Configure remote k8s cluster

Run another cluster in a remote location running minimal services.
mchill · Jan 16, 2025 · cd1abdd · cd1abdd
1 parent 62d9841
commit cd1abdd
Show file tree

Hide file tree

Showing 28 changed files with 432 additions and 81 deletions.
diff --git a/devices/remote/k8s/applications/build.sh b/devices/remote/k8s/applications/build.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+kubectl kustomize plex && echo "---"
+kubectl kustomize tautulli && echo "---"
diff --git a/devices/remote/k8s/applications/plex/deployment.yaml b/devices/remote/k8s/applications/plex/deployment.yaml
@@ -0,0 +1,65 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: plex
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      securityContext:
+        fsGroup: 911
+      containers:
+        - name: plex
+          image: ghcr.io/linuxserver/plex:1.41.3
+          ports:
+            - name: ingress
+              containerPort: 32400
+            - name: gdm-1
+              containerPort: 32410
+              protocol: UDP
+            - name: gdm-2
+              containerPort: 32412
+              protocol: UDP
+            - name: gdm-3
+              containerPort: 32413
+              protocol: UDP
+            - name: gdm-4
+              containerPort: 32414
+              protocol: UDP
+          env:
+            - name: TZ
+              value: America/New_York
+          resources:
+            limits:
+              memory: 4Gi
+            requests:
+              cpu: 1
+              memory: 1Gi
+          volumeMounts:
+            - name: plex
+              mountPath: /config
+            - name: media
+              mountPath: /transcode
+              subPath: transcode/plex
+            - name: media
+              mountPath: /data/movies
+              subPath: libraries/movies/sd
+            - name: media
+              mountPath: /data/movies-requested
+              subPath: libraries/movies/requested
+            - name: media
+              mountPath: /data/tv
+              subPath: libraries/tv/sd
+            - name: media
+              mountPath: /data/tv-requested
+              subPath: libraries/tv/requested
+      volumes:
+        - name: plex
+          hostPath:
+            type: Directory
+            path: /home/mchill/k8s/plex
+        - name: media
+          persistentVolumeClaim:
+            claimName: media
diff --git a/devices/remote/k8s/applications/plex/kustomization.yaml b/devices/remote/k8s/applications/plex/kustomization.yaml
@@ -0,0 +1,6 @@
+namespace: server
+commonLabels:
+  app: plex
+resources:
+  - deployment.yaml
+  - service.yaml
diff --git a/devices/remote/k8s/applications/plex/service.yaml b/devices/remote/k8s/applications/plex/service.yaml
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: plex
+spec:
+  type: NodePort
+  ports:
+    - name: ingress
+      port: 32400
+      targetPort: ingress
+      nodePort: 32400
+    - name: gdm-1
+      port: 32410
+      targetPort: gdm-1
+      nodePort: 32410
+      protocol: UDP
+    - name: gdm-2
+      port: 32412
+      targetPort: gdm-2
+      nodePort: 32412
+      protocol: UDP
+    - name: gdm-3
+      port: 32413
+      targetPort: gdm-3
+      nodePort: 32413
+      protocol: UDP
+    - name: gdm-4
+      port: 32414
+      targetPort: gdm-4
+      nodePort: 32414
+      protocol: UDP
diff --git a/devices/remote/k8s/applications/tautulli/deployment.yaml b/devices/remote/k8s/applications/tautulli/deployment.yaml
@@ -0,0 +1,33 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: tautulli
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    spec:
+      securityContext:
+        fsGroup: 1000
+      containers:
+        - name: tautulli
+          image: tautulli/tautulli:v2.15.0
+          ports:
+            - name: ingress
+              containerPort: 8181
+          env:
+            - name: TZ
+              value: America/New_York
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+          volumeMounts:
+            - name: tautulli
+              mountPath: /config
+      volumes:
+        - name: tautulli
+          hostPath:
+            type: Directory
+            path: /home/mchill/k8s/tautulli
diff --git a/devices/remote/k8s/applications/tautulli/kustomization.yaml b/devices/remote/k8s/applications/tautulli/kustomization.yaml
@@ -0,0 +1,6 @@
+namespace: server
+commonLabels:
+  app: tautulli
+resources:
+  - deployment.yaml
+  - service.yaml
diff --git a/devices/remote/k8s/applications/tautulli/service.yaml b/devices/remote/k8s/applications/tautulli/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tautulli
+spec:
+  type: NodePort
+  ports:
+    - name: ingress
+      port: 30181
+      targetPort: ingress
+      nodePort: 30181
diff --git a/devices/remote/k8s/infrastructure/apply.sh b/devices/remote/k8s/infrastructure/apply.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+curl -skSL https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/v1.16.0/deploy/install-driver.sh | bash -s v1.16.0 --
+
+kubectl apply --server-side -k sealed-secrets
+kubectl wait --for=condition=available --timeout=60s -n sealed-secrets deployment/sealed-secrets-controller
+find ../ -type f -iname secret.yaml -not -path "*/charts/*" -execdir sh -c "cat {} | kubeseal --controller-namespace=sealed-secrets -o yaml > sealed-secret.yaml" \;
+
+kubectl apply --server-side -k server
diff --git a/devices/remote/k8s/infrastructure/sealed-secrets/kustomization.yaml b/devices/remote/k8s/infrastructure/sealed-secrets/kustomization.yaml
@@ -0,0 +1,4 @@
+namespace: sealed-secrets
+resources:
+  - https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.27.2/controller.yaml
+  - namespace.yaml
diff --git a/devices/remote/k8s/infrastructure/sealed-secrets/namespace.yaml b/devices/remote/k8s/infrastructure/sealed-secrets/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sealed-secrets
diff --git a/devices/remote/k8s/infrastructure/server/kustomization.yaml b/devices/remote/k8s/infrastructure/server/kustomization.yaml
@@ -0,0 +1,6 @@
+namespace: server
+resources:
+  - namespace.yaml
+  - pv.yaml
+  - pvc.yaml
+  - sealed-secret.yaml
diff --git a/devices/remote/k8s/infrastructure/server/namespace.yaml b/devices/remote/k8s/infrastructure/server/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: server
diff --git a/devices/remote/k8s/infrastructure/server/pv.yaml b/devices/remote/k8s/infrastructure/server/pv.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: media
+  annotations:
+    pv.kubernetes.io/provisioned-by: smb.csi.k8s.io
+spec:
+  accessModes:
+    - ReadWriteMany
+  capacity:
+    storage: 10Ti
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: smb
+  mountOptions:
+    - dir_mode=0755
+    - file_mode=0644
+  csi:
+    driver: smb.csi.k8s.io
+    volumeHandle: //192.168.0.201/media##
+    volumeAttributes:
+      source: //192.168.0.201/media
+    nodeStageSecretRef:
+      name: smbcreds
+      namespace: server
diff --git a/devices/remote/k8s/infrastructure/server/pvc.yaml b/devices/remote/k8s/infrastructure/server/pvc.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: media
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Ti
+  storageClassName: smb
+  volumeName: media
diff --git a/devices/remote/k8s/infrastructure/server/sealed-secret.yaml b/devices/remote/k8s/infrastructure/server/sealed-secret.yaml
@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: smbcreds
+  namespace: server
+spec:
+  encryptedData:
+    password: AgBcxSg2fBYMOgYJgVuJke3QFpwT5JggmuS/4AYdmVypghs3pvSjk4zBASGwPZufFS80yjJbMFJXJEqKKZ6miq13SB5VVpHD98dwUshnf10aIQshkr5wolFFJP4/pozMy6n+j0dx1uQMyKT4rYQKXwNxNKdxoRZVmWSkqE1SFbYqmzBelFnHKjLolTAWqMwkWPmk1h51ST07OG74jjb+E2ny7uL0mhkDvEbA17wCKfMao62gxEVDuXbNCNVJE9a3kMVyKX65FS1gEfETW/zLYVG7CVKg6x3/0wHEduOEPz4EBuqNmBil+db8J0Xdl3VO32TQ8oTPtNKTX2+mapfWGrArbP/nzn+Md6X+6v9gsT6GS4NgSVONpvJFxN4MXNLHqf9JjuY/oNQwquXMgndVF2ltnuctfUEfQG5qlAgItcJGZGlqd051gMQi547JnJeVpsK5tNR8FwskegRYVCz4Jhb3qtUUyUBdBhMr0NBUQ15SBG4/oZvL1FUHHzyp5ON/mFuWkN+KvLJS0LWacQGnqE7gBecQkuVaahYa13WXnnKWmsNFODGqQ9fGMZfJLjNRr89LWbNIhsf3fXbQrKPZNWmM5dtSnx22+S9YOxYwBLwXWXngRLRNlz07BoI16wB9cIK7CTjkA4tm7wuSumqD05QJUsN495FA2ZP8wVrTubc/vBfmkkd5x0l8KE5ordiiIq25QNU1/bT8jzG12qoecRF0t8m3ERHojQp+KylHKho9dw==
+    username: AgAW+FPLGQK9otiu1fgTgZcHLseUz3iAxXGgoMebBTFP31QADqiRvIO7tvtedxN0OKaCmUv+xjqS+ClUGj5isXb1rwTKO56AyvV8PRKJeRoyMxnP8/141Omm6TDgf+TccDegbIHQO5RvxYlMFYDKQem8UTbdwdEDPxgcjjGUp6/VnjuVIpcSQZdjJBXyPZabDIYIYjGw3lBU83AZ4c6ruq2yM4U4ptswVUV79nSGJQ9jYev6tpd/HUewJF7BlAzAO2Cbx6TJ/1FW37YfQK3yJ8IksPOffvfa8aPcsmps3morUvPW+GWnOlIPf2BRR934L/VliWvd3qSQKvULCvnzKZAqDkec8e3b/N4qk95YuSYW3ST3eIyS94feovaSqrfqnfV2jWZTiO2epiESJzq+tFu9h6cX+c079qlcXeqQZxCIw2kJcDCrHjx3I+UMXKyUFJnnt7ePkqRYA1BI1CVe+akzx7OWWji5CJg+p5IABkrDfFLSzqXyIYD8f5IS9oqf2Nl+7JbEhKKMHVrFa+hl5TTWZMfFyJbIWSOMdG4SpdUA/al7Tk8L/QsM8uIVk5JRW2zENuSa1HMpASX2urknCVMcMSH1dqXT3G3JmcmCc9hrRSU8WcTg7NA8ku9OABXq5JGThc66KQ13nQS+mnUXkOosDKzDELw0yakHrtDEcBiff6Xz07FEpNUffzkgKNwLLHtfXJlR
+  template:
+    metadata:
+      creationTimestamp: null
+      name: smbcreds
+      namespace: server
+    type: Opaque
+