02-cni-cilium/README.md

@@ -1,40 +0,0 @@
-# 02 | CNI Cilium
-
-Only install one CNI.  Cilium brings network policy capabilities and uses eBPF technology to provide increased performance.
-
-Reference: https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/
-
-First we must install the cilium CLI binary, as root:
-
-```bash
-sudo su -
-CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
-CLI_ARCH=amd64
-if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
-curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
-sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
-sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
-rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
-
-```
-
-Then we can use it to install cilium into Kubernetes:
-
-```bash
-cilium install --version 1.14.5
-
-```
-
-Validate the install:
-
-```bash
-cilium status --wait
-
-```
-
-The following test can be performed, but it won't work until worker nodes are joined.  
-
-```bash
-cilium connectivity test
-
-```

05-ingress-controller-nginx/README.md

@@ -18,8 +18,6 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ingress-mandelmapper
-  annotations:
-    cert-manager.io/issuer: letsencrypt
 spec:
   ingressClassName: nginx
   rules:
@@ -33,10 +31,6 @@ spec:
             name: mandelmapper
             port:
               number: 6161
-  tls:
-    - hosts:
-      - mandelmap.home.stevenpolley.net
-      secretName: mandelmap-cert
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -59,7 +53,6 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ingress-myserviceb
-  cert-manager.io/issuer: letsencrypt
 spec:
   ingressClassName: nginx
   rules:
@@ -77,7 +70,7 @@ spec:
       - myserviceb.foo.org
       secretName: example-tls
 ---
-# A secret must also be provided, this will be created by cert-manager
+# A secret must also be provided, likely by a cert-manager of some kind
 apiVersion: v1
 kind: Secret
 metadata:

06-cert-manager/README.md

@@ -8,27 +8,11 @@ Install cert-manager - check for latest version.
 kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
 ```
 
-After cert manager is installed, create API tokens (not keys, but tokens) on cloudflare (User Profile > API Tokens > API Tokens) with permissions:
+After cert manager is installed, create the Let's Encrypt issuer:
-
-Permissions:
-
-* Zone - DNS - Edit
-* Zone - Zone - Read
-
-Zone Resources:
-
-* Include - All Zones
-
-Configure a the API token as a secret in Kubernetes and replace the <APITOKEN> in the below command with the token from cloudflare.
-
-```bash
-kubectl create secret generic cloudflare-api-token-secret --namespace=cert-manager --type=Opaque --from-literal=api-token=<APIKEY>
-```
-
-Create the Let's Encrypt ClusterIssuer:
 
 ```yaml
 
 # Be sure to edit the file and set the production URL if not a test cluster
 kubectl apply -f lets-encrypt-issuer.yaml
 ```
+

06-cert-manager/lets-encrypt-issuer.yaml

@@ -1,13 +1,14 @@
 apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
+kind: Issuer
 metadata:
   name: letsencrypt
+  namespace: default
 spec:
   acme:
     # The ACME server URL
     # production is https://acme-v02.api.letsencrypt.org/directory
     # stagiong is https://acme-staging-v02.api.letsencrypt.org/directory
-    server: https://acme-v02.api.letsencrypt.org/directory
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
     # Email address used for ACME registration
     email: himself@stevenpolley.net
     # Name of a secret used to store the ACME account private key
@@ -17,8 +18,6 @@ spec:
     solvers:
     # An empty 'selector' means that this solver matches all domains
     - selector: {}
-      dns01:
+      http01:
-        cloudflare:
+        ingress:
-          apiTokenSecretRef:
+          ingressClassName: nginx
-            name: cloudflare-api-token-secret
-            key: api-token

10-applications/mandelmap.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: mandelmapper
+  name: mandelmapper
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: mandelmapper
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: mandelmapper
+    spec:
+      containers:
+      - image: registry.deadbeef.codes/mandelmapper
+        name: mandelmapper
+        resources:
+          requests:
+            memory: "24Mi"
+            cpu: "50m"
+status: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: mandelmapper
+  name: mandelmapper
+spec:
+  type: NodePort
+  ports:
+  - port: 6161
+    protocol: TCP
+    targetPort: 6161
+  selector:
+    app: mandelmapper
+status:
+  loadBalancer: {}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ingress-mandelmapper
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: mandelmap.home.stevenpolley.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: mandelmapper
+            port:
+              number: 6161