Skip to content

Commit 1eb53fa

Browse files
authored
feat: add Cilium to Talos environments (#912)
* feat: add cilium to dev Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: update SOPS configuration for dev and prod clusters Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: add security context capabilities for Cilium Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: reorder cgroup and service configuration in HelmRelease patch Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: comment out security context capabilities in HelmRelease patch Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: update kustomization files for cilium and correct resource paths Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: restore security context capabilities in HelmRelease patch Signed-off-by: Nikolai Emil Damm <[email protected]> * feat: add kustomization and flux configurations for production environment Signed-off-by: Nikolai Emil Damm <[email protected]> * fix: change concurrency cancel-in-progress setting to false in deploy workflow Signed-off-by: Nikolai Emil Damm <[email protected]> --------- Signed-off-by: Nikolai Emil Damm <[email protected]>
1 parent e256253 commit 1eb53fa

File tree

24 files changed

+260
-21
lines changed

24 files changed

+260
-21
lines changed

.github/workflows/deploy.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ on:
1111

1212
concurrency:
1313
group: ${{ github.workflow }}
14-
cancel-in-progress: true
14+
cancel-in-progress: false
1515

1616
permissions:
1717
contents: read

.sops.yaml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,17 @@ creation_rules:
33
encrypted_regex: ^(data|stringData)$
44
age: |-
55
age1fqcl89lrl8daucdkn7xstjhv9mcxk39m59a9mhvw0g3j24kjmu6qcaxpp7
6+
- path_regex: ^k8s\/clusters\/dev\/.+\.enc\.ya?ml$
7+
encrypted_regex: ^(data|stringData)$
8+
age: |-
9+
age1q2vtjmghm5yv3sm426325u0tsgvru758lum8kefhp62fhmhf3afqhrnm3x
10+
- path_regex: ^k8s\/clusters\/prod\/.+\.enc\.ya?ml$
11+
encrypted_regex: ^(data|stringData)$
12+
age: |-
13+
age18huaqzzrln439z9nj56kmqnkcu5zrj44y57ml8tlauhh5vj3yqgsa0l9dw
614
- path_regex: ^.+\.enc\.ya?ml$
715
encrypted_regex: ^(data|stringData)$
816
age: |-
9-
age1fqcl89lrl8daucdkn7xstjhv9mcxk39m59a9mhvw0g3j24kjmu6qcaxpp7
17+
age1fqcl89lrl8daucdkn7xstjhv9mcxk39m59a9mhvw0g3j24kjmu6qcaxpp7,
18+
age1q2vtjmghm5yv3sm426325u0tsgvru758lum8kefhp62fhmhf3afqhrnm3x,
19+
age18huaqzzrln439z9nj56kmqnkcu5zrj44y57ml8tlauhh5vj3yqgsa0l9dw

k8s/clusters/dev/apps/flux-kustomization.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,18 @@ spec:
1111
sourceRef:
1212
kind: OCIRepository
1313
name: flux-system
14+
dependsOn:
15+
- name: infrastructure
16+
decryption:
17+
provider: sops
18+
secretRef:
19+
name: sops-age
20+
postBuild:
21+
substituteFrom:
22+
- kind: ConfigMap
23+
name: variables-dev
24+
- kind: Secret
25+
name: variables-dev-sensitive
1426
path: clusters/dev/apps/
1527
prune: true
1628
wait: true

k8s/clusters/dev/infrastructure/controllers/kustomization.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
apiVersion: kustomize.config.k8s.io/v1beta1
33
kind: Kustomization
44
resources:
5-
- ../../../../distributions/talos/infrastructure/controllers
5+
- ../../../../distributions/talos/infrastructure/controllers/

k8s/clusters/dev/infrastructure/flux-kustomization.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ spec:
1313
kind: OCIRepository
1414
name: flux-system
1515
dependsOn:
16-
- name: variables
1716
- name: infrastructure-controllers
1817
decryption:
1918
provider: sops

k8s/clusters/dev/kustomization.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
apiVersion: kustomize.config.k8s.io/v1beta1
33
kind: Kustomization
44
resources:
5+
- apps/flux-kustomization.yaml
56
- infrastructure/controllers/flux-kustomization.yaml
67
- infrastructure/flux-kustomization.yaml
78
- variables/flux-kustomization.yaml

k8s/clusters/dev/variables/secret.enc.yaml

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,21 +4,21 @@ metadata:
44
name: variables-dev-sensitive
55
namespace: flux-system
66
stringData:
7-
dex_client_secret: ENC[AES256_GCM,data:+e5Ci4m7nMWUpkDT42brDaehqE0=,iv:vt18z7crgtdhsa2L371GLCv/acPnD3hNS5ZA2ZktAgw=,tag:nPQRcUHivbfwg98P0hP+6Q==,type:str]
8-
github_app_client_secret: ENC[AES256_GCM,data:ElSZ3N+pvXNWarUiBazdBYme7LGCbbSOCGXpgutMJ8Agt+SHBaCaIw==,iv:TQVSBXGdRdyMGUXUP3YMZjpw4GF/jvA+9Bro2al0sNs=,tag:99sUHhgeVxgvmpXIuRfZ/A==,type:str]
9-
github_app_private_key: ENC[AES256_GCM,data:+uRkDbVKduvgExe15gaue3/Mr5MGLIyiJJsjbhQBbfeRPU0wsGc0Vrcyj+4eFUjloTBB0R29I/rsZrhDE0B9L+tF59YYK1uFn5Uc+MsNkxdwxpJ4XXZPBlMsfwclLZxtncm9BhP950PQnY/5VN2Fb53BGp+xDBv42ARkT2T2qjrYzogO3uOefMv5GqL4UX2Qxj+pRjw6VelUMUNSHFKCFBQ7DDl3eI2dhIfqT0ZwxxVBxvIgNdBnEKgzQgblWz8xpyNIeFHFscTWnpoY4xgMwJJOzdCwq7IV4zhmmzxAv339VmUi2jUE055ZvyX1D7mxGontQbjuJn7uFW8Z5b0ov8A3PMa6CuEycEKvymYhKG07s3KsUZvegtKheV4L33l/3LPUPHV9T8uIYfyImcJ8fJj5C/indawdxQDMpyDN5+KuSkc/AP4Xtte4YWdNXUxmo0SxsR0HOR0VsBCIOetVnkB5WBtDXI9hTCMGDS3QZ5PoHTjQtyvZdFBrS4sv8g3tsvNmuHCcfZ6s6qo6FQ65/ZJmzSWJ6BM8H/iIJWiLDFiDIAG1XiZNqr8GRSP/jzYcTTma6sh9ST7DmdAlAeSigV/Shn8IFLKmfXxlMUMEBnPoHbOeqIpLPxDZPOlr7CiYHPE7y6gjswVNfAb1KyU7HiLzDQdtwR7VMjghJ5bAJu+erBhSb3oMU/yecBCOnTCgZStV7Qn86DWflaWa/rdn7hC4elsMYGrfbocERef2AWRFQS3ZdmjczlLc2nEspiRPEdrw3SqPEr7MduHA0nHg/OPe7+OTbXevBp0/hNXLh8Jdbk63B3RqE2+aSvSal49n8bdLlK+S8F4UKTecxtIuhMGcmU7FLcgAjuFBda0FQqC8yMEaWSzmAfLybXQuEZxlHIMKc44ODpqVdT4y9mqQuS30tz0+UnXGYOzkPqmq75p46yltIj29ZoZ1mvQjBQ2ZU8dOLOIX1ouGu417cvpMq8qG4iFL9cfW6xzrwbMC8tlLh7tC2fYgtbqf1/JPRmraJCCqiWCwZaaihTcoEy/1yWmmreGjfNMbpyaauyzJ+8OnUq5bk91nP57PHaLPsHFrphNrjyGIhFh73+3rCZrwkfyf9BOpxNyXtNXFPlLTw6r22u1tr/qSPdvElcIWlxOrSX54b9lettgFB0SSPe6hJxr5afmaErAVG6uwxcrTaGhFuVDJ4FZTCV1ws8i9Q8txM7prvV8xmwf0zuG2eUjWcZfUEiZlZ9GVCSsPVqnHXuoSXEPiGGAKY3t3d+oVuVsenfk4LK/srJGBYUrahdG7TGEhMHgMyhd++/y02S+93oxJdGIwYwpZbHca/n0asEs8m8mwirs2+Fj+zAC9JOjo3F7ew4Plh63hkJC3j2bOXY4yD0gwNjrr9TyEkLlj06354TGVzlnmpkIRl2r8PwZdOtDrHWh1zMutMKYv2D+ws9nOqKjzE0Zf6hVI1XIbn471gVvMkVvxeMq8A//txNF5g0eYDBlY8iBZ3//dbhCWiY4MFPAkCC4+6QEkbSsGNqbnDZPwPMQm1zXrrF6hJpC4Oc6elo0wPk85hzdoyqTBE0XFEpgsvDFAeyEowNYFGaBMC6vM7snxfJvH4f3X8Kro74i9ImAO+DpviiMhT5NoYCstLkyYklzn/XEsN+EOMNq6p9CvDI3X3IYucI6julbAH6XgCYcetPPN0UdXtGn4eh7X1Y9ZG1xfI1xP7122y/OClx+LjhxRw/Tuw3uVgzo6pSC10TCXqEhmpO3kKlGKd09z3vTBpFueG2rCTpZ4MmrrLXdFCu2o7Z2jbzM0iD8MYl6LQ5FmWGyUWMSfkY8FQLOqRUklP/Uh9ZHQEf1yxR1JNcTSrzyqrP4l66js4q8hVxw/T9DJnOtDIF6dOk81K4GDRF8J/0j2ikMgeunESyblXsVomSjZkchSbjgfKpAagLqS1koBbflkU0NrVsqHCF0ZjiGFlkAGtfbTrUPLTMAR17r4QbJ5zqq3/ROjhS476GS8xiqZm4UnfX4LXezVEKMF4Y++IvbLkZ5SsV3a6+aL9yF+v0eQcA56Bb8MYag9KB7kkvWIfKbJcS+hINAChRABjzSSY0RHlPjeN4+6fyEbvAlllaRIO45s4vdIJOjvdTgtCJ4CMcWW5XGMRYshrypKi5sA/Na6SCKS6G8yvBmg+QuTJpaYm0XfFBYIsVikBknWNxHuTlzMbcbznlj6fX2WDIG/zPTBp5Jlpw==,iv:/tby64GY0Q5UPkbg0w81YT6aOBiTNyDBKFFgLB0T1WA=,tag:HZ8/bnRqeO0cFfSPffzhaw==,type:str]
7+
dex_client_secret: ENC[AES256_GCM,data:tOdVZhFh2GCtciIQNBOlc6IqXTg=,iv:pPb8Qm4Yxxm7SzdMXN4sIcXWNdSTdY40LAXIgIangYU=,tag:BjKwaaxFqvdTPBOlJnUejg==,type:str]
8+
github_app_client_secret: ENC[AES256_GCM,data:GfDCRM515Z7u/bcSTfEdMTYicv7CcDHNEen4cuu7Qk9gGMDVSzTZiQ==,iv:05NU5gqRQTsI06HDXdeAzKsrlgcG01XL1UD7RwUIqww=,tag:vKOs1MJHbdDxiuPem9pvFA==,type:str]
9+
github_app_private_key: ENC[AES256_GCM,data:GQGbcemwC6QhUCkEQAafsZLqe7v8E3BEtiTu44kpQBiFC9coig+/4+YsRhEcLJnIFHl9G7bNhbZej5kKPQ+MdgU47Z9iS/sJDQLIsOI5WOf2aEB1i21bxBgDLobdArSbYO+oDy9HotvvAZ6crjILaWUjfGpjk6J20b8b+HYBBfplLKkQTg3ZeCFn/OAsWG4B+mgNAcHN1rSw617YnoZRej9N2JYMSY3CgOBQ/qTEO9/jvqGICvf1jouAk0oHb+4LgihXAsizo2BmdXf5tYZI1bJ7QbqFZYbSEL4cvy445FXhDpbpn7nKrq3p94ic/B3Mw0JS81uUj/rpFH7jD87IzHImrqm6Vt2US3Hn+xUc/xv8jVjOa+WxvZsFuT4/uR/k1l4tev3PfHxaztOmSXd1B4Tz2ec85qEYZDMvNYR+D/O6ext2P7P39RV21JD8e2M/yX+mjOEIX5uO7kJMe4UTsJrkK/K3XtkfqDoCFzQufkNrL9vBLzVI18VJU67ErDp4zH9THK8EqDvfq3JDu/F31tCDhsA3W2FSQ6zisW+QPRyqCHIaIvKw6dWjfr6zgbGUdPrhkowf2wY0nQIG4207QGHHYATv1f83nx2mZHMrxsFnYVLzNHFbJ2IjEj/D9MqkhLkY9v/Qw9rm+RWbymESEWZsBA3NbJWznsFgfhdKwsTjAe+HUDAs8gmJKd1h4AQTZq0VYCgaj0gzNwIICC7ZQqOIbA0g57xCJWM8XJBfoMds16fMv4dBJomQIGI1xw9oI9IGzYy/ahOwgZ9qZTWQ2n7fC/Hw1m8XvqOe8qHUTheo8OV3HReYpBybyCGpDVUvWeqY0Oo3uwewW0r/r0OuonUTZIqlUS98Rxnqbwz+M9rPbNJWPyfG095l0etjdimb9FgqmneS6jPXV5z2h4isPqibY1HjfxtMiVecyO1xHJZTAjxg3Jh+EOGPsclcoD3NC894atRMVP8KDoyZCIgYNmOUli2iKflIan3bG3s6zdTJxCPWMfTaXIJuorRmUsuCcBs+7PHhAb2BofWzT5vzrh4uLDq407b+ipx0hn6s8kOx9OvugsbsbzJHBP2fMXw/uFGt4EUGq8Yt0X85aN6CRpvcUjIcuj2Xff5bkWgK5MXn7JBgVe6Db+d37mWsj77TnKush+C4ZXNtrWGCtJdrYOCUSYhIOFUiSEGbrz5vdIqXjdrNTG+8nDTf5VZlI8wV22sBJOGiPlWLv5OMaZSnTxRCLfmlpr0lNOE4kC3smQvYA49dpSDKLLWOAoVbdoxZz3znRV9zK1/eEy+cPhIuwwRokcrCvTp5LwppLeLv60hdh+z0LhvrP7QrelRfHUrD+rYaQHd71a1ImYzJAJy+4TmBPDWKx+RotvLZk+SyKuTGrwjbx09SmLCvp1o8oiICVsYYf7DJeGT1aoPrqwd2VSs6lv156pv2c4hIFBvQzFxDyb5LJzmkxZorfyx8n8otj0wb2Gy4BcD9hC7RXFIbNPdzGi7Wjvj0/LhrIagwa2tzUMpIyOQkSIw0NWV3wjbSys3fBDTQ0mvk61QDDOrCiBjbU4bqM+JfFHCBlF+VwKy5AXAj50m2jl6eU1OkRbLa8nnfP6kb6yV6bYuyc13YNe/FQfyM5nHfJWJDd7it0DQjo6yYGirPrbPE9+Cn3hTeCO+LRcVvTMaa3+YN/MkjyuzFU8TSMBUuPOividdoNBGlrveJq8EkS0P9oUWRHUDP+Y+iGgQe6ChgZe13Vwn3M8nY/+tsbi7u2sG3v2jDFGA5puWcbfLcC3kBlF77d2XGm3Hok2+MHHRo1uwkiObKUONGAnQAUrfZElFrfTMupJTPBXSEcQgosaQb6qq2eo6B/rBNWQes43Ftkjpwo2H7gCNtkVcjrINt5aiDKMkcjN2O5CiaW/FdY2Oy/8fZ4pQpTyFeGnCY+0rHXbLT45GRV+ILUleKdC9offsa8Vf/EswKLYJ8E9tu/5YNCTqGPT79M1/jZf53G0B0aFXouUsmlDF0HPvoWyECG3v6Qyjs+S06Ht+1gnzmVNOZtQiyMNH59W87NDEIFf/nmnhGSYxpOis5gP+QMFSflRgncOxZgNUL3MzA93W155UysbaeCItiY3RS8aFKsyVyFUSQ7xxNDF66JU3iDc+bS2YdFeAKl7e+VoX4YM7YV8WNla7sniw+Q6IBTiosG/EpR9ELU3DuEbNgUWdG/XX30jTuXTrSeSHrhjTThMNfHdtVwQ==,iv:iaQu/4tWhLkNevePvoNF4KIxqQr/Zx+mqfvGqLlYYjc=,tag:F4w8EKfr+4zrZ1P2fz7PxA==,type:str]
1010
sops:
1111
age:
12-
- recipient: age1fqcl89lrl8daucdkn7xstjhv9mcxk39m59a9mhvw0g3j24kjmu6qcaxpp7
12+
- recipient: age1q2vtjmghm5yv3sm426325u0tsgvru758lum8kefhp62fhmhf3afqhrnm3x
1313
enc: |
1414
-----BEGIN AGE ENCRYPTED FILE-----
15-
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5b20wRER4SWdWdVgwTXpF
16-
ZWxqTExtOFpFc2dpQ2l4bkNPRVZ4R3MyUVVnCnhUYkgxL1UxWGV6ZXBDb2xyQjZq
17-
akJyVzdneUlPaXltNjhpYy9QbWtLVVkKLS0tIDFJUW54QUoxbXh5ZUNRcXBWRWI1
18-
OE1CVEVqRVBjT3Jqckc1L0gwZ1JTdk0KGKF8qlUINhdrzW3JuplBqQ52s4PfbSo9
19-
8HBAS+DlVet6PrlaolKlNjI5qL0u4FZfPwub6AXrI0jIq8XwEGzj/g==
15+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNcGN3MG9COGxGOGhtTmN6
16+
SFJsWkVxWjhLOEZpT0Y4WmFkOGxIQy80ZmpjCnAvWGVXOE5INUZ3Wkh1OGxJbjdo
17+
UVo3S1o0UU9tUDV6aGJzK2FzeS9kNzQKLS0tIFpoNVpsQ0dKUUpKU1E3SlppbzQ0
18+
WHEzdjBFQ1dlcURQMEVQL2lxQXFrM2cKeQMGiRZQjdWI0/faqJDsFSN9eggyr73d
19+
q8S5XiZDB+wAFTMaMebscfhSWo/3N8G3EpFdh1GMiVNyLMskzkbARw==
2020
-----END AGE ENCRYPTED FILE-----
21-
lastmodified: "2025-05-09T15:47:43Z"
22-
mac: ENC[AES256_GCM,data:Zw3zc3sQ6jLMAfj3rkMFbXh86F94JeOmP3caFW+cpqaziPyydXahQ+296Q10n3ydivNbEq2EMEkgjut3fArpN6KTxxTQ3vagpeReq3kOlDqOwdKTAwZ+Xd1IkCvljdUigbpsUWn6pPKvzfrxQ5UiOsA3J4re3ngndrKUqypW98s=,iv:qblri7AXEtDDKAIGJCCRZwrFR8b7Syk3uQphPqQNtNA=,tag:OSYICwjt0IC1IChS+shezQ==,type:str]
21+
lastmodified: "2025-05-10T12:05:56Z"
22+
mac: ENC[AES256_GCM,data:HuaKpCFAsbs/EnLsrWt0AMBlYzVNNEIFN/v7YW43D3PgVyq+Rh7rdJbkC3am9qlmXEbSbMGE0muMcudH+ApPYxRsFwmLvOskvAaEsnd41xiBwA+AIHkODcYcL7h18mSJ8JLXxI/I9+WKfYMf/hPIOds+SaAEI7l5t3PXHS8yJF8=,iv:VekpOes4+E6yO7tPfOILk8IV6n6eE+rdz6wqIAwjffo=,tag:7sLeFJgeN6SZ1mNd1oxO+w==,type:str]
2323
encrypted_regex: ^(data|stringData)$
2424
version: 3.10.2

k8s/clusters/local/apps/flux-kustomization.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,18 @@ spec:
1111
sourceRef:
1212
kind: OCIRepository
1313
name: flux-system
14+
dependsOn:
15+
- name: infrastructure
16+
decryption:
17+
provider: sops
18+
secretRef:
19+
name: sops-age
20+
postBuild:
21+
substituteFrom:
22+
- kind: ConfigMap
23+
name: variables-local
24+
- kind: Secret
25+
name: variables-local-sensitive
1426
path: clusters/local/apps/
1527
prune: true
1628
wait: true

k8s/clusters/local/infrastructure/flux-kustomization.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ spec:
1313
kind: OCIRepository
1414
name: flux-system
1515
dependsOn:
16-
- name: variables
1716
- name: infrastructure-controllers
1817
decryption:
1918
provider: sops

k8s/clusters/local/kustomization.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
apiVersion: kustomize.config.k8s.io/v1beta1
33
kind: Kustomization
44
resources:
5+
- apps/flux-kustomization.yaml
56
- infrastructure/controllers/flux-kustomization.yaml
67
- infrastructure/flux-kustomization.yaml
78
- variables/flux-kustomization.yaml

0 commit comments

Comments
 (0)