From e84e03cd05cd9d0cdc0e714ab887b903c085e58b Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 17 Apr 2026 15:43:57 -0500 Subject: [PATCH] chore: move charts into manifests --- hosts/baseline.nix | 42 ++++++++++++++----- hosts/unstable/exodus/default.nix | 6 ++- manifests/helm/external-secrets.yaml | 33 +++++++++++++++ manifests/helm/kustomization.yaml | 3 ++ manifests/helm/kyverno.yaml | 40 ++++++++++++++++++ manifests/helm/longhorn.yaml | 5 +++ .../tailscale.yaml} | 33 +++++++++++++++ modules/nixos/kubernetes.nix | 39 ----------------- 8 files changed, 151 insertions(+), 50 deletions(-) create mode 100644 manifests/helm/external-secrets.yaml create mode 100644 manifests/helm/kyverno.yaml rename manifests/{auto/operator-oauth.yaml => helm/tailscale.yaml} (55%) diff --git a/hosts/baseline.nix b/hosts/baseline.nix index 1a59328..25dadb0 100644 --- a/hosts/baseline.nix +++ b/hosts/baseline.nix @@ -53,9 +53,25 @@ # Network Manager pulls in too many deps networking = { + extraHosts = + let + onNetwork = + attr: _k: v: + (builtins.hasAttr attr v) && v.${attr} != null; + getIPs = + attr: domain: + (lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") ( + lib.filterAttrs (onNetwork attr) metadata.hosts + )); + in + builtins.concatStringsSep "\n" ( + (getIPs "ts" "shire-zebra.ts.net") + ++ (getIPs "nebulaIp" "nebula.thehellings.com") + ++ (getIPs "nebulaIp" "nebula") + ++ (getIPs "ip" "thehellings.lan") + ); search = [ - "thehellings.lan" - "home" + "nebula.thehellings.com" ]; networkmanager.enable = false; }; @@ -114,17 +130,23 @@ }; }; - security.sudo.extraRules = [ - { - users = [ "greg" ]; - commands = [ + security = { + sudo-rs = { + enable = true; + extraRules = [ { - command = "ALL"; - options = [ "NOPASSWD" ]; + users = [ "greg" ]; + commands = [ + { + command = "ALL"; + options = [ "NOPASSWD" ]; + } + ]; } ]; - } - ]; + }; + sudo.enable = false; + }; # Define a user account. Don't forget to set a password with ‘passwd’. users.users.greg = { diff --git a/hosts/unstable/exodus/default.nix b/hosts/unstable/exodus/default.nix index 84b6c00..672b429 100644 --- a/hosts/unstable/exodus/default.nix +++ b/hosts/unstable/exodus/default.nix @@ -18,7 +18,11 @@ boot = { loader = { - systemd-boot.enable = true; + systemd-boot = { + enable = true; + memtest86.enable = true; + netbootxyz.enable = true; + }; efi.canTouchEfiVariables = true; }; binfmt.emulatedSystems = [ diff --git a/manifests/helm/external-secrets.yaml b/manifests/helm/external-secrets.yaml new file mode 100644 index 0000000..263e56a --- /dev/null +++ b/manifests/helm/external-secrets.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: external-secrets +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: external-secrets + namespace: external-secrets +spec: + interval: "24h" + url: "https://charts.external-secrets.io/" +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: external-secrets + namespace: external-secrets +spec: + interval: 10m + chart: + spec: + chart: external-secrets + version: "2.3.0" + sourceRef: + kind: HelmRepository + name: external-secrets + interval: "1h" + values: + crds: + create: true + includeCRDs: true diff --git a/manifests/helm/kustomization.yaml b/manifests/helm/kustomization.yaml index 034a8e4..c7f16ad 100644 --- a/manifests/helm/kustomization.yaml +++ b/manifests/helm/kustomization.yaml @@ -1,3 +1,6 @@ resources: + - kyverno.yaml + - external-secrets.yaml + - tailscale.yaml - longhorn.yaml # Needed for storage - traefik.yaml diff --git a/manifests/helm/kyverno.yaml b/manifests/helm/kyverno.yaml new file mode 100644 index 0000000..d15bc1d --- /dev/null +++ b/manifests/helm/kyverno.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: kyverno-system +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: kyverno + namespace: kyverno-system +spec: + interval: "24h" + url: "https://kyverno.github.io/kyverno/" +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: kyverno + namespace: kyverno-system +spec: + interval: 10m + chart: + spec: + chart: kyverno + version: "1.17.1" + sourceRef: + kind: HelmRepository + name: kyverno + interval: "1h" + values: + admissionController: + replicas: 3 + backgroundController: + replicas: 3 + cleanupController: + replicas: 2 + reportsController: + replicas: 2 + crds: + install: true diff --git a/manifests/helm/longhorn.yaml b/manifests/helm/longhorn.yaml index aa5de52..b5c3380 100644 --- a/manifests/helm/longhorn.yaml +++ b/manifests/helm/longhorn.yaml @@ -19,6 +19,11 @@ metadata: namespace: longhorn-system spec: interval: 10m + dependsOn: + - name: tailscale-operator + namespace: tailscale + - name: kyverno + namespace: kyverno chart: spec: chart: longhorn diff --git a/manifests/auto/operator-oauth.yaml b/manifests/helm/tailscale.yaml similarity index 55% rename from manifests/auto/operator-oauth.yaml rename to manifests/helm/tailscale.yaml index 74389f0..7e0ab94 100644 --- a/manifests/auto/operator-oauth.yaml +++ b/manifests/helm/tailscale.yaml @@ -1,3 +1,36 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: tailscale +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: tailscale + namespace: tailscale +spec: + interval: "24h" + url: "https://pkgs.tailscale.com/helmcharts" +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: tailscale + namespace: tailscale +spec: + interval: 10m + dependsOn: + - name: external-secrets + namespace: external-secrets + chart: + spec: + chart: tailscale-operator + version: "1.96.5" + sourceRef: + kind: HelmRepository + name: tailscale + interval: "1h" +--- apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index 4e8bc1d..7ded731 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -2,7 +2,6 @@ config, lib, pkgs, - top, ... }: let @@ -86,43 +85,6 @@ in services = { k3s = { enable = true; - autoDeployCharts = { - external-secrets = { - inherit (top.charts.chartsMetadata.external-secrets.external-secrets) repo version; - enable = true; - name = top.charts.chartsMetadata.external-secrets.external-secrets.chart; - hash = "sha256-dPuUWthwN6L0jdAKRpkDtDedGyDUxUlJrwkvUNwLsrU="; - createNamespace = true; - targetNamespace = "external-secrets"; - values = { - crds.create = true; - includeCRDs = true; - }; - }; - kyverno = { - inherit (top.charts.chartsMetadata.kyverno.kyverno) repo version; - enable = true; - name = top.charts.chartsMetadata.kyverno.kyverno.chart; - hash = "sha256-sNdFEupwfnYSo2iGqKwTadPtXfcbyM1kuisavpiGUyU="; - createNamespace = true; - targetNamespace = "kyverno-system"; - values = { - admissionController.replicas = 3; - backgroundController.replicas = 3; - cleanupController.replicas = 2; - reportsController.replicas = 2; - crds.install = true; - }; - }; - tailscale = { - inherit (top.charts.chartsMetadata.tailscale.tailscale-operator) repo version; - enable = true; - name = top.charts.chartsMetadata.tailscale.tailscale-operator.chart; - hash = "sha256-BtZ24mCT2GMHE9iR+2xuIkB+4m1r2OC3WLkY3jC3i3I="; - createNamespace = true; - targetNamespace = "tailscale"; - }; - }; extraFlags = [ "--cluster-cidr=10.211.0.0/16" "--service-cidr=10.221.0.0/16" @@ -138,7 +100,6 @@ in cert-manager.source = cert-manager; flux.source = flux; node-annotations.source = ../../manifests/auto/nodes.yaml; - operator-oauth.source = ../../manifests/auto/operator-oauth.yaml; }; role = if cfg.agentOnly then "agent" else "server"; serverAddr = lib.mkIf (