Adds Checkmk, partially

.github/workflows/tofu-k3s-k1.yml

@@ -37,6 +37,7 @@ jobs:
           # Tailscale OAuth Client Keys
           TF_VAR_tailscale_client_id: op://aws-svcs/knwzgjajqmorvfhvlyjpve5zle/clientId
           TF_VAR_tailscale_client_secret: op://aws-svcs/knwzgjajqmorvfhvlyjpve5zle/clientSecret
+          TF_VAR_tailnet: op://aws-svcs/7f67qgmdvqjl6qghuccxswbham/tailnet
           # Cloudflare API Token
           TF_VAR_cloudflare_api_token: op://aws-svcs/ozxn4ucjnnymr3bnbs6oonpmke/token
           # Longhorn CIFS username/password

cloudflare/zone_aws/dns_aws.tf → cloud/dns_aws.tf

@@ -2,15 +2,15 @@
 locals {
   dns_entries = {
     k1 = {
-      ipv4   = var.aws_chicago_ipv4
-      cnames = ["", "actual", "ha", "homepage", "karakeep", "a1"]
+      ipv4 = var.aws_chicago_ipv4
+      cnames = ["", "actual", "ha", "homepage", "karakeep", "a1", "checkmk"]
     }
     auth = {
-      ipv4   = var.authentik_ipv4
+      ipv4 = var.authentik_ipv4
       cnames = ["authentik"]
     }
     overwatch = {
-      ipv4   = var.overwatch_ipv4
+      ipv4 = var.overwatch_ipv4
       cnames = ["whoami.overwatch", "status", "uptime", "id", "lldap"]
     }
   }
@@ -28,7 +28,7 @@ locals {
           cname  = cname
         }
       ]
-      ]) : triple.key => {
+    ]) : triple.key => {
       domain = triple.domain
       cname  = triple.cname
     }

cloudflare/zone_aws/provider.tf → cloud/provider.tf

@@ -3,9 +3,9 @@ terraform {
     access_key = var.b2_access_key_id
     secret_key = var.b2_secret_access_key
 
-    bucket   = "gh-aws-infra"
-    key      = "cloudlfare/zone_aws/terraform.state"
-    region   = "us-west-004"
+    bucket = "gh-aws-infra"
+    key    = "cloud/terraform.state"
+    region = "us-west-004"
     endpoint = "s3.us-west-004.backblazeb2.com"
 
     # necessary settings to make s3 backend work with b2
@@ -20,6 +20,10 @@ terraform {
       source  = "cloudflare/cloudflare"
       version = "~> 5"
     }
+    hcloud = {
+      source  = "hetznercloud/hcloud"
+      version = "~> 1.45"
+    }
   }
 }
 
@@ -31,10 +35,6 @@ variable "zone_id" {
   default = "6dfb9abb8a292cebb7a9be4944886e29"
 }
 
-variable "account_id" {
-  default = "aad57bf06f66f299d32f1323117f8a19"
-}
-
 variable "domain" {
   default = "andywebservices.com"
 }

k3s/k1/actual.tf

@@ -8,6 +8,10 @@ resource "kubernetes_persistent_volume_claim" "actual" {
   metadata {
     name      = "actual-data-pvc"
     namespace = kubernetes_namespace.actual.metadata[0].name
+    labels = {
+      "recurring-job-group.longhorn.io/default" = "enabled"
+      "recurring-job.longhorn.io/c-svue5v"      = "enabled"
+    }
   }
   spec {
     access_modes = ["ReadWriteOnce"]

k3s/k1/checkmk-agent.tf

@@ -0,0 +1,14 @@
+resource "kubernetes_namespace" "checkmk_agent" {
+  metadata {
+    name = "checkmk-agent"
+  }
+}
+
+resource "helm_release" "checkmk_agent" {
+  name       = "checkmk-agent-chart"
+  namespace  = kubernetes_namespace.checkmk_agent.metadata[0].name
+  chart      = "checkmk"
+  repository = "https://checkmk.github.io/checkmk_kube_agent"
+  values = [file("./config/checkmk-agent/helm-values.yaml")]
+}
+

k3s/k1/checkmk-dummy.tf

@@ -0,0 +1,103 @@
+resource "kubernetes_namespace" "checkmk_dummy" {
+  metadata {
+    name = "checkmk-dummy"
+  }
+  depends_on = [kubernetes_manifest.cloudflare_clusterissuer]
+}
+
+resource "kubernetes_manifest" "checkmk_dummy_certificate" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "checkmk-dummy-ingressroute-certificate"
+      namespace = kubernetes_namespace.checkmk_dummy.metadata[0].name
+    }
+    spec = {
+      secretName = "checkmk-dummy-certificate-secret"
+      issuerRef = {
+        name = kubernetes_manifest.cloudflare_clusterissuer.manifest.metadata.name
+        kind = "ClusterIssuer"
+      }
+      dnsNames = [
+        "checkmk.andywebservices.com"
+      ]
+    }
+  }
+  depends_on = [kubernetes_namespace.checkmk_dummy]
+}
+
+resource "kubernetes_manifest" "checkmk_dummy_service" {
+  manifest = {
+    apiVersion = "v1"
+    kind       = "Service"
+    metadata = {
+      name      = "checkmk"
+      namespace = kubernetes_namespace.checkmk_dummy.metadata[0].name
+    }
+    spec = {
+      ports = [
+        {
+          port        = 8080
+          target_port = 8080
+        }
+      ]
+      clusterIP = "None" # Headless service
+    }
+  }
+  depends_on = [kubernetes_namespace.checkmk_dummy]
+}
+
+resource "kubernetes_manifest" "checkmk_dummy_ingressroute" {
+  manifest = {
+    apiVersion = "traefik.io/v1alpha1"
+    kind       = "IngressRoute"
+    metadata = {
+      name      = "checkmk-dummy-ingressroute"
+      namespace = kubernetes_namespace.checkmk_dummy.metadata[0].name
+    }
+    spec = {
+      entryPoints = ["websecure"]
+      routes = [
+        {
+          match = "Host(`checkmk.andywebservices.com`)"
+          kind  = "Rule"
+          services = [
+            {
+              name = "checkmk"
+              port = 8080
+            }
+          ]
+        }
+      ]
+      tls = {
+        secretName = kubernetes_manifest.checkmk_dummy_certificate.manifest.spec.secretName
+      }
+    }
+  }
+}
+
+resource "kubernetes_manifest" "checkmk_dummy_endpoints" {
+  manifest = {
+    apiVersion = "v1"
+    kind       = "Endpoints"
+    metadata = {
+      name      = "checkmk"
+      namespace = kubernetes_namespace.checkmk_dummy.metadata[0].name
+    }
+    subsets = [
+      {
+        addresses = [
+          {
+            ip = "192.168.0.44"
+          }
+        ]
+        ports = [
+          {
+            port = "8080"
+          }
+        ]
+      }
+    ]
+  }
+}

k3s/k1/config/checkmk-agent/helm-values.yaml

@@ -0,0 +1,36 @@
+ingress:
+  enabled: true
+  className: ""
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+  hosts:
+    - host: checkmk-agent.andywebservices.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName = "checkmk-agent-certificate-secret"
+
+tlsCommunication:
+  enabled: false
+  verifySsl: false
+
+## Configuration for cluster-collector
+clusterCollector:
+  image:
+    repository: andrewmzhang/kubernetes-collector
+    pullPolicy: Always
+
+nodeCollector:
+  cadvisor:
+    image:
+      repository: andrewmzhang/cadvisor-patched
+      pullPolicy: Always
+  containerMetricsCollector:
+    image:
+      repository: andrewmzhang/kubernetes-collector
+      pullPolicy: Always
+  machineSectionsCollector:
+    image:
+      repository: andrewmzhang/kubernetes-collector
+      pullPolicy: Always

k3s/k1/karakeep.tf

@@ -106,6 +106,10 @@ resource "kubernetes_persistent_volume_claim" "data_pvc" {
   metadata {
     name      = "data-pvc"
     namespace = kubernetes_namespace.karakeep.metadata[0].name
+    labels = {
+      "recurring-job-group.longhorn.io/default" = "enabled"
+      "recurring-job.longhorn.io/c-a0ip13"      = "enabled"
+    }
   }
 
   spec {
@@ -123,11 +127,13 @@ resource "kubernetes_persistent_volume_claim" "meilisearch_pvc" {
   metadata {
     name      = "meilisearch-pvc"
     namespace = kubernetes_namespace.karakeep.metadata[0].name
+    labels = {
+      "recurring-job-group.longhorn.io/default" = "enabled"
+      "recurring-job.longhorn.io/c-gz3vw1"      = "enabled"
+    }
   }
-
   spec {
     access_modes = ["ReadWriteOnce"]
-
     resources {
       requests = {
         storage = "1Gi"
@@ -141,28 +147,23 @@ resource "kubernetes_deployment" "chrome" {
     name      = "chrome"
     namespace = kubernetes_namespace.karakeep.metadata[0].name
   }
-
   spec {
     replicas = 1
-
     selector {
       match_labels = {
         app = "chrome"
       }
     }
-
     template {
       metadata {
         labels = {
           app = "chrome"
         }
       }
-
       spec {
         container {
           name  = "chrome"
           image = "gcr.io/zenika-hub/alpine-chrome:123"
-
           command = [
             "chromium-browser",
             "--headless",
@@ -184,54 +185,44 @@ resource "kubernetes_deployment" "meilisearch" {
     name      = "meilisearch"
     namespace = kubernetes_namespace.karakeep.metadata[0].name
   }
-
   spec {
     replicas = 1
-
     selector {
       match_labels = {
         app = "meilisearch"
       }
     }
-
     template {
       metadata {
         labels = {
           app = "meilisearch"
         }
       }
-
       spec {
         container {
           name  = "meilisearch"
           image = "getmeili/meilisearch:v1.11.1"
-
           env {
             name  = "MEILI_NO_ANALYTICS"
             value = "true"
           }
-
           env_from {
             secret_ref {
               name = kubernetes_secret.karakeep_secrets.metadata[0].name
             }
           }
-
           env_from {
             config_map_ref {
               name = kubernetes_config_map.karakeep_configuration.metadata[0].name
             }
           }
-
           volume_mount {
             name       = "meilisearch"
             mount_path = "/meili_data"
           }
         }
-
         volume {
           name = "meilisearch"
-
           persistent_volume_claim {
             claim_name = kubernetes_persistent_volume_claim.meilisearch_pvc.metadata[0].name
           }
@@ -246,23 +237,19 @@ resource "kubernetes_deployment" "web" {
     name      = "web"
     namespace = kubernetes_namespace.karakeep.metadata[0].name
   }
-
   spec {
     replicas = 1
-
     selector {
       match_labels = {
         app = "karakeep-web"
       }
     }
-
     template {
       metadata {
         labels = {
           app = "karakeep-web"
         }
       }
-
       spec {
         container {
           name              = "web"

k3s/k1/variables.tf

@@ -19,6 +19,11 @@ variable "tailscale_client_secret" {
   description = "Tailscale OAuth Client Secret"
 }
 
+variable "tailscale_tailnet" {
+  type        = string
+  description = "Name of tailnet, e.g. `some-name.ts.net`"
+}
+
 variable "cloudflare_api_token" {
   type        = string
   description = "Cloudflare API Token"