#! /bin/bash -eu # namespaces kubectl create namespace longhorn # taints kubectl taint nodes server-1 node=special:NoSchedule ## install nginx ingress controller grafana dashboards # https://github.com/kubernetes/ingress-nginx/tree/master/deploy/grafana/dashboards # in order to pull private docker image kubectl create secret docker-registry regcred --docker-server=https://docker.pkg.github.com --docker-username=wahyd4 --docker-password=344f51a3979759788914088c8bfe87736ffefb5b --docker-email=wahyd4@gmail.com kubectl -n kube-system apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml k apply -f prometheus-pv.yml -n default # kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.42/example/prometheus-operator-crd/monitoring.coreos.com_prometheuses.yaml # kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.42/example/prometheus-operator-crd/monitoring.coreos.com_prometheusrules.yaml # kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.42/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml # kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.42/example/prometheus-operator-crd/monitoring.coreos.com_podmonitors.yaml # kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.42/example/prometheus-operator-crd/monitoring.coreos.com_alertmanagers.yaml # kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.42/example/prometheus-operator-crd/monitoring.coreos.com_thanosrulers.yaml helm upgrade --install prometheus -n default -f prometheus-values.yaml prometheus-community/kube-prometheus-stack k create namespace nginx-ingress helm upgrade --install ingress bitnami/nginx-ingress-controller -n nginx-ingress -f nginx-values.yaml k apply -f lets.yaml helm upgrade --install cert-manager --namespace cert-manager -f cert-manager-values.yaml jetstack/cert-manager k apply -f prometheus-ingress.yml kubectl -n default create secret generic oauth2-proxy-creds \ --from-literal=cookie-secret=ZuThURd/AK9ouHNxg0Czhg== \ --from-literal=client-id=4f46385b435275c693ec \ --from-literal=client-secret=518d5b4693aaaee3e62ce5b8d9da6ec5cc160098 helm upgrade oauth2-proxy --install -n default stable/oauth2-proxy --values oauth2-proxy-config.yaml k apply -f postgres-pv.yml -n default k create namespace db helm upgrade --install new-postgres -n db -f postgres-values.yaml bitnami/postgresql --set postgresqlPassword= # media applications k apply -f media.yaml # influxdb helm upgrade --install influxdb bitnami/influxdb --namespace db \ --set adminUser.name=junv \ --set adminUser.pwd=Lovewifi2020! \ --set persistence.storageClass=manual \ --set persistence.existingClaim=influxdb \ --set influxdb.securityContext.fsGroup=1000 \ --set influxdb.securityContext.runAsUser=1000 # metabase k apply -f metabase.yaml -n home-apps # create secret kubectl -n apps create secret generic database-credentials --from-literal=password=<...> k apply -f pihole-pv.yaml -n home-apps kubectl -n home-apps create secret generic pihole-admin-password --from-literal=webpassword=Uj2s3iUkRubkJs4 k apply -f pihole.yaml -n home-apps helm upgrade --install telegraf -f telegraf-values.yaml stable/telegraf -n home-apps ### level=error ts=2020-06-25T14:19:22.581Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="/app/discovery/kubernetes/kubernetes.go:263: Failed to list *v1.Pod: pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" in the namespace \"home-apps\"" # https://github.com/coreos/prometheus-operator/blob/master/Documentation/user-guides/getting-started.md # service account and role binding, one service account can have multiple role bindings kubectl create rolebinding apps-editor-binding --clusterrole=edit --serviceaccount=apps:cd-robot --namespace=apps # https://coreos.com/operators/prometheus/docs/latest/rbac.html kubectl create rolebinding apps-metrics-operator-binding --clusterrole=prometheus-prometheus-oper-operator --serviceaccount=apps:cd-robot --namespace=apps k apply -f prometheus-service-account.yaml -n default # create service monitor for telegraf k apply -f telegraf-service-monitor.yaml -n default # ddns k apply -f ddns.yaml -n home-apps # cluster issuers k apply -f lets.yaml ### badges kubectl -n apps create secret generic sentry-credentials --from-literal=dsn=xxx ### Nextcloud # kubectl -n apps create secret generic postgresql-credentials --from-literal=username=postgres --from-literal=password=xxx k apply -f nextcloud-pv.yaml -n media # datadog helm upgrade --install datadog -f datadog-values.yaml -n datadog --set datadog.site='datadoghq.com' --set datadog.apiKey=a78f4b0a6500fc28440a6c4274e6080e datadog/datadog # etcd and db backups k apply -f backup-cronjobs.yaml -n default # longhorn helm upgrade --install longhorn longhorn/longhorn -n longhorn -f longhorn-values.yaml # redis helm upgrade --install redis -n db -f redis-values.yaml bitnami/redis # superset # navigate to the codebase of superset and update TODO to provide db password manually helm upgrade --install -n home-apps --values ~/code/home-docker/superset-values.yaml superset helm/superset --set redis.password=$(kubectl get secret --namespace db redis -o jsonpath="{.data.redis-password}" | base64 --decode) --set postgresql.postgresqlPassword= --set postgresql.postgresHost=new-postgres-postgresql.db.svc.cluster.local # n8n k apply -f n8n.yaml -n home-apps # minio k apply -f minio-pv.yaml -n db # create secrets for longhorn kubectl -n media create secret generic minio --from-literal=AWS_ENDPOINTS=https://minio.junv.me --from-literal=AWS_ACCESS_KEY_ID='' --from-literal=AWS_SECRET_ACCESS_KEY='' # fill s3 bucket name for longhorn s3://bucket-name@ap-southeast-2/ # helm helm upgrade --install minio -n db -f minio-values.yaml bitnami/minio --set accessKey.password="TODO" \ --set secretKey.password="TODO" # copy secret to another namespace kubectl get secret minio --namespace=db -o yaml | sed 's/namespace: db/namespace: longhorn/g' | kubectl create -f - # namecheap ddns kubectl -n home-apps create secret generic namecheap-password --from-literal=password=xxxx # es k create namespace es k apply -f es.yaml # fluent bit helm repo add fluent https://fluent.github.io/helm-charts helm upgrade --install fluent-bit fluent/fluent-bit -f fluentbit-values.yaml # code server https://code.junv.me k apply -f nfs-code-server.yaml -n apps k apply -f code-server.yaml