Skip to content

Commit 598dee8

Browse files
batleforcbatleforc
committed
feat: add a local talos cluster
1 parent 2553ec6 commit 598dee8

5 files changed

Lines changed: 375 additions & 3 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,4 @@ Thumbs.db
4242
.nx/workspace-data
4343
.cursor/rules/nx-rules.mdc
4444
.github/instructions/nx.instructions.md
45+
kubeconfig.*.yaml

‎.taskfile/talos.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
version: '3'
2+
3+
tasks:
4+
up:
5+
desc: "Start Talos cluster"
6+
cmds:
7+
- talosctl cluster create --workers 1
8+
down:
9+
desc: "Destroy Talos cluster"
10+
cmds:
11+
- talosctl cluster destroy
12+
kubeconfig:
13+
desc: "Get kubeconfig for Talos cluster"
14+
cmds:
15+
- talosctl kubeconfig 'kubeconfig.local.yaml' -n 10.5.0.2
16+
dashboard:
17+
desc: "Open Talos dashboard"
18+
cmds:
19+
- talosctl dashboard -n 10.5.0.2
20+
k:
21+
desc: "Shortcut for kubectl"
22+
env:
23+
KUBECONFIG: kubeconfig.local.yaml
24+
cmds:
25+
- kubectl {{ .CLI_ARGS }}
26+
k9s:
27+
desc: "Shortcut for k9s"
28+
env:
29+
KUBECONFIG: kubeconfig.local.yaml
30+
cmds:
31+
- k9s {{ .CLI_ARGS }}
32+
crd:
33+
desc: "Apply CRDs to Talos cluster"
34+
env:
35+
KUBECONFIG: kubeconfig.local.yaml
36+
cmds:
37+
- kubectl apply -f ./deploy/crds.yaml

‎Taskfile.yaml‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
version: '3'
22

3+
includes:
4+
talos: .taskfile/talos.yaml
5+
36
tasks:
47
run:
8+
env:
9+
KUBECONFIG: ./kubeconfig.local.yaml
510
cmds:
6-
- echo "Running the main task"
11+
- echo "Running the backend "
712
- cargo run --bin server
8-
desc: "Run the main task"
13+
desc: "Run the backend"
914
gen:crds:
1015
silent: true
1116
cmds:
@@ -27,4 +32,9 @@ tasks:
2732
echo "Neither docker nor podman is installed. Please install one of them to run the service."
2833
exit 1
2934
fi
30-
desc: "Run the service task"
35+
desc: "Run the service task"
36+
recu:
37+
desc: "Run all gen jobs"
38+
cmds:
39+
- task gen:crds > deploy/crds.yaml
40+
- task gen:swagger > swagger.json

‎deploy/crds.yaml‎

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
name: proxykubeapis.weebo.si.rs
5+
spec:
6+
group: weebo.si.rs
7+
names:
8+
categories: []
9+
kind: ProxyKubeApi
10+
plural: proxykubeapis
11+
shortNames: []
12+
singular: proxykubeapi
13+
scope: Namespaced
14+
versions:
15+
- additionalPrinterColumns: []
16+
name: v1
17+
schema:
18+
openAPIV3Schema:
19+
description: Auto-generated derived type for ProxyKubeApiSpec via `CustomResource`
20+
properties:
21+
spec:
22+
properties:
23+
auth_config:
24+
description: Main configuration for authentication
25+
properties:
26+
jwt:
27+
items:
28+
properties:
29+
claim_mappings:
30+
properties:
31+
extra:
32+
items:
33+
properties:
34+
key:
35+
type: string
36+
value_expression:
37+
type: string
38+
required:
39+
- key
40+
- value_expression
41+
type: object
42+
type: array
43+
groups:
44+
nullable: true
45+
properties:
46+
claim:
47+
type: string
48+
expression:
49+
type: string
50+
prefix:
51+
nullable: true
52+
type: string
53+
required:
54+
- claim
55+
- expression
56+
type: object
57+
uid:
58+
nullable: true
59+
properties:
60+
claim:
61+
nullable: true
62+
type: string
63+
expression:
64+
nullable: true
65+
type: string
66+
type: object
67+
username:
68+
nullable: true
69+
properties:
70+
claim:
71+
type: string
72+
expression:
73+
type: string
74+
prefix:
75+
nullable: true
76+
type: string
77+
required:
78+
- claim
79+
- expression
80+
type: object
81+
required:
82+
- extra
83+
type: object
84+
claim_validation_rules:
85+
items:
86+
properties:
87+
claim:
88+
type: string
89+
expression:
90+
type: string
91+
message:
92+
type: string
93+
required_value:
94+
type: string
95+
required:
96+
- claim
97+
- expression
98+
- message
99+
- required_value
100+
type: object
101+
type: array
102+
issuer:
103+
properties:
104+
audience_match_policy:
105+
enum:
106+
- MatchAny
107+
type: string
108+
audiences:
109+
items:
110+
type: string
111+
type: array
112+
certificate_authority:
113+
nullable: true
114+
type: string
115+
discovery_url:
116+
nullable: true
117+
type: string
118+
egress_selector:
119+
enum:
120+
- controlplane
121+
- cluster
122+
type: string
123+
url:
124+
type: string
125+
required:
126+
- audience_match_policy
127+
- audiences
128+
- egress_selector
129+
- url
130+
type: object
131+
user_validation_rules:
132+
items:
133+
properties:
134+
expression:
135+
type: string
136+
message:
137+
type: string
138+
required:
139+
- expression
140+
- message
141+
type: object
142+
type: array
143+
required:
144+
- claim_mappings
145+
- claim_validation_rules
146+
- issuer
147+
- user_validation_rules
148+
type: object
149+
type: array
150+
required:
151+
- jwt
152+
type: object
153+
cert:
154+
description: Certificate for the Kubernetes API
155+
oneOf:
156+
- required:
157+
- Secret
158+
- required:
159+
- Cert
160+
properties:
161+
Cert:
162+
description: Use a cert from a file path
163+
type: string
164+
Secret:
165+
description: Use a cert from a secret
166+
properties:
167+
key:
168+
type: string
169+
name:
170+
type: string
171+
required:
172+
- key
173+
- name
174+
type: object
175+
type: object
176+
dashboard_group:
177+
description: |-
178+
If the proxy exposition is accessible via the dashboard
179+
the oidc group that allow access to the dashboard, should be unique
180+
Default: to the resource namespace + resource name
181+
nullable: true
182+
type: string
183+
expose_via_dashboard:
184+
default: true
185+
description: |-
186+
If the proxy exposition should be accessible via the Dashboard
187+
Default: false
188+
type: boolean
189+
security_config:
190+
description: Security configuration
191+
properties:
192+
enabled:
193+
default: true
194+
description: Whether the token is validated beforehand
195+
type: boolean
196+
fail2login_equal_ban:
197+
description: Configuration for banning users after multiple failed login attempts
198+
properties:
199+
ban_duration:
200+
default: 300
201+
description: |-
202+
The duration of the ban in seconds
203+
default: 300 (5 minutes)
204+
0 means permanent ban
205+
format: uint32
206+
minimum: 0.0
207+
type: integer
208+
enabled:
209+
default: false
210+
description: |-
211+
If the feature is enabled
212+
default: false
213+
type: boolean
214+
exponential_backoff:
215+
default: false
216+
description: |-
217+
If the time is exponentially increased with each failed login attempt
218+
default: false
219+
type: boolean
220+
max_failed_logins:
221+
default: 5
222+
description: |-
223+
The number of failed login attempts before the user is banned
224+
default: 5
225+
format: uint32
226+
minimum: 0.0
227+
type: integer
228+
type: object
229+
per_user_group_rate_limiting:
230+
description: |-
231+
Per group rate limiting configuration
232+
This take precedence over the global rate limiting configuration
233+
items:
234+
description: Per-user group rate limiting configuration
235+
properties:
236+
claim:
237+
description: Claim to identify the user group, used in conjunction with claim_mappings in the JWTAuthenticator
238+
type: string
239+
group:
240+
description: Group name
241+
type: string
242+
max_requests_per_minute:
243+
description: |-
244+
The maximum number of requests per minute for this group
245+
This setting overrides the global rate limiting setting
246+
0 disables the rate limiting for this group
247+
format: uint32
248+
minimum: 0.0
249+
type: integer
250+
required:
251+
- claim
252+
- group
253+
- max_requests_per_minute
254+
type: object
255+
type: array
256+
required:
257+
- fail2login_equal_ban
258+
- per_user_group_rate_limiting
259+
type: object
260+
required:
261+
- auth_config
262+
- cert
263+
- security_config
264+
type: object
265+
status:
266+
nullable: true
267+
properties:
268+
error:
269+
nullable: true
270+
type: string
271+
exposed:
272+
type: boolean
273+
path:
274+
nullable: true
275+
type: string
276+
required:
277+
- exposed
278+
type: object
279+
required:
280+
- spec
281+
title: ProxyKubeApi
282+
type: object
283+
served: true
284+
storage: true
285+
subresources:
286+
status: {}

0 commit comments

Comments
 (0)