My Notes

FLUXCD Setup 1 - Installation

2 min read

om

FLUX Installation

Replace the name “prod” with the name for your new cluster to manage

flux bootstrap github \  
--owner=markkpamy \  
--branch=main \  
--repository=fleet-infra \  
--path=clusters/prod-talos-cluster \  
--personal

OR

export GITHUB_USER=[email protected]  
export GITHUB_TOKEN=ghp_YOUR_GITHUB_TOKEN_HERE_32_CHARS
 
flux bootstrap git \  
--token-auth=true \  
--url=https://github.com/markkpamy/fleet-infra \  
--username=${GITHUB_USER} \  
--password=${GITHUB_TOKEN} \  
--branch=main \  
--path=clusters/prod-talos-cluster \  
--verbose

WEAVE GITOPS INSTALLATION

(no need if you will install via the repo fleet-infra)

PASSWORD="weave-gitops"  
gitops create dashboard ww-gitops \
--password=$PASSWORD \
--export > ./clusters/my-cluster/weave-gitops-dashboard.yaml

OVH CREDENTIALS

For prod :

kubectl create secret generic ovh-creds-litteral \  
--from-literal=ovh_endpoint=ovh-eu \  
--from-literal=ovh_application_key=YOUR_OVH_APP_KEY_HERE \  
--from-literal=ovh_application_secret=YOUR_OVH_APPLICATION_SECRET_HERE \  
--from-literal=ovh_consumer_key=YOUR_OVH_CONSUMER_KEY_HERE \  
-n traefik-prod

For staging :

kubectl create secret generic ovh-creds-litteral \  
--from-literal=ovh_endpoint=ovh-eu \  
--from-literal=ovh_application_key=YOUR_OVH_APP_KEY_HERE \  
--from-literal=ovh_application_secret=YOUR_OVH_APPLICATION_SECRET_HERE \  
--from-literal=ovh_consumer_key=YOUR_OVH_CONSUMER_KEY_HERE \  
-n traefik-staging

Secrets :

These secrets are SOPS encrypted and stored in the git repo. No need to create them manually. You only need to setup SOPS decryption key.

  • cloudflare
  • external-dns
  • toolsera tls
  • whoami tls
kubectl create secret generic cf-creds-litteral --from-literal=cf_dns_api_token=YOUR_CLOUDFLARE_DNS_API_TOKEN_HERE -n traefik-staging
kubectl create secret tls toolserafr-certificate -n traefik-staging --cert=toolserafr_cloudflare_origin.crt  
--key=toolserafr_cloudflare_origin.key
kubectl create secret generic external-dns-ovh-creds -n external-dns \  
--from-literal=ovh_endpoint=ovh-eu \  
--from-literal=ovh_application_key=YOUR_OVH_APP_KEY_HERE \  
--from-literal=ovh_application_secret=YOUR_OVH_APPLICATION_SECRET_HERE \  
--from-literal=ovh_consumer_key=YOUR_OVH_CONSUMER_KEY_HERE

Install Cilium

helm repo add cilium https://helm.cilium.io/
helm repo update
export CILIUM_NAMESPACE=kube-system
helm install cilium cilium/cilium \
  --version 1.17.2 \
  --namespace $CILIUM_NAMESPACE \
  --set=ipam.mode=kubernetes \
  --set=kubeProxyReplacement=true \
  --set=securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
  --set=securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
  --set=cgroup.autoMount.enabled=false \
  --set=cgroup.hostRoot=/sys/fs/cgroup \
  --set=k8sServiceHost=localhost \
  --set=k8sServicePort=7445

Enable Cilium Hubble UI

export CILIUM_NAMESPACE=kube-system
helm upgrade cilium cilium/cilium --version 1.17.2 \
   --namespace $CILIUM_NAMESPACE \
   --reuse-values \
   --set hubble.relay.enabled=true \
   --set hubble.ui.enabled=true
  # --set hubble.tls.enabled=false

Graph View