From 1eab0689772fb29015ac5a213333cdb2dfae9a27 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?c=C4=83t=C4=83lin?= Date: Mon, 24 Aug 2026 13:23:19 +0200 Subject: [PATCH] feat: add metallb --- .gitignore | 1 + README.md | 5 +++++ k8s/argo-apps/adguard.yaml | 6 +++++- k8s/argo-apps/audiobookshelf.yaml | 2 +- k8s/argo-apps/authelia.yaml | 2 +- k8s/argo-apps/authentik.yaml | 4 ++-- k8s/argo-apps/dokuwiki.yaml | 2 +- k8s/argo-apps/forgejo.yaml | 2 +- k8s/argo-apps/helm-rustical.yaml | 2 +- k8s/argo-apps/immich.yaml | 4 ++-- k8s/argo-apps/lldap.yaml | 2 +- k8s/argo-apps/metallb.yaml | 25 ++++++++++++++++++++++ k8s/argo-apps/miniflux.yaml | 2 +- k8s/argo-apps/oxicloud.yaml | 2 +- k8s/argo-apps/pgadmin.yaml | 2 +- k8s/argo-apps/portainer.yaml | 2 +- k8s/argo-apps/vault-sm.yaml | 4 ++-- k8s/argo-apps/vaultwarden.yaml | 2 +- k8s/charts/_template/values.yaml | 2 +- k8s/charts/dokuwiki/values.yaml | 2 +- k8s/charts/lldap/values.yaml | 2 +- k8s/charts/oxicloud/values.yaml | 2 +- k8s/charts/vaultwarden/values.yaml | 2 +- k8s/helm/argo-cd/values.yaml | 2 +- k8s/services/argo/project-management.yaml | 3 +++ k8s/services/metallb/l2advert-adguard.yaml | 9 ++++++++ k8s/services/metallb/l2advert-prod.yaml | 9 ++++++++ k8s/services/metallb/namespace.yaml | 5 +++++ k8s/services/metallb/pool-adguard.yaml | 10 +++++++++ k8s/services/metallb/pool-prod.yaml | 12 +++++++++++ 30 files changed, 107 insertions(+), 24 deletions(-) create mode 100644 k8s/argo-apps/metallb.yaml create mode 100644 k8s/services/metallb/l2advert-adguard.yaml create mode 100644 k8s/services/metallb/l2advert-prod.yaml create mode 100644 k8s/services/metallb/namespace.yaml create mode 100644 k8s/services/metallb/pool-adguard.yaml create mode 100644 k8s/services/metallb/pool-prod.yaml diff --git a/.gitignore b/.gitignore index e7b695a..a1df2e8 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ k8s/charts/README.md opencode.json *.pyc .venv/ +METALLB.md diff --git a/README.md b/README.md index aff389b..3da2575 100644 --- a/README.md +++ b/README.md @@ -19,3 +19,8 @@ helm upgrade argo-cd argo/argo-cd -n argo-cd -f k8s/helm/argo-cd/values.yaml ```bash scripts/users.py add -u catalin -n cătălin -e catalin@roboces.dev ``` + +## MetalLB and reserved VIPs + +- traefik VIP: 192.168.1.127 +- adguard dns VIP: 192.168.1.125 diff --git a/k8s/argo-apps/adguard.yaml b/k8s/argo-apps/adguard.yaml index de1880e..d7611da 100644 --- a/k8s/argo-apps/adguard.yaml +++ b/k8s/argo-apps/adguard.yaml @@ -41,6 +41,10 @@ spec: service: dns: type: LoadBalancer + port: 53 + annotations: + metallb.universe.tf/address-pool: adguard-dns-pool + loadBalancerIP: 192.168.1.125 web: - type: LoadBalancer + type: ClusterIP port: 8006 diff --git a/k8s/argo-apps/audiobookshelf.yaml b/k8s/argo-apps/audiobookshelf.yaml index c1863e2..d52b97a 100644 --- a/k8s/argo-apps/audiobookshelf.yaml +++ b/k8s/argo-apps/audiobookshelf.yaml @@ -16,7 +16,7 @@ spec: helm: valuesObject: service: - type: LoadBalancer + type: ClusterIP port: 8081 ingress: enabled: true diff --git a/k8s/argo-apps/authelia.yaml b/k8s/argo-apps/authelia.yaml index c3096c2..0bd9ddc 100644 --- a/k8s/argo-apps/authelia.yaml +++ b/k8s/argo-apps/authelia.yaml @@ -28,7 +28,7 @@ spec: cpu: 1 memory: 1024Mi service: - type: LoadBalancer + type: ClusterIP port: 9091 ingress: enabled: true diff --git a/k8s/argo-apps/authentik.yaml b/k8s/argo-apps/authentik.yaml index 9479e43..e421fa8 100644 --- a/k8s/argo-apps/authentik.yaml +++ b/k8s/argo-apps/authentik.yaml @@ -63,7 +63,7 @@ spec: enabled: true minAvailable: 1 service: - type: LoadBalancer + type: ClusterIP servicePortHttp: 9001 servicePortHttps: 9444 annotations: @@ -72,7 +72,7 @@ spec: metrics: enabled: true service: - type: LoadBalancer + type: ClusterIP serviceMonitor: enabled: false ingress: diff --git a/k8s/argo-apps/dokuwiki.yaml b/k8s/argo-apps/dokuwiki.yaml index 6e5216d..83e2daf 100644 --- a/k8s/argo-apps/dokuwiki.yaml +++ b/k8s/argo-apps/dokuwiki.yaml @@ -26,7 +26,7 @@ spec: drop: - all service: - type: LoadBalancer + type: ClusterIP port: 8004 ingress: enabled: true diff --git a/k8s/argo-apps/forgejo.yaml b/k8s/argo-apps/forgejo.yaml index 5f234e6..3ceecd3 100644 --- a/k8s/argo-apps/forgejo.yaml +++ b/k8s/argo-apps/forgejo.yaml @@ -20,7 +20,7 @@ spec: replicaCount: 1 service: http: - type: LoadBalancer + type: ClusterIP ssh: type: NodePort ingress: diff --git a/k8s/argo-apps/helm-rustical.yaml b/k8s/argo-apps/helm-rustical.yaml index 7fcba18..2962404 100644 --- a/k8s/argo-apps/helm-rustical.yaml +++ b/k8s/argo-apps/helm-rustical.yaml @@ -25,7 +25,7 @@ spec: targetCPUUtilizationPercentage: 80 targetMemoryUtilizationPercentage: 80 service: - type: LoadBalancer + type: ClusterIP port: 8001 targetPort: 4000 ingress: diff --git a/k8s/argo-apps/immich.yaml b/k8s/argo-apps/immich.yaml index 31e0c8b..65cca62 100644 --- a/k8s/argo-apps/immich.yaml +++ b/k8s/argo-apps/immich.yaml @@ -27,7 +27,7 @@ spec: drop: - all service: - type: LoadBalancer + type: ClusterIP config: database: hostname: "192.168.1.3" @@ -96,7 +96,7 @@ spec: machineLearning: enabled: true service: - type: LoadBalancer + type: ClusterIP secret: enabled: true existingSecretName: "immich-secrets" diff --git a/k8s/argo-apps/lldap.yaml b/k8s/argo-apps/lldap.yaml index c2218b2..577dfd3 100644 --- a/k8s/argo-apps/lldap.yaml +++ b/k8s/argo-apps/lldap.yaml @@ -17,7 +17,7 @@ spec: valuesObject: lldap: service: - type: LoadBalancer + type: ClusterIP httpPort: 17170 ldapPort: 3890 ingress: diff --git a/k8s/argo-apps/metallb.yaml b/k8s/argo-apps/metallb.yaml new file mode 100644 index 0000000..7f909f5 --- /dev/null +++ b/k8s/argo-apps/metallb.yaml @@ -0,0 +1,25 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb + namespace: argo-cd +spec: + destination: + name: '' + namespace: metallb-system + server: https://kubernetes.default.svc + sources: + - repoURL: https://metallb.github.io/metallb + chart: metallb + targetRevision: 0.16.* + helm: + valuesObject: + crds: + enabled: true + - repoURL: https://git.roboces.dev/catalin/fukuops.git + path: k8s/services/metallb + targetRevision: main + project: management + syncPolicy: + automated: {} diff --git a/k8s/argo-apps/miniflux.yaml b/k8s/argo-apps/miniflux.yaml index 2339c6f..af22dc8 100644 --- a/k8s/argo-apps/miniflux.yaml +++ b/k8s/argo-apps/miniflux.yaml @@ -27,7 +27,7 @@ spec: drop: - all service: - type: LoadBalancer + type: ClusterIP ingress: enabled: true className: "traefik" diff --git a/k8s/argo-apps/oxicloud.yaml b/k8s/argo-apps/oxicloud.yaml index aa5556e..fcf6b13 100644 --- a/k8s/argo-apps/oxicloud.yaml +++ b/k8s/argo-apps/oxicloud.yaml @@ -22,7 +22,7 @@ spec: accessMode: ReadWriteMany size: 50Gi service: - type: LoadBalancer + type: ClusterIP config: server: port: 8086 diff --git a/k8s/argo-apps/pgadmin.yaml b/k8s/argo-apps/pgadmin.yaml index d961954..9ff22e8 100644 --- a/k8s/argo-apps/pgadmin.yaml +++ b/k8s/argo-apps/pgadmin.yaml @@ -19,7 +19,7 @@ spec: image: tag: "9.7" service: - type: LoadBalancer + type: ClusterIP port: 8010 ingress: enabled: true diff --git a/k8s/argo-apps/portainer.yaml b/k8s/argo-apps/portainer.yaml index 691cbc9..8751358 100644 --- a/k8s/argo-apps/portainer.yaml +++ b/k8s/argo-apps/portainer.yaml @@ -19,7 +19,7 @@ spec: helm: valuesObject: service: - type: LoadBalancer + type: NodePort httpPort: 9002 httpsPort: 9445 edgePort: 8005 diff --git a/k8s/argo-apps/vault-sm.yaml b/k8s/argo-apps/vault-sm.yaml index d017a0b..22f0f3c 100644 --- a/k8s/argo-apps/vault-sm.yaml +++ b/k8s/argo-apps/vault-sm.yaml @@ -18,14 +18,14 @@ spec: api: enabled: true service: - type: LoadBalancer + type: ClusterIP persistence: storageClass: truenas-nfs-csi accessMode: ReadWriteMany dashboard: enabled: true service: - type: LoadBalancer + type: ClusterIP port: 8007 ingress: enabled: true diff --git a/k8s/argo-apps/vaultwarden.yaml b/k8s/argo-apps/vaultwarden.yaml index 98009c1..d35a61b 100644 --- a/k8s/argo-apps/vaultwarden.yaml +++ b/k8s/argo-apps/vaultwarden.yaml @@ -34,7 +34,7 @@ spec: drop: - all service: - type: LoadBalancer + type: ClusterIP ingress: enabled: true className: "traefik" diff --git a/k8s/charts/_template/values.yaml b/k8s/charts/_template/values.yaml index 7aa1f5f..5f70727 100644 --- a/k8s/charts/_template/values.yaml +++ b/k8s/charts/_template/values.yaml @@ -7,7 +7,7 @@ chart: tag: "" service: - type: LoadBalancer + type: ClusterIP port: 80 targetPort: 80 diff --git a/k8s/charts/dokuwiki/values.yaml b/k8s/charts/dokuwiki/values.yaml index f003331..31c68df 100644 --- a/k8s/charts/dokuwiki/values.yaml +++ b/k8s/charts/dokuwiki/values.yaml @@ -12,7 +12,7 @@ dokuwiki: securityContext: {} service: - type: LoadBalancer + type: ClusterIP port: 8004 targetPort: 8080 diff --git a/k8s/charts/lldap/values.yaml b/k8s/charts/lldap/values.yaml index bb19244..0a3230f 100644 --- a/k8s/charts/lldap/values.yaml +++ b/k8s/charts/lldap/values.yaml @@ -7,7 +7,7 @@ lldap: tag: "stable" service: - type: LoadBalancer + type: ClusterIP httpPort: 17170 ldapPort: 3890 diff --git a/k8s/charts/oxicloud/values.yaml b/k8s/charts/oxicloud/values.yaml index 1348f56..fa16dca 100644 --- a/k8s/charts/oxicloud/values.yaml +++ b/k8s/charts/oxicloud/values.yaml @@ -8,7 +8,7 @@ oxicloud: tag: "" service: - type: LoadBalancer + type: ClusterIP port: 8086 ingress: diff --git a/k8s/charts/vaultwarden/values.yaml b/k8s/charts/vaultwarden/values.yaml index c3c1baa..f93218f 100644 --- a/k8s/charts/vaultwarden/values.yaml +++ b/k8s/charts/vaultwarden/values.yaml @@ -12,7 +12,7 @@ vaultwarden: securityContext: {} service: - type: LoadBalancer + type: ClusterIP port: 8008 targetPort: 80 diff --git a/k8s/helm/argo-cd/values.yaml b/k8s/helm/argo-cd/values.yaml index 89d4cd4..8e618b6 100644 --- a/k8s/helm/argo-cd/values.yaml +++ b/k8s/helm/argo-cd/values.yaml @@ -8,7 +8,7 @@ configs: server: service: - type: LoadBalancer + type: ClusterIP servicePortHttp: 8002 servicePortHttps: 8003 diff --git a/k8s/services/argo/project-management.yaml b/k8s/services/argo/project-management.yaml index 180673b..141f7a2 100644 --- a/k8s/services/argo/project-management.yaml +++ b/k8s/services/argo/project-management.yaml @@ -18,6 +18,8 @@ spec: server: https://kubernetes.default.svc - namespace: argo-workflows server: https://kubernetes.default.svc + - namespace: metallb-system + server: https://kubernetes.default.svc clusterResourceWhitelist: - group: '*' kind: '*' @@ -26,3 +28,4 @@ spec: - https://democratic-csi.github.io/charts/ - https://bitnami-labs.github.io/sealed-secrets - https://kubernetes-sigs.github.io/descheduler + - https://metallb.github.io/metallb diff --git a/k8s/services/metallb/l2advert-adguard.yaml b/k8s/services/metallb/l2advert-adguard.yaml new file mode 100644 index 0000000..707c837 --- /dev/null +++ b/k8s/services/metallb/l2advert-adguard.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: adguard-dns-l2 + namespace: metallb-system +spec: + ipAddressPools: + - adguard-dns-pool diff --git a/k8s/services/metallb/l2advert-prod.yaml b/k8s/services/metallb/l2advert-prod.yaml new file mode 100644 index 0000000..6b422c2 --- /dev/null +++ b/k8s/services/metallb/l2advert-prod.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: ingress-l2 + namespace: metallb-system +spec: + ipAddressPools: + - ingress-pool diff --git a/k8s/services/metallb/namespace.yaml b/k8s/services/metallb/namespace.yaml new file mode 100644 index 0000000..928cb91 --- /dev/null +++ b/k8s/services/metallb/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: metallb-system diff --git a/k8s/services/metallb/pool-adguard.yaml b/k8s/services/metallb/pool-adguard.yaml new file mode 100644 index 0000000..12f9c77 --- /dev/null +++ b/k8s/services/metallb/pool-adguard.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: adguard-dns-pool + namespace: metallb-system +spec: + addresses: + - 192.168.1.125/32 + autoAssign: false diff --git a/k8s/services/metallb/pool-prod.yaml b/k8s/services/metallb/pool-prod.yaml new file mode 100644 index 0000000..b090516 --- /dev/null +++ b/k8s/services/metallb/pool-prod.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: ingress-pool + namespace: metallb-system +spec: + addresses: + - 192.168.1.126/32 + # Only Traefik should get this IP. Other LoadBalancer services that are + # not yet migrated will stay pending instead of stealing the single VIP. + autoAssign: false