Skip to content

Commit 57dcb5d

Browse files
Pythoner6Pythoner6
committed
Build individual image per app, factor out common cue logic
1 parent d4af4ec commit 57dcb5d

File tree

15 files changed

+688
-356
lines changed

15 files changed

+688
-356
lines changed

‎.github/workflows/demo.yaml

+9-1
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
uses: cachix/install-nix-action@v23
1717
with:
1818
nix_path: nixpkgs=channel:nixos-23.11
19+
- name: Nix Cache
20+
uses: DeterminateSystems/magic-nix-cache-action@main
1921
- name: Build manifests
2022
run: nix build .#ociImages
2123
- name: Push to registry
@@ -34,4 +36,10 @@ jobs:
3436
for chart in "${charts[@]}"; do
3537
skopeo copy --dest-tls-verify "oci:$chart" "docker://$BASE_URL/charts/$(get_chart_name "$chart"):$(get_chart_version "$chart")"
3638
done
37-
skopeo copy --dest-tls-verify oci:result/apps "docker://$BASE_URL/netserv"
39+
readarray -t apps <<< "$(find result/apps -maxdepth 1 -mindepth 1 -type d)"
40+
for app in "${apps[@]}"; do
41+
if [[ "$app" != "root" ]]; then
42+
skopeo copy --dest-tls-verify "oci:$app" "docker://$BASE_URL/netserv/$(get_chart_name "$app")"
43+
fi
44+
done
45+
skopeo copy --dest-tls-verify "oci:result/apps/root" "docker://$BASE_URL/netserv/$(get_chart_name "result/apps/root")"

‎cue.mod/pkg/pythoner6.dev/c8s/c8s.cue

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
package c8s
2+
3+
import (
4+
"encoding/yaml"
5+
6+
corev1 "k8s.io/api/core/v1"
7+
helmrepository "source.toolkit.fluxcd.io/helmrepository/v1beta2"
8+
ocirepository "source.toolkit.fluxcd.io/ocirepository/v1beta2"
9+
kustomizationv1 "kustomize.toolkit.fluxcd.io/kustomization/v1"
10+
)
11+
12+
13+
#Ref: {
14+
#obj: {
15+
apiVersion: string
16+
kind: string
17+
metadata: {
18+
name: string
19+
namespace?: string
20+
...
21+
}
22+
...
23+
}
24+
apiVersion: #obj.apiVersion
25+
kind: #obj.kind
26+
if #obj.metadata.namespace != _|_ {
27+
namespace: #obj.metadata.namespace
28+
}
29+
name: #obj.metadata.name
30+
}
31+
32+
#DepRef: {
33+
#obj: {
34+
metadata: {
35+
name: string
36+
namespace?: string
37+
...
38+
}
39+
...
40+
}
41+
if #obj.metadata.namespace != _|_ {
42+
namespace: #obj.metadata.namespace
43+
}
44+
name: #obj.metadata.name
45+
}
46+
47+
ChartsDef=#Charts: {
48+
#in: string
49+
#repo: #Ref.#obj
50+
for name, tag in yaml.Unmarshal(#in) & {[_]: string} {
51+
(name): {
52+
chart: name
53+
version: tag
54+
sourceRef: #Ref & {#obj: #repo}
55+
}
56+
}
57+
}
58+
59+
#Namespace: corev1.#Namespace & {
60+
#name: string
61+
metadata: name: #name
62+
}
63+
64+
#Resources: this={
65+
#namespace: #Namespace
66+
#asList: [for _, resource in this {resource}]
67+
[Name=!~"^[_#]"]: {
68+
metadata: {
69+
namespace: string | *#namespace.metadata.name
70+
name: string | *Name
71+
...
72+
}
73+
...
74+
}
75+
}
76+
77+
#Kustomization: {
78+
_#appName: string
79+
#fullName: [if #name == "$default" {_#appName}, "\(_#appName)-\(#name)"][0]
80+
#name: string
81+
#namespace: #Namespace
82+
#defaultResourceNamespace: #Namespace
83+
#dependsOn: [...#Kustomization]
84+
[!~"^[_#]"]: #Resources & {#namespace: _ | *#defaultResourceNamespace}
85+
}
86+
87+
#Kustomizations: this={
88+
#appName: string
89+
#defaultKustomizationNamespace: #Namespace
90+
#defaultResourceNamepsace: #Namespace
91+
[Name=!~"^[_#]"]: #Kustomization & {
92+
_#appName: #appName
93+
#name: _ | *Name
94+
#namespace: _ | *#defaultKustomizationNamespace
95+
#defaultResourceNamespace: this.#defaultResourceNamespace
96+
}
97+
}
98+
99+
100+
#FluxResources: #Resources & {
101+
#namespace: #Namespace
102+
#kustomizations: #Kustomizations
103+
#repo: string
104+
#appName: string
105+
#digests: { [string]: string }
106+
for kname, kustomization in #kustomizations {
107+
repo="repository:\(kname)": ocirepository.#OCIRepository & {
108+
metadata: {
109+
"name": kustomization.#fullName
110+
namespace: kustomization.#namespace.metadata.name
111+
}
112+
spec: {
113+
url: "oci://\(#repo)/\(metadata.name)"
114+
interval: string | *"24h"
115+
}
116+
}
117+
"kustomization:\(kname)": kustomizationv1.#Kustomization & {
118+
metadata: {
119+
"name": kustomization.#fullName
120+
namespace: kustomization.#namespace.metadata.name
121+
}
122+
spec: {
123+
path: "./"
124+
interval: _ | *"10m0s"
125+
prune: _ | *true
126+
sourceRef: #Ref & {#obj: repo}
127+
dependsOn: [for dep in kustomization.#dependsOn {name: dep.#fullName, namespace: dep.#namespace.metadata.name}]
128+
wait: _ | *true
129+
}
130+
}
131+
}
132+
}
133+
134+
#Default: this={
135+
#appName: string
136+
#defaultKustomizationNamespace: #Namespace
137+
#defaultResourceNamespace: #Namespace
138+
#repo: string
139+
#charts: string
140+
#chartsRepo: helmrepository.#HelmRepository
141+
142+
#Charts: ChartsDef & {
143+
#in: #charts
144+
#repo: #chartsRepo
145+
}
146+
147+
kustomizations: #Kustomizations & {
148+
#appName: this.#appName
149+
#defaultKustomizationNamespace: this.#defaultKustomizationNamespace
150+
#defaultResourceNamespace: this.#defaultResourceNamespace
151+
}
152+
153+
#fluxResources: #FluxResources & {
154+
#repo: this.#repo
155+
#kustomizations: kustomizations
156+
#appName: this.#appName
157+
#namespace: #defaultKustomizationNamespace
158+
}
159+
}

‎flake.nix

+5-15
Original file line numberDiff line numberDiff line change
@@ -104,29 +104,19 @@
104104
default = manifests;
105105
manifests = cue.synth {
106106
name = "netserv";
107-
#src = ./.;
108-
#src = let x = lib.sources.sourceByRegex ./. [
109-
# #''^k8s/.*\.cue$''
110-
# #''^cue.mod/.*\.cue$''
111-
# #''^[^/]*\.cue$''
112-
# ''^.*\.cue$''
113-
# ''^k8s$''
114-
#]; in builtins.trace x x;
115-
#src = lib.cleanSourceWith {
116-
# filter = path: type: if type == "directory" then true else ;
117-
# src = ./.;
118-
#};
119-
src = lib.sources.sourceFilesBySuffices ./. [".cue"];
107+
#src = lib.sources.sourceFilesBySuffices ./. [".cue"];
108+
src = ./.;
120109
appsSubdir = "k8s";
110+
rootAppName = "root";
121111
inherit charts;
122112
extraDefinitions = [
123113
(cue.fromCrds "flux-crds" flux-manifests)
124114
(cue.fromCrds "cilium-crds" cilium-crds)
125115
(cue.fromCrds "gateway-crds" gateway-crds)
126116
];
127117
extraManifests = {
128-
flux-components."flux-components.yaml" = flux-manifests;
129-
cilium."crds.yaml" = gateway-crds;
118+
flux.components."flux-components.yaml" = flux-manifests;
119+
cilium.gateway-crds."crds.yaml" = gateway-crds;
130120
};
131121
};
132122
ociImages = cue.images {

‎k8s/cert-manager/cert-manager.cue

+10-13
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,19 @@ import (
88
appName: "cert-manager"
99

1010
kustomizations: {
11-
helm: "manifest.yaml": {
12-
clusterResources: ns: #AppNamespace
13-
resources: {
14-
(appName): helmrelease.#HelmRelease & {
15-
spec: {
16-
chart: spec: #Charts[appName]
17-
interval: "10m0s"
18-
values: installCRDs: true
19-
}
11+
helm: "release": {
12+
ns: #AppNamespace
13+
(appName): helmrelease.#HelmRelease & {
14+
spec: {
15+
chart: spec: #Charts[appName]
16+
interval: "10m0s"
17+
values: installCRDs: true
2018
}
2119
}
2220
}
23-
$default: _dependsOn: [helm]
24-
$default: "issuers.yaml": {
25-
namespace: #AppNamespace
26-
clusterResources: "self-signed": clusterissuer.#ClusterIssuer & {
21+
$default: #dependsOn: [helm]
22+
$default: "issuers": {
23+
"self-signed": clusterissuer.#ClusterIssuer & {
2724
spec: selfSigned: {}
2825
}
2926
}

‎k8s/cilium/cilium.cue

+61-67
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
package netserv
22

33
import (
4-
"encoding/yaml"
4+
//"encoding/yaml"
55

66
helmrelease "helm.toolkit.fluxcd.io/helmrelease/v2beta2"
77
bgppolicy "cilium.io/ciliumbgppeeringpolicy/v2alpha1"
@@ -10,79 +10,73 @@ import (
1010

1111
appName: "cilium"
1212

13-
kustomizations: "gateway-crds": {
14-
_extraManifests: yaml.Unmarshal(extraManifests)
15-
}
13+
kustomizations: "gateway-crds": {}
1614

17-
kustomizations: helm: _dependsOn: [kustomizations."gateway-crds"]
18-
kustomizations: helm: "manifest.yaml": {
19-
resources: {
20-
(appName): helmrelease.#HelmRelease & {
21-
metadata: namespace: "kube-system"
22-
spec: {
23-
chart: spec: #Charts[appName]
24-
interval: "10m0s"
25-
values: {
26-
bgpControlPlane: enabled: true
27-
hubble: {
28-
tls: auto: method: "cronJob"
29-
relay: enabled: true
30-
ui: enabled: true
31-
}
32-
clustermesh: apiserver: tls: auto: method: "cronJob"
33-
ipam: mode: "kubernetes"
34-
kubeProxyReplacement: true
35-
l7Proxy: true
36-
gatewayAPI: enabled: true
37-
rolloutCiliumPods: true
38-
operator: {
39-
rolloutPods: true
40-
}
41-
ingressController: enabled: false
15+
kustomizations: helm: #dependsOn: [kustomizations."gateway-crds"]
16+
kustomizations: helm: "release": {
17+
(appName): helmrelease.#HelmRelease & {
18+
metadata: namespace: "kube-system"
19+
spec: {
20+
chart: spec: #Charts[appName]
21+
interval: "10m0s"
22+
values: {
23+
bgpControlPlane: enabled: true
24+
hubble: {
25+
tls: auto: method: "cronJob"
26+
relay: enabled: true
27+
ui: enabled: true
28+
}
29+
clustermesh: apiserver: tls: auto: method: "cronJob"
30+
ipam: mode: "kubernetes"
31+
kubeProxyReplacement: true
32+
l7Proxy: true
33+
gatewayAPI: enabled: true
34+
rolloutCiliumPods: true
35+
operator: {
36+
rolloutPods: true
37+
}
38+
ingressController: enabled: false
4239

43-
// Required for Talos
44-
securityContext: capabilities: {
45-
ciliumAgent: ["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID"]
46-
cleanCiliumState: ["NET_ADMIN","SYS_ADMIN","SYS_RESOURCE"]
47-
}
48-
cgroup: {
49-
autoMount: enabled: false
50-
hostRoot: "/sys/fs/cgroup"
51-
}
52-
// Use Talos' kubeprism endpoint
53-
k8sServiceHost: "localhost"
54-
k8sServicePort: 7445
40+
// Required for Talos
41+
securityContext: capabilities: {
42+
ciliumAgent: ["CHOWN","KILL","NET_ADMIN","NET_RAW","IPC_LOCK","SYS_ADMIN","SYS_RESOURCE","DAC_OVERRIDE","FOWNER","SETGID","SETUID"]
43+
cleanCiliumState: ["NET_ADMIN","SYS_ADMIN","SYS_RESOURCE"]
44+
}
45+
cgroup: {
46+
autoMount: enabled: false
47+
hostRoot: "/sys/fs/cgroup"
5548
}
49+
// Use Talos' kubeprism endpoint
50+
k8sServiceHost: "localhost"
51+
k8sServicePort: 7445
5652
}
5753
}
5854
}
5955
}
6056

61-
kustomizations: bgp: _dependsOn: [kustomizations.helm]
62-
kustomizations: bgp: "manifest.yaml": {
63-
clusterResources: {
64-
"default-pool": ippool.#CiliumLoadBalancerIPPool & {
65-
spec: blocks: [{cidr: "10.16.3.0/24"}]
66-
}
67-
default: bgppolicy.#CiliumBGPPeeringPolicy & { spec: {
68-
nodeSelector: matchLabels: #DefaultBGPPolicyLabels
69-
virtualRouters: [{
70-
localASN: 64514
71-
exportPodCIDR: false
72-
serviceSelector: matchExpressions: [{key: "bgp", operator: "NotIn", values: ["disabled"]}]
73-
neighbors: [{
74-
peerAddress: "10.16.2.2/32"
75-
peerASN: 64512
76-
eBGPMultihopTTL: 10
77-
connectRetryTimeSeconds: 120
78-
holdTimeSeconds: 90
79-
keepAliveTimeSeconds: 30
80-
gracefulRestart: {
81-
enabled: true
82-
restartTimeSeconds: 120
83-
}
84-
}]
85-
}]
86-
}}
57+
kustomizations: bgp: #dependsOn: [kustomizations.helm]
58+
kustomizations: bgp: "manifest": {
59+
"default-pool": ippool.#CiliumLoadBalancerIPPool & {
60+
spec: blocks: [{cidr: "10.16.3.0/24"}]
8761
}
62+
default: bgppolicy.#CiliumBGPPeeringPolicy & { spec: {
63+
nodeSelector: matchLabels: #DefaultBGPPolicyLabels
64+
virtualRouters: [{
65+
localASN: 64514
66+
exportPodCIDR: false
67+
serviceSelector: matchExpressions: [{key: "bgp", operator: "NotIn", values: ["disabled"]}]
68+
neighbors: [{
69+
peerAddress: "10.16.2.2/32"
70+
peerASN: 64512
71+
eBGPMultihopTTL: 10
72+
connectRetryTimeSeconds: 120
73+
holdTimeSeconds: 90
74+
keepAliveTimeSeconds: 30
75+
gracefulRestart: {
76+
enabled: true
77+
restartTimeSeconds: 120
78+
}
79+
}]
80+
}]
81+
}}
8882
}

0 commit comments

Comments
 (0)