Skip to content

Commit 2424a28

Browse files
alexandref75alexandref75
authored
Add suport for k3s-edge as helm chart (#17)
* Add suport for k3s-edge as helm chart Signed-off-by: Alexandre Peixoto Ferreira <[email protected]> * Make NGINX optional Signed-off-by: Alexandre Peixoto Ferreira <[email protected]> * Add k3s-start.sh script to NGINX Signed-off-by: Alexandre Peixoto Ferreira <[email protected]> * Adding documentation of smarter-k3s-edge Signed-off-by: Alexandre Peixoto Ferreira <[email protected]> Signed-off-by: Alexandre Peixoto Ferreira <[email protected]>
1 parent 77599d7 commit 2424a28

File tree

9 files changed

+374
-5
lines changed

9 files changed

+374
-5
lines changed

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
## This demo makes the following assumptions about your environment
55

66
In this guide we assume you have done the following:
7-
- You should have a cloud-based k3s server dedicated for edge deployment (we will refer to this as k3s-edge-server) before proceeding any further
8-
- if you don't have a k3s-edge-server, you can follow [these instructions](./k3s-edge-server.md)
9-
- You should also have an installed InfluxDB and Grafana instance in a separate kubernetes cluster
7+
- You should have an installed InfluxDB and Grafana instance in a separate kubernetes cluster (cloud or local).
108
- these may be installed on a second cloud node, with its own k3s server, we will refer to this as the cloud-data-node
119
- if you don't have a cloud-data-node, you can follow [these instructions](./k3s-cloud-server.md)
10+
- You should have a cloud-based k3s server dedicated for edge deployment (we will refer to this as k3s-edge-server) before proceeding any further
11+
- if you don't have a k3s-edge-server, you can follow [these instructions](./k3s-edge-server.md)
1212
- You will also need an installed k3s edge node which has already been setup to talk to k3s-edge-server
1313
- instructions for registering a node running a **64 bit kernel and user space** are available [here](./k3s-edge-server.md#Joining a k3s edge node to the cluster)
1414

‎charts/smarter-k3s-edge/Chart.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: v2
2+
name: smarter-k3s-edge
3+
version: 0.0.1
4+
appVersion: v1.25.3-k3s1
5+
description: K3s server on kubernetes
6+
home: https://k3s.io/
7+
icon: https://k3s.io/img/k3s-logo-light.svg
8+
keywords:
9+
- k3s
10+
- edge
11+
annotations:
12+
artifacthub.io/license: Apache-2.0
13+
artifacthub.io/maintainers: |
14+
- name: Alexandre Ferreira
15+
email: [email protected]
16+
artifacthub.io/prerelease: "false"
17+
artifacthub.io/signKey: |
18+
fingerprint: 71EDA4E3D652DC73EB09E3A5387D298C169CF24E
19+
url: https://smarter-project.github.io/documentation/pgp_keys.asc

‎charts/smarter-k3s-edge/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# k3s edge helm chart
2+
3+
[k3s](https://k3s.io) is a lightweight kubernetes
4+

‎charts/smarter-k3s-edge/ci/ci-values.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
logLevel: debug

‎charts/smarter-k3s-edge/default.conf‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
user root root;
2+
3+
worker_processes auto;
4+
5+
error_log /var/log/nginx/error.log notice;
6+
pid /var/run/nginx.pid;
7+
8+
events {
9+
worker_connections 1024;
10+
}
11+
12+
13+
http {
14+
include /etc/nginx/mime.types;
15+
default_type application/octet-stream;
16+
17+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
18+
'$status $body_bytes_sent "$http_referer" '
19+
'"$http_user_agent" "$http_x_forwarded_for"';
20+
21+
access_log /var/log/nginx/access.log main;
22+
23+
sendfile on;
24+
#tcp_nopush on;
25+
26+
keepalive_timeout 65;
27+
28+
#gzip on;
29+
30+
server {
31+
listen 80 default_server;
32+
listen [::]:80 default_server;
33+
server_name server_domain_or_IP;
34+
return 302 https://$server_name$request_uri;
35+
}
36+
server {
37+
disable_symlinks off;
38+
# SSL configuration
39+
listen 443 ssl http2 default_server;
40+
listen [::]:443 ssl http2 default_server;
41+
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
42+
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
43+
# from https://cipherli.st/
44+
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
45+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
46+
ssl_prefer_server_ciphers on;
47+
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
48+
ssl_ecdh_curve secp384r1;
49+
ssl_session_cache shared:SSL:10m;
50+
ssl_session_tickets off;
51+
ssl_stapling on;
52+
ssl_stapling_verify on;
53+
resolver 8.8.8.8 8.8.4.4 valid=300s;
54+
resolver_timeout 5s;
55+
# Disable preloading HSTS for now. You can use the commented out header line that includes
56+
# the "preload" directive if you understand the implications.
57+
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
58+
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
59+
add_header X-Frame-Options DENY;
60+
add_header X-Content-Type-Options nosniff;
61+
ssl_dhparam /etc/ssl/certs/dhparam.pem;
62+
root /var/www/html;
63+
server_name _;
64+
location / {
65+
# First attempt to serve request as file, then
66+
# as directory, then fall back to displaying a 404.
67+
try_files $uri $uri/ =404;
68+
# proxy_pass http://localhost:8080;
69+
# proxy_http_version 1.1;
70+
# proxy_set_header Upgrade $http_upgrade;
71+
# proxy_set_header Connection 'upgrade';
72+
# proxy_set_header Host $host;
73+
# proxy_cache_bypass $http_upgrade;
74+
}
75+
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
76+
#
77+
#location ~ \.php$ {
78+
# include snippets/fastcgi-php.conf;
79+
#
80+
# # With php7.0-cgi alone:
81+
# fastcgi_pass 127.0.0.1:9000;
82+
# # With php7.0-fpm:
83+
# fastcgi_pass unix:/run/php/php7.0-fpm.sock;
84+
#}
85+
# deny access to .htaccess files, if Apache's document root
86+
# concurs with nginx's one
87+
#
88+
#location ~ /\.ht {
89+
# deny all;
90+
#}
91+
}
92+
}

‎charts/smarter-k3s-edge/templates/common.yaml‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
{{- if .Values.configuration.portHTTPS }}
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: {{ .Values.application.appName }}-data
6+
spec:
7+
accessModes:
8+
- ReadWriteOnce
9+
storageClassName: local-path
10+
resources:
11+
requests:
12+
storage: 2Gi
13+
---
14+
apiVersion: v1
15+
kind: ConfigMap
16+
metadata:
17+
name: {{ .Values.application.appName }}
18+
data:
19+
default.conf: |
20+
user root root;
21+
22+
worker_processes auto;
23+
24+
error_log /var/log/nginx/error.log notice;
25+
pid /var/run/nginx.pid;
26+
27+
events {
28+
worker_connections 1024;
29+
}
30+
31+
32+
http {
33+
include /etc/nginx/mime.types;
34+
default_type application/octet-stream;
35+
36+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
37+
'$status $body_bytes_sent "$http_referer" '
38+
'"$http_user_agent" "$http_x_forwarded_for"';
39+
40+
access_log /var/log/nginx/access.log main;
41+
42+
sendfile on;
43+
#tcp_nopush on;
44+
45+
keepalive_timeout 65;
46+
47+
#gzip on;
48+
49+
server {
50+
listen 80 default_server;
51+
listen [::]:80 default_server;
52+
server_name server_domain_or_IP;
53+
return 302 https://$server_name$request_uri;
54+
}
55+
server {
56+
disable_symlinks off;
57+
# SSL configuration
58+
listen {{ .Values.configuration.portHTTPS }} ssl http2 default_server;
59+
listen [::]:{{ .Values.configuration.portHTTPS }} ssl http2 default_server;
60+
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
61+
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
62+
# from https://cipherli.st/
63+
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
64+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
65+
ssl_prefer_server_ciphers on;
66+
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
67+
ssl_ecdh_curve secp384r1;
68+
ssl_session_cache shared:SSL:10m;
69+
ssl_session_tickets off;
70+
ssl_stapling on;
71+
ssl_stapling_verify on;
72+
resolver 8.8.8.8 8.8.4.4 valid=300s;
73+
resolver_timeout 5s;
74+
# Disable preloading HSTS for now. You can use the commented out header line that includes
75+
# the "preload" directive if you understand the implications.
76+
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
77+
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
78+
add_header X-Frame-Options DENY;
79+
add_header X-Content-Type-Options nosniff;
80+
ssl_dhparam /etc/ssl/certs/dhparam.pem;
81+
root /var/www/html;
82+
server_name _;
83+
location / {
84+
# First attempt to serve request as file, then
85+
# as directory, then fall back to displaying a 404.
86+
try_files $uri $uri/ =404;
87+
# proxy_pass http://localhost:8080;
88+
# proxy_http_version 1.1;
89+
# proxy_set_header Upgrade $http_upgrade;
90+
# proxy_set_header Connection 'upgrade';
91+
# proxy_set_header Host $host;
92+
# proxy_cache_bypass $http_upgrade;
93+
}
94+
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
95+
#
96+
#location ~ \.php$ {
97+
# include snippets/fastcgi-php.conf;
98+
#
99+
# # With php7.0-cgi alone:
100+
# fastcgi_pass 127.0.0.1:9000;
101+
# # With php7.0-fpm:
102+
# fastcgi_pass unix:/run/php/php7.0-fpm.sock;
103+
#}
104+
# deny access to .htaccess files, if Apache's document root
105+
# concurs with nginx's one
106+
#
107+
#location ~ /\.ht {
108+
# deny all;
109+
#}
110+
}
111+
}
112+
k3s-start.sh: |
113+
#!/bin/bash
114+
#
115+
curl -sflkO https://{{ default .Values.configuration.hostIP .Values.configuration.externalHostIP}}:{{ .Values.configuration.portHTTPS }}/token.{{ .Values.configuration.id }}
116+
curl -sflkO https://{{ default .Values.configuration.hostIP .Values.configuration.externalHostIP}}:{{ .Values.configuration.portHTTPS }}/k3s.yaml.{{ .Values.configuration.id }}
117+
export INSTALL_K3S_VERSION=$(echo "{{ default .Chart.AppVersion .Values.image.tag }}" | sed -e "s/-k3/+k3/")
118+
export K3S_TOKEN=$(cat token.{{ .Values.configuration.id }})
119+
export K3S_URL=$(grep server: k3s.yaml.{{ .Values.configuration.id }} | sed -e "s/^ *.server: *//")
120+
121+
curl -sfL https://get.k3s.io | \\
122+
sh -s - \\
123+
--kubelet-arg cluster-dns=169.254.0.2 \\
124+
--log /var/log/k3s.log \\
125+
--node-label smarter.nodetype=unknown \\
126+
--node-label smarter.nodemodel=unknown \\
127+
--node-label smarter.type=edge \\
128+
--node-taint smarter.type=edge:NoSchedule \\
129+
--node-label smarter-build=user-installed
130+
---
131+
{{- end }}
132+
apiVersion: apps/v1
133+
kind: Deployment
134+
metadata:
135+
name: {{ .Values.application.appName }}
136+
labels:
137+
name: {{ .Values.application.appName }}
138+
spec:
139+
selector:
140+
matchLabels:
141+
name: {{ .Values.application.appName }}
142+
template:
143+
metadata:
144+
labels:
145+
name: {{ .Values.application.appName }}
146+
annotations:
147+
node.kubernetes.io/bootstrap-checkpoint: "true"
148+
spec:
149+
containers:
150+
- name: {{ .Values.application.appName }}
151+
image: {{ .Values.image.repository }}:{{ default .Chart.AppVersion .Values.image.tag }}
152+
command: [ "/bin/k3s",
153+
"server",
154+
"--tls-san","{{ .Values.configuration.hostip }}",
155+
"--advertise-address", "{{ default .Values.configuration.hostIP .Values.configuration.externalHostIP}}",
156+
"--https-listen-port", "{{ .Values.configuration.port }}",
157+
"--disable-agent",
158+
"--disable","traefik",
159+
"--disable","metrics-server",
160+
"--disable","coredns",
161+
"--disable","local-storage",
162+
"--flannel-backend=none" ]
163+
{{- if .Values.configuration.portHTTPS }}
164+
volumeMounts:
165+
- name: k3s-data
166+
mountPath: /var/lib/rancher/k3s
167+
- name: k3s-config
168+
mountPath: /etc/rancher/k3s
169+
{{- end }}
170+
ports:
171+
- containerPort: {{ .Values.configuration.port }}
172+
{{- if .Values.configuration.portHTTPS }}
173+
- name: {{ .Values.application.appName }}-nginx
174+
image: nginx:1.23.2-alpine
175+
command: [ "/bin/sh",
176+
"-c",
177+
"apk update;apk add openssl;echo -e '\n\n\n\n\n\n\n' | openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt;openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048;mkdir -p /var/www/html;ln -s /etc/rancher/k3s/k3s.yaml /var/www/html/k3s.yaml.{{ .Values.configuration.id }};ln -s /var/lib/rancher/k3s/server/token /var/www/html/token.{{ .Values.configuration.id }};ln -s /etc/nginx/conf.d/k3s-start.sh /var/www/html/k3s-start.sh.{{ .Values.configuration.id }};chmod -R ago+rw /var/www/html;nginx -c /etc/nginx/conf.d/default.conf -g 'daemon off;'" ]
178+
volumeMounts:
179+
- name: k3s-data
180+
mountPath: /var/lib/rancher/k3s
181+
- name: k3s-config
182+
mountPath: /etc/rancher/k3s
183+
- name: config
184+
mountPath: /etc/nginx/conf.d
185+
ports:
186+
- containerPort: {{ .Values.configuration.portHTTPS }}
187+
{{- end }}
188+
volumes:
189+
{{- if .Values.configuration.portHTTPS }}
190+
- name: k3s-data
191+
persistentVolumeClaim:
192+
claimName: {{ .Values.application.appName }}-data
193+
- name: k3s-config
194+
emptyDir: {}
195+
- name: config
196+
configMap:
197+
name: {{ .Values.application.appName }}
198+
{{- end }}

‎charts/smarter-k3s-edge/templates/service.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Values.application.appName }}
5+
labels:
6+
name: {{ .Values.application.appName }}
7+
spec:
8+
selector:
9+
name: {{ .Values.application.appName }}
10+
ports:
11+
- protocol: TCP
12+
port: {{ .Values.configuration.port }}
13+
name: {{ .Values.application.appName }}
14+
{{- if .Values.configuration.portHTTPS }}
15+
- protocol: TCP
16+
port: {{ .Values.configuration.portHTTPS }}
17+
name: {{ .Values.application.appName }}-https
18+
{{- end }}
19+
externalIPs:
20+
- {{ .Values.configuration.hostIP }}

‎charts/smarter-k3s-edge/values.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#
2+
3+
application:
4+
appName: smarter-k3s-server
5+
6+
image:
7+
repository: rancher/k3s
8+
# @default -- chart.appVersion
9+
tag: ""
10+
pullPolicy: IfNotPresent
11+
12+
configuration:
13+
hostIP: 192.168.2.222
14+
# Use this in case of NATed AWS
15+
#externalHostIP: 192.168.2.222
16+
port: 6443
17+
# Comment to remove NGINX
18+
portHTTPS: 6453
19+
# set id to paqssword

0 commit comments

Comments
 (0)