Merge pull request 'switch to traefik' (#39) from traefik into main

Reviewed-on: #39

app-files/core-deployments.yaml

@@ -2,24 +2,24 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: nginx-ingress
+  name: traefik
   namespace: argocd
 spec:
   project: default
   sources:
-    - repoURL: https://helm.nginx.com/stable
+    - repoURL: https://traefik.github.io/charts
-      chart: nginx-ingress
+      chart: traefik
-      targetRevision: 1.1.2
+      targetRevision: 26.0.0
       helm:
-        releaseName: nginx
+        releaseName: traefik
         valueFiles:
-        - $values/ingress/values.yaml
+        - $values/traefik/values.yaml
     - repoURL: https://git.ar21.de/yolokube/core-deployments.git
       targetRevision: HEAD
       ref: values
   destination:
     server: https://kubernetes.default.svc
-    namespace: nginx-ingress
+    namespace: traefik
   syncPolicy:
     syncOptions:
     - CreateNamespace=true

examples/example-deployment.yaml

@@ -69,9 +69,7 @@ metadata:
   namespace: example
   #annotations:
   # Use for Basic auth:
-    #nginx.org/basic-auth-secret: example-basic-auth-secret
+  #  traefik.ingress.kubernetes.io/router.middlewares: traefik-basic-auth@kubernetescrd
-    # Use the following annotation if the backend only speaks HTTPS (fill out the service name accordingly):
-    #nginx.org/ssl-services: "example-service"
 spec:
   rules:
   - host: "example.apps.yolokube.de"
@@ -84,14 +82,3 @@ spec:
             name: example-service
             port:
               number: 80
-# Use for Basic auth:
-#---
-#kind: Secret
-#metadata:
-#  name: example-basic-auth-secret
-#  namespace: example
-#apiVersion: v1
-#type: nginx.org/htpasswd
-#stringData:
-#  htpasswd: |
-#test:$apr1$2XMU6EMv$f1MJ7zxqTS079YsB7Z.CX/

longhorn/values.yaml

@@ -25,7 +25,7 @@ ingress:
   ingressClassName: nginx
   host: longhorn.services.yolokube.de
   annotations:
-    nginx.org/basic-auth-secret: longhorn-basic-auth-secret
+    traefik.ingress.kubernetes.io/router.middlewares: traefik-basic-auth@kubernetescrd
 metrics:
   serviceMonitor:
     enabled: true

prometheus/values.yaml

@@ -60,7 +60,7 @@ alertmanager:
     hosts:
       - alertmanager.services.yolokube.de
     annotations:
-      nginx.org/basic-auth-secret: prometheus-basic-auth-secret
+      traefik.ingress.kubernetes.io/router.middlewares: traefik-basic-auth@kubernetescrd
   ingressPerReplica:
     pathType: ImplementationSpecific
     paths:
@@ -70,7 +70,7 @@ alertmanager:
     hostPrefix: alertmanager
     hostDomain: services.yolokube.de
     annotations:
-      nginx.org/basic-auth-secret: prometheus-basic-auth-secret
+      traefik.ingress.kubernetes.io/router.middlewares: traefik-basic-auth@kubernetescrd
   servicePerReplica:
     enabled: true
   podAntiAffinity: "hard"
@@ -107,7 +107,7 @@ prometheus:
     hosts:
       - prometheus.services.yolokube.de
     annotations:
-      nginx.org/basic-auth-secret: prometheus-basic-auth-secret
+      traefik.ingress.kubernetes.io/router.middlewares: traefik-basic-auth@kubernetescrd
   ingressPerReplica:
     pathType: ImplementationSpecific
     paths:
@@ -116,7 +116,7 @@ prometheus:
     hostPrefix: prometheus
     hostDomain: services.yolokube.de
     annotations:
-      nginx.org/basic-auth-secret: prometheus-basic-auth-secret
+      traefik.ingress.kubernetes.io/router.middlewares: traefik-basic-auth@kubernetescrd
   prometheusSpec:
     retentionSize: "45GB"
     replicas: 2

traefik/basicauth.yaml

@@ -0,0 +1,20 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: basic-auth
+  namespace: traefik
+spec:
+  basicAuth:
+    secret: authsecret
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authsecret
+  namespace: traefik
+data:
+  users: |2
+    YWFyb246JDJ5JDA1JEIyLlEuOS9lNFZFWHNub2UueXBqWU9raXlrbXJGMmhwQXBFN0NZYzJEUEly
+    MHBGSWRETzFPCnRvbTokMnkkMDUkQnNNN2Z2bWYzR3B1em5hazVPU2dyZTB4ODFLNC52eFVRTy9h
+    S1c1Y1k0Z21RT3p2c3NQTE8KYmFzdGk6JCRhcHIxJCRYYUdERnByYiQkTzlZMW9SaFROWTdVNWFh
+    NUxqM3dhMQo=

traefik/values.yaml

@@ -0,0 +1,49 @@
+deployment:
+  kind: DaemonSet
+hostNetwork: true
+ports:
+  web:
+    port: 80
+    redirectTo:
+      port: "websecure"
+  websecure:
+    port: 443
+    tls:
+      certResolver: "letsencrypt"
+
+securityContext:
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+  runAsGroup: 0
+  runAsNonRoot: false
+  runAsUser: 0
+
+service:
+  type: NodePort
+  ipFamilyPolicy: PreferDualStack
+
+persistence:
+  enabled: true
+
+certResolvers:
+  letsencrypt:
+    email: letsencrypt@ar21.de
+    tlsChallenge: true
+    httpChallenge:
+      entryPoint: "web"
+    storage: /data/acme.json
+
+updateStrategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 1
+    maxSurge: 0
+
+ingressRoute:
+  dashboard:
+    matchRule: Host(`traefik.lab.ar21.de`)
+    entryPoints: ["traefik", "websecure"]
+    middlewares:
+      - name: basic-auth