feat: hegerdes kubernetes service

.gitignore

@@ -12,3 +12,6 @@ infra/hcloud-tf-k8s-talos/data/k8s-secret-external-secret.yml
 k8s-apps/linkerd/
 infra/test
 *.log
+k8s-apps/hegerdes-kubernetes-service/generated
+k8s-apps/hegerdes-kubernetes-service/helper/generated
+k8s-apps/hegerdes-kubernetes-service/helper/

.pre-commit-config.yaml

@@ -4,7 +4,7 @@ repos:
     hooks:
       - id: check-yaml
         args: [--allow-multiple-documents]
-        exclude: .gitlab-ci.yml|infra/.*/cloud-init.yml
+        exclude: .gitlab-ci.yml|infra/.*/cloud-init.yml|k8s-apps/hegerdes-kubernetes-service/hks/templates/extra-manifests.yaml|k8s-apps/hegerdes-kubernetes-service/hks/templates/pdb.yaml|k8s-apps/hegerdes-kubernetes-service/hks-manager/templates/.*|k8s-apps/hegerdes-kubernetes-service/shared/helm-rendering/templates/extra-manifests.yaml|k8s-apps/hegerdes-kubernetes-service/hks/templates/eso.yaml|k8s-apps/hegerdes-kubernetes-service/hks/templates/tls-route.yaml
       - id: check-json
       - id: pretty-format-json
         args: [--autofix, --no-sort-keys, --no-ensure-ascii]

k8s-apps/hegerdes-kubernetes-service/Kube-tasks.md

@@ -0,0 +1,40 @@
+Hennes Kubernes Service
+
+Tasks:
+ * Create deploymets for:
+  * kube-apiserver ✅
+  * kube-controller ✅
+  * etcd ✅
+ * Create certs - hacky ✅
+ * Ensure communication ✅
+ * Refine Deployments ✅
+ * Create certs - prod ✅
+ * GitOps:
+   * HKS ✅
+   * Slave Cluster
+ * Generate join token
+   * POC ✅
+   * Service-Controller
+ * Join Worker
+ * Ensure Connectivity
+   * Worker -> CP
+   * CP -> Worker
+ * Worker Apps
+   * CoreDNS
+   * Cilium
+
+
+```bash
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.19.2/cert-manager.yaml
+kubectl create namespace argocd
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.3/manifests/install.yaml
+# kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/standard-install.yaml
+kubectl apply --server-side -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/experimental-install.yaml
+kubectl kustomize "https://github.com/nginx/nginx-gateway-fabric/config/crd/gateway-api/experimental?ref=v2.3.0" | kubectl apply -f - --server-side
+helm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric --create-namespace -n nginx-gateway --set nginxGateway.gwAPIExperimentalFeatures.enable=true
+
+kaf argo-hks-shared.yaml
+kaf ../../k8s-cluster-hcloud-critical/argo-external-secrets.yml
+kaf ../argo-nginx-gateway-fabric.yml
+kaf argo-appset-hks.yaml
+```

k8s-apps/hegerdes-kubernetes-service/argo-appset-hks.yaml

@@ -0,0 +1,48 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: hks-appset
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+    - git:
+        repoURL: https://github.com/hegerdes/GitOps.git
+        revision: feat/hks
+        directories:
+          - path: k8s-apps/hegerdes-kubernetes-service/clusters/*
+  template:
+    metadata:
+      name: "hks-{{.path.basename}}"
+      labels:
+        name: hks
+      finalizers:
+        - resources-finalizer.argocd.argoproj.io/background
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/hegerdes/GitOps.git
+        targetRevision: feat/hks
+        path: k8s-apps/hegerdes-kubernetes-service/hks
+        helm:
+          valuesObject:
+            extraObjects: []
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{.path.basename}}"
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+      ignoreDifferences:
+        - kind: StatefulSet
+          group: apps
+          jqPathExpressions:
+            - .spec.updateStrategy.rollingUpdate.maxUnavailable
+        - kind: ConfigMap
+          name: cluster-data
+          jqPathExpressions:
+            - .data.advertiseIP

k8s-apps/hegerdes-kubernetes-service/argo-hks-manager.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: hks-manager
+  namespace: argocd
+  labels:
+    name: hks-manager
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/hegerdes/GitOps.git
+    targetRevision: feat/hks
+    path: k8s-apps/hegerdes-kubernetes-service/hks-manager
+    helm:
+      valuesObject:
+        extraObjects: []
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: hks-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

k8s-apps/hegerdes-kubernetes-service/argo-hks-shared.yaml

@@ -0,0 +1,24 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: hks-shared
+  namespace: argocd
+  labels:
+    name: hks
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/hegerdes/GitOps.git
+    targetRevision: feat/hks
+    path: k8s-apps/hegerdes-kubernetes-service/shared
+    directory:
+      recurse: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

k8s-apps/hegerdes-kubernetes-service/clustes-shared/cm-kubelet-conf.yaml

@@ -0,0 +1,70 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kubelet-config
+  namespace: kube-system
+data:
+  kubelet: |
+    apiVersion: kubelet.config.k8s.io/v1beta1
+    authentication:
+      anonymous:
+        enabled: false
+      webhook:
+        cacheTTL: 0s
+        enabled: true
+      x509:
+        clientCAFile: /etc/kubernetes/pki/ca.crt
+    authorization:
+      mode: Webhook
+      webhook:
+        cacheAuthorizedTTL: 0s
+        cacheUnauthorizedTTL: 0s
+    cgroupDriver: systemd
+    clusterDNS:
+    - 10.96.0.10
+    clusterDomain: cluster.local
+    containerRuntimeEndpoint: unix:///run/containerd/containerd.sock
+    cpuManagerReconcilePeriod: 0s
+    crashLoopBackOff: {}
+    enableDebugFlagsHandler: false
+    enableProfilingHandler: false
+    evictionPressureTransitionPeriod: 0s
+    failCgroupV1: true
+    failSwapOn: true
+    featureGates:
+      ClusterTrustBundle: true
+      ClusterTrustBundleProjection: true
+    fileCheckFrequency: 0s
+    healthzBindAddress: 0.0.0.0
+    healthzPort: 10248
+    httpCheckFrequency: 0s
+    imageMaximumGCAge: 1h0m0s
+    imageMinimumGCAge: 5m0s
+    kind: KubeletConfiguration
+    logging:
+      flushFrequency: 0
+      options:
+        json:
+          infoBufferSize: "0"
+        text:
+          infoBufferSize: "0"
+      verbosity: 0
+    maxParallelImagePulls: 8
+    maxPods: 220
+    memorySwap: {}
+    nodeStatusMaxImages: -1
+    nodeStatusReportFrequency: 0s
+    nodeStatusUpdateFrequency: 0s
+    protectKernelDefaults: true
+    resolvConf: /etc/resolv.conf
+    rotateCertificates: true
+    runtimeRequestTimeout: 0s
+    seccompDefault: true
+    serializeImagePulls: false
+    serverTLSBootstrap: true
+    shutdownGracePeriod: 0s
+    shutdownGracePeriodCriticalPods: 0s
+    staticPodPath: /etc/kubernetes/manifests
+    streamingConnectionIdleTimeout: 0s
+    syncFrequency: 0s
+    volumeStatsAggPeriod: 5m0s

k8s-apps/hegerdes-kubernetes-service/clustes-shared/rbac-super-user.yaml

@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kube-apiserver-kubelet-client-extra
+rules:
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes/proxy"]
+    verbs: ["get", "create"]
+  - apiGroups: [""]
+    resources:
+      - pods/exec
+      - pods/attach
+      - pods/portforward
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kube-apiserver-kubelet-client-extra-binding
+subjects:
+  - kind: User
+    name: kube-apiserver-kubelet-client
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: kube-apiserver-kubelet-client-extra
+  apiGroup: rbac.authorization.k8s.io