.io/charts/
        - https://bitnami-labs.github.io/sealed-secrets
        - https://kubernetes-sigs.github.io/descheduler
+        - https://metallb.github.io/metallb
--- a/k8s/services/metallb/l2advert-adguard.yaml
+++ b/k8s/services/metallb/l2advert-adguard.yaml
@ -0,0 +1,9 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: adguard-dns-l2
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - adguard-dns-pool
--- a/k8s/services/metallb/l2advert-prod.yaml
+++ b/k8s/services/metallb/l2advert-prod.yaml
@ -0,0 +1,9 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: ingress-l2
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - ingress-pool
--- a/k8s/services/metallb/namespace.yaml
+++ b/k8s/services/metallb/namespace.yaml
@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system
--- a/k8s/services/metallb/pool-adguard.yaml
+++ b/k8s/services/metallb/pool-adguard.yaml
@ -0,0 +1,10 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: adguard-dns-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.1.125/32
+  autoAssign: false
--- a/k8s/services/metallb/pool-prod.yaml
+++ b/k8s/services/metallb/pool-prod.yaml
@ -0,0 +1,12 @@
+---
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: ingress-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.1.126/32
+  # Only Traefik should get this IP. Other LoadBalancer services that are
+  # not yet migrated will stay pending instead of stealing the single VIP.
+  autoAssign: false