Add teleport cluster & agent

WolfeCub · Nov 30, 2022 · 74ab839 · 74ab839
1 parent 481bbf5
commit 74ab839
Show file tree

Hide file tree

Showing 8 changed files with 87 additions and 2 deletions.
diff --git a/kubernetes/apps/admin/kustomization.yaml b/kubernetes/apps/admin/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - flux-notifications
   - traefik
   - dashboard
+  - teleport
diff --git a/kubernetes/apps/admin/teleport/agent-helm-release.yaml b/kubernetes/apps/admin/teleport/agent-helm-release.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: teleport-agent
+  namespace: admin
+spec:
+  interval: 5m
+  upgrade:
+    force: true
+  chart:
+    spec:
+      chart: teleport-kube-agent
+      version: 11.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: teleport
+        namespace: flux-system
+      interval: 5m
+  values:
+    authToken: "${teleport_join_token}"
+    proxyAddr: "teleport-cluster.admin.svc.cluster.local:3080"
+    roles: "kube,app"
+    kubeClusterName: "${teleport_cluster_name}"
+    appResources:
+      - labels:
+          "*": "*"
diff --git a/kubernetes/apps/admin/teleport/cluster-helm-release.yaml b/kubernetes/apps/admin/teleport/cluster-helm-release.yaml
@@ -0,0 +1,24 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: teleport-cluster
+  namespace: admin
+spec:
+  interval: 5m
+  upgrade:
+    force: true
+  chart:
+    spec:
+      chart: teleport-cluster
+      version: 11.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: teleport
+        namespace: flux-system
+      interval: 5m
+  values:
+    clusterName: "teleport.${domain}"
+    kubeClusterName: "${teleport_cluster_name}"
+    persistence:
+      existingClaimName: teleport-cluster-config
diff --git a/kubernetes/apps/admin/teleport/config-pvc.yaml b/kubernetes/apps/admin/teleport/config-pvc.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: teleport-cluster-config
+  namespace: admin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: longhorn
diff --git a/kubernetes/apps/admin/teleport/kustomization.yaml b/kubernetes/apps/admin/teleport/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cluster-helm-release.yaml
+  - agent-helm-release.yaml
+  - config-pvc.yaml
diff --git a/kubernetes/bootstrap/cluster-secrets.sops.yaml b/kubernetes/bootstrap/cluster-secrets.sops.yaml
@@ -36,6 +36,8 @@ stringData:
     flux_discord_webhook: ENC[AES256_GCM,data:PGkEfTVSddiWGha+fc5ZTKep8DpMT8IFTt2gPxIOAEBeUOEB3PVEJP/YIY055acxxUzFIEH39Nze5aCBaq0952d60fITnmMq4eRcci00tY4lPdy8ckSTwxxHnOJ4ob+GBMTBIxO+Z2SqfFPKH+FK1oXPOpl6D4yc,iv:ERRkait6R3UcC95dPQ/QFAVRT5z7Am37QMDrG9PDEN8=,tag:igrrr+sH+tn7M66rp8uCwA==,type:str]
     grafana_admin_password: ENC[AES256_GCM,data:wLQAs6dN1o/vt9NiCsnDM54KRovAqg6k/VpHfy6VrFc=,iv:GP3kSK4rWRQwJAByaX8aDMUlbyVT+2bEN9GDHoG5qaE=,tag:hHPLk7QLy0j38+GGlI0sxA==,type:str]
     alertmanager_discord_webhook: ENC[AES256_GCM,data:RGumR3YkRhX7lBUvWC0BeC+d/2n5/5G84wYtKDR6+wn1seeYRDaduDiecZpz6BvBeZCqBX9D7li2Y1z/4aQqbNhbXuAOXLk/XvmDhv4b8shPdkXa/7tXJWSRukOKEKzpVN75DkkdxnRUyduNlZOkEn82CiHEWz2Dv3YAMzAI,iv:Hwul9Zvh8s+PLm88nCrV6p6JPQiIg3Va0oZB9Bb8xBA=,tag:mp9YCocAMzJcPFGR5jC3ag==,type:str]
+    teleport_cluster_name: ENC[AES256_GCM,data:5+dcSv9/iTCs,iv:5s+6gnUYHqzWuZEuTJDAxkahnX/wwJcVlEqvXs6QJ0s=,tag:R9QZSXrlH22LNsX5G/dPUQ==,type:str]
+    teleport_join_token: ENC[AES256_GCM,data:3+mZN8SEzxhIKzLoy2ePlix1V678/yLsmt2OwKur5iI=,iv:be0YYQYs1AAYItGGiWI9LDJ+72i+LHshxxPbqY87Sr0=,tag:rTvkMYVtaCWrnf953IoAug==,type:str]
 kind: Secret
 metadata:
     creationTimestamp: null
@@ -47,8 +49,8 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2022-10-30T23:36:17Z"
-    mac: ENC[AES256_GCM,data:FXAtR4IX3iVFQie5UKaxSogCt4zfKCEktnZcsFNdO3mHpAtCOo/XXYIkpGgH8m0VoQypRU1itUunEYK7/YFZlE8xJPHYYLMlftGQuatsFTtnlX4FpnUXs4NQyAWjiy73Fv8g040m2Wh7EcwB95Um3XXi7adhWd0lFGxDlAyZNkY=,iv:5wbG0hl9ugtneoXwgQsC/cr6OWj3Q8tLOOo4hdN5k6Q=,tag:YVoaf5KC5SXLyLOBc4NLVQ==,type:str]
+    lastmodified: "2022-11-30T21:40:41Z"
+    mac: ENC[AES256_GCM,data:xX2aTrZifu20OZyXUlzHK04OG8xbKr7AQhcLbCt5z8G6wsD5KvDC8gqjcFL7b6406GM6IqNuLHY8gDLKPd9pZAAKL2P3xN675LAB/yPL0XXQNL8VYc/MLibBGS0pcVAg8pzT6PWz2z0URvZ4AH6zzSD2t1mUVC6R858miz7u7d0=,iv:PwpX3caeVLe/Xvw5JLglUL6grQri13u7xk6prc9yMWQ=,tag:51UEKcxkGW4Ft+rQqfw0Yg==,type:str]
     pgp:
         - created_at: "2022-08-10T19:08:51Z"
           enc: |

diff --git a/kubernetes/bootstrap/flux-system/helm-repos/kustomization.yaml b/kubernetes/bootstrap/flux-system/helm-repos/kustomization.yaml
@@ -12,3 +12,4 @@ resources:
   - grafana.yaml
   - dashboard.yaml
   - bjw-s.yaml
+  - teleport.yaml
diff --git a/kubernetes/bootstrap/flux-system/helm-repos/teleport.yaml b/kubernetes/bootstrap/flux-system/helm-repos/teleport.yaml
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: HelmRepository
+metadata:
+  name: teleport
+  namespace: flux-system
+spec:
+  interval: 15m
+  url: https://charts.releases.teleport.dev
+  timeout: 3m