initial add of enabling k8s with vault

08_Vault/auth-token-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vault-auth-token
+  annotations:
+    kubernetes.io/service-account.name: vault-auth
+type: kubernetes.io/service-account-token
+

08_Vault/justfile

@@ -0,0 +1,126 @@
+set fallback := true
+
+export K8S_VAULT_NAMESPACE := env("K8S_VAULT_NAMESPACE", "vault")
+export VAULT_CHART_VERSION := env("VAULT_CHART_VERSION", "0.31.0")
+export VAULT_HOST := env("VAULT_HOST", "")
+export VAULT_ADDR := "https://" + VAULT_HOST
+export VAULT_DEBUG := env("VAULT_DEBUG", "false")
+SECRET_PATH := "secret"
+
+
+[private]
+default:
+    @just --list --unsorted --list-submodules
+
+# Add Helm repository
+add-helm-repo:
+    helm repo add hashicorp https://helm.releases.hashicorp.com
+    helm repo update
+
+# Remove Helm repository
+remove-helm-repo:
+    helm repo remove hashicorp
+
+
+# Create Vault namespace
+create-namespace:
+    @kubectl get namespace ${K8S_VAULT_NAMESPACE} > /dev/null || kubectl create namespace ${K8S_VAULT_NAMESPACE}
+
+# Delete Vault namespace
+delete-namespace:
+    @kubectl delete namespace ${K8S_VAULT_NAMESPACE} --ignore-not-found
+
+install:
+    #!/bin/bash
+    set -eu
+    just create-namespace
+    just add-helm-repo
+ 
+    gomplate -f vault-values.gomplate.yaml -o vault-values.yaml
+
+    helm upgrade \
+      --cleanup-on-fail \
+      --install \
+      vault \
+      hashicorp/vault \
+      --namespace ${K8S_VAULT_NAMESPACE} \
+      --wait \
+      -f vault-values.yaml
+
+    kubectl wait pod --for=condition=PodReadyToStartContainers \
+        -n ${K8S_VAULT_NAMESPACE} vault-0 --timeout=5m
+
+    # Wait for Vault service to be ready to accept connections
+    echo "Waiting for Vault service to be ready..."
+    for i in {1..30}; do
+        if kubectl exec -n ${K8S_VAULT_NAMESPACE} vault-0 -- \
+            vault status 2>&1 | grep -qE "(Initialized|Sealed)"; then
+            echo "✓ Vault service is ready"
+            break
+        fi
+        if [ $i -eq 30 ]; then
+            echo "Error: Timeout waiting for Vault service to be ready"
+            exit 1
+        fi
+        sleep 3
+    done
+
+    init_output=$(kubectl exec -n ${K8S_VAULT_NAMESPACE} vault-0 -- \
+        vault operator init -key-shares=1 -key-threshold=1 -format=json || true)
+
+    root_token=""
+    if echo "${init_output}" | grep -q "Vault is already initialized"; then
+        echo "Vault is already initialized"
+        while [ -z "${root_token}" ]; do
+            root_token=$(gum input --prompt="Vault root token: " --password --width=100)
+        done
+    else
+        unseal_key=$(echo "${init_output}" | jq -r '.unseal_keys_b64[0]')
+        root_token=$(echo "${init_output}" | jq -r '.root_token')
+        kubectl exec -n ${K8S_VAULT_NAMESPACE} vault-0 -- \
+            vault operator unseal "${unseal_key}"
+        echo "Vault initialized and unsealed successfully"
+        echo "Root Token: ${root_token}"
+        echo "Unseal Key: ${unseal_key}"
+        echo "Please save these credentials securely!"
+    fi
+
+    # Wait for all vault instances to pass readiness checks and be ready to serve requests
+    kubectl wait pod --for=condition=ready -n ${K8S_VAULT_NAMESPACE} \
+        -l app.kubernetes.io/name=vault --timeout=5m
+
+    just setup-kubernetes-auth "${root_token}"
+
+
+# Uninstall Vault
+uninstall delete-ns='false':
+    #!/bin/bash
+    set -euo pipefail
+    helm uninstall vault -n ${K8S_VAULT_NAMESPACE} --ignore-not-found --wait
+    just delete-namespace
+
+
+# Setup Kubernetes authentication
+setup-kubernetes-auth root_token='':
+    #!/bin/bash
+    set -euo pipefail
+    export VAULT_TOKEN="{{ root_token }}"
+    while [ -z "${VAULT_TOKEN}" ]; do
+        VAULT_TOKEN=$(gum input --prompt="Vault root token: " --password --width=100)
+    done
+
+    gomplate -f ./serviceaccount.gomplate.yaml | kubectl apply -n "${K8S_VAULT_NAMESPACE}" -f -
+    gomplate -f ./rolebinding.gomplate.yaml | kubectl apply -n "${K8S_VAULT_NAMESPACE}" -f -
+    kubectl apply -n "${K8S_VAULT_NAMESPACE}" -f ./auth-token-secret.yaml
+
+    SA_SECRET="vault-auth-token"
+    SA_JWT=$(kubectl get secret -n ${K8S_VAULT_NAMESPACE} ${SA_SECRET} -o jsonpath='{.data.token}' | base64 --decode)
+    SA_CA=$(kubectl get secret -n ${K8S_VAULT_NAMESPACE} ${SA_SECRET} -o jsonpath='{.data.ca\.crt}' | base64 --decode)
+
+    vault auth list -format=json | jq -e '.["kubernetes/"]' >/dev/null 2>&1 || \
+        vault auth enable kubernetes
+    
+    vault write auth/kubernetes/config \
+        token_reviewer_jwt="${SA_JWT}" \
+        kubernetes_host="https://kubernetes.default.svc" \
+        kubernetes_ca_cert="${SA_CA}"

08_Vault/rolebinding.gomplate.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vault-auth-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault-auth
+    namespace: {{ .Env.K8S_VAULT_NAMESPACE }}

08_Vault/serviceaccount.gomplate.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault-auth
+  namespace: {{ .Env.K8S_VAULT_NAMESPACE }}

08_Vault/vault-values.gomplate.yaml

@@ -0,0 +1,16 @@
+server:
+  ingress:
+    enabled: true
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    ingressClassName: traefik
+    hosts:
+      - host: {{ .Env.VAULT_HOST }}
+        paths:
+          - /
+    tls:
+      - hosts:
+        - {{ .Env.VAULT_HOST }}
+dataStorage:
+  storageClass: longhorn

08_Vault/vault-values.yaml

@@ -0,0 +1,16 @@
+server:
+  ingress:
+    enabled: true
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    ingressClassName: traefik
+    hosts:
+      - host: vault.test.k8s.schnrbs.work
+        paths:
+          - /
+    tls:
+      - hosts:
+        - vault.test.k8s.schnrbs.work
+dataStorage:
+  storageClass: longhorn

11_storage_tests/foo-pv.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: foo-pv
+spec:
+  storageClassName: "longhorn"
+  claimRef:
+    name: foo-pvc
+    namespace: foo

11_storage_tests/longhorn-pv.yaml

@@ -9,7 +9,7 @@ spec:
   volumeMode: Filesystem
   accessModes:
     - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain  # Optionally, 'Delete' oder 'Recycle'
+  persistentVolumeReclaimPolicy: Delete  # Optionally, 'Delete' oder 'Recycle'
   storageClassName: longhorn  # Verwende den Longhorn-StorageClass-Namen
   csi:
     driver: driver.longhorn.io  # Der Longhorn CSI-Treiber

11_storage_tests/longhorn-with-nginx.yaml

@@ -1,16 +1,42 @@
 apiVersion: v1
+kind: Namespace
+metadata:
+  name: foo
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: longhorn-nginx-pvc
+  namespace: foo
+spec:
+  storageClassName: longhorn  # Die gleiche StorageClass wie im PV
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi  # Die angeforderte Größe sollte mit der des PV übereinstimmen
+#  volumeName: longhorn-test-pv  # Der Name des PV, das für diesen PVC verwendet werden soll
+---
+apiVersion: v1
 kind: Pod
 metadata:
   name: longhorn-demo
-  namespace: default
+  namespace: foo
 spec:
   containers:
     - name: demo-container
       image: nginx:latest
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "250m"
+        limits:
+          memory: "128Mi"
+          cpu: "500m"
       volumeMounts:
         - mountPath: /usr/share/nginx/html
           name: longhorn-volume
   volumes:
     - name: longhorn-volume
       persistentVolumeClaim:
-        claimName: longhorn-test-pvc
+        claimName: longhorn-nginx-pvc

Longhorn/README.md

@@ -167,7 +167,8 @@ Mit diesen Schritten hast du ein Persistent Volume (PV) und einen Persistent Vol
 
 
 ## Disable Localpath as default
+```
 kubectl get storageclass
 
 kubectl patch storageclass local-path -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'
-
+```

Longhorn/auth

@@ -0,0 +1 @@
+basti:$apr1$N23gJpBe$CYlDcwTfp8YsQMq0UcADQ0

Longhorn/justfile

@@ -0,0 +1,67 @@
+set fallback:=true
+
+export LONGHORN_NAMESPACE := env("LONGHORN_NAMESPACE","longhorn-system")
+export LONGHORN_VERSION := env("LONGHORN_VERSION","1.10.1")
+
+add-helm-repo:
+    helm repo add longhorn https://charts.longhorn.io --force-update
+    helm repo update
+
+# Delete namespace
+delete-namespace:
+    #!/bin/bash
+    set -euo pipefail
+    if kubectl get namespace ${LONGHORN_NAMESPACE} &>/dev/null; then
+        kubectl delete namespace ${LONGHORN_NAMESPACE} --ignore-not-found
+    else
+        echo "Namespace ${LONGHORN_NAMESPACE} does not exist."
+    fi
+
+
+install:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    just add-helm-repo
+
+    helm upgrade longhorn longhorn/longhorn \
+      --install \
+      --cleanup-on-fail \
+      --namespace ${LONGHORN_NAMESPACE} \
+      --create-namespace \
+      --version ${LONGHORN_VERSION} \
+      --values longhorn-values.yaml
+
+    # remove default storage class annotation from local-path storage class
+    kubectl patch storageclass local-path -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'
+
+uninstall:
+    #!/bin/bash
+    set -euo pipefail
+
+    for crd in $(kubectl get crd -o name | grep longhorn); do
+        kubectl patch $crd -p '{"metadata":{"finalizers":[]}}' --type=merge
+    done
+
+    kubectl -n ${LONGHORN_NAMESPACE} patch -p '{"value": "true"}' --type=merge lhs deleting-confirmation-flag || true
+
+    helm uninstall longhorn --namespace ${LONGHORN_NAMESPACE} || true
+    just delete-namespace
+
+
+install-dashboard-ingress:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    echo "Deploying Longhorn Dashboard Ingress with EXTERNAL_DOMAIN=${EXTERNAL_DOMAIN}"
+    gomplate -f longhorn-certificate-gomplate.yaml | kubectl apply -f -
+    gomplate -f longhorn-ingressroute-gomplate.yaml | kubectl apply -f -
+
+uninstall-dashboard-ingress:
+    #!/bin/bash
+    set -euo pipefail
+
+    kubectl delete -f longhorn-ingressroute-gomplate.yaml || true
+    kubectl delete -f longhorn-certificate-gomplate.yaml || true

Longhorn/longhorn-certificate-gomplate.yaml

@@ -7,7 +7,7 @@ metadata:
 spec:
   secretName: longhorn-web-ui-tls
   dnsNames:
-    - longhorn-dashboard.k8s.schnrbs.work
+    - longhorn-dashboard.{{.Env.EXTERNAL_DOMAIN}}
   issuerRef:
     name: cloudflare-cluster-issuer
     kind: ClusterIssuer

Longhorn/longhorn-ingressroute-gomplate.yaml

@@ -7,7 +7,7 @@ spec:
   entryPoints:
   - websecure
   routes:
-  - match: Host(`longhorn-dashboard.k8s.schnrbs.work`)
+  - match: Host(`longhorn-dashboard.{{.Env.EXTERNAL_DOMAIN}}`)
     kind: Rule
     services:
     - name: longhorn-frontend

Longhorn/longhorn-values.yaml

@@ -1,18 +1,6 @@
-global:
-  nodeSelector:
-    node.longhorn.io/create-default-disk: "true"
-
-service:
-  ui:
-    type: NodePort
-    nodePort: 30050 
-  manager:
-    type: ClusterIP
 
 # Replica count for the default Longhorn StorageClass.
 persistence:
-  defaultClass: false
-  defaultFsType: ext4
   defaultClassReplicaCount: 2
   reclaimPolicy: Delete
 
@@ -25,12 +13,10 @@ csi:
 
 # Default replica count and storage path
 defaultSettings:
-  upgradeChecker: false
   kubernetesClusterAutoscalerEnabled: false
   allowCollectingLonghornUsageMetrics: false
-  createDefaultDiskLabeledNodes: true
   defaultReplicaCount: 2
-  defaultDataPath: "/k8s-data"
+#  defaultDataPath: "/k8s-data"
 
 longhornUI:
   replicas: 1

Longhorn/pod_with_pvc.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: longhorn-volv-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: volume-test
+  namespace: default
+spec:
+  restartPolicy: Always
+  containers:
+  - name: volume-test
+    image: nginx:stable-alpine
+    imagePullPolicy: IfNotPresent
+    livenessProbe:
+      exec:
+        command:
+          - ls
+          - /data/lost+found
+      initialDelaySeconds: 5
+      periodSeconds: 5
+    volumeMounts:
+    - name: volv
+      mountPath: /data
+    ports:
+    - containerPort: 80
+  volumes:
+  - name: volv
+    persistentVolumeClaim:
+      claimName: longhorn-volv-pvc

Test-Deployment/justfile

@@ -0,0 +1,37 @@
+set fallback:=true
+
+export EXTERNAL := env("EXTERNAL_DOMAIN", "")
+
+install-nginx:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    if [ -z "${EXTERNAL}" ]; then
+        echo "ERROR: EXTERNAL_DOMAIN environment variable is not set."
+        exit 1
+    fi
+
+    kubectl apply -f nginx-deployment.yaml
+    gomplate -f nginx-certificate-gomplate.yaml | kubectl apply -f -
+    gomplate -f nginx-ingress-route-gomplate.yaml | kubectl apply -f -
+
+install-dishes:
+    #!/bin/bash
+    set -euo pipefail
+    just env::check
+
+    if [ -z "${EXTERNAL}" ]; then
+        echo "ERROR: EXTERNAL_DOMAIN environment variable is not set."
+        exit 1
+    fi
+
+    kubectl apply -f dishes-deployment.yaml
+    gomplate -f dishes-certificate-gomplate.yaml | kubectl apply -f -
+    gomplate -f dishes-ingress-route-gomplate.yaml | kubectl apply -f -
+
+remove-nginx:
+    kubectl delete ns test || true
+
+remove-dishes:
+    kubectl delete ns dishes || true

env/env.local.gomplate

@@ -7,3 +7,4 @@ METALLB_ADDRESS_RANGE={{ .Env.METALLB_ADDRESS_RANGE }}
 CLOUDFLARE_API_TOKEN={{ .Env.CLOUDFLARE_API_TOKEN}}
 ACME_EMAIL={{ .Env.ACME_EMAIL}}
 EXTERNAL_DOMAIN={{ .Env.EXTERNAL_DOMAIN }}
+VAULT_HOST={{ .Env.VAULT_HOST }}

env/justfile

@@ -120,6 +120,16 @@ setup:
         fi
     done
     
+    while [ -z "${VAULT_HOST}" ]; do
+        if ! VAULT_HOST=$(
+            gum input --prompt="Vault hostname: " \
+            --width=100 --placeholder="vault"
+        ); then
+            echo "Setup cancelled." >&2
+            exit 1
+        fi
+    done
+
     echo "Generating .env.local file..."    
     rm -f ../.env.local
     gomplate -f env.local.gomplate -o ../.env.local

justfile

@@ -10,3 +10,5 @@ mod env
 mod BasicSetup '01_Basic_Setup'
 mod MetalLbSetup 'Metallb_Setup'
 mod Traefik
+mod Longhorn
+mod Vault '08_Vault'

longhorn/longhorn-ingress.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: longhorn-web-ui
-  namespace: longhorn-system
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  rules:
-    - host: longhorn.k8s.internal.schnrbs.work
-      http:
-        paths: 
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: longhorn-frontend
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - longhorn.k8s.internal.schnrbs.work
-      secretName: longhorn-web-ui-tls
-

mise.toml

@@ -5,3 +5,4 @@ helm = '3.19.0'
 gum = '0.16.2'
 gomplate = '4.3.3'
 just = "1.42.4"
+vault = "1.20.2"