From 6753be7f09be361dfaf20829d2f8ab1aeaca1f5e Mon Sep 17 00:00:00 2001 From: kasun Date: Fri, 12 Jun 2026 18:33:09 +0200 Subject: [PATCH] refactor code --- 01-proxmox-infra/index.ts | 6 +----- 03-k8s-infra/CLAUDE.md | 2 +- 03-k8s-infra/index.ts | 18 +++++++++++++----- 04-k8s-apps/index.ts | 10 +++++----- 05-monitoring/index.ts | 4 ++-- 5 files changed, 22 insertions(+), 18 deletions(-) diff --git a/01-proxmox-infra/index.ts b/01-proxmox-infra/index.ts index 53f2ae7..8813764 100644 --- a/01-proxmox-infra/index.ts +++ b/01-proxmox-infra/index.ts @@ -303,7 +303,7 @@ k3sVms.forEach((vmResource, i) => { (nic) => nic[0].macAddress, ); - return new pfsense.Dhcpv4Staticmapping( + new pfsense.Dhcpv4Staticmapping( `${nodeConfigs[i].name}-dhcp`, { interface: "lan", @@ -315,8 +315,6 @@ k3sVms.forEach((vmResource, i) => { ); }); -// Individual vmId exports — used by k8s-bootstrap to start VMs. -// Order matches nodeConfigs: master-1, master-2, worker-1, master-3, worker-2. export const vmIds = { master1: k3sVms[0].vmId, master2: k3sVms[1].vmId, @@ -328,8 +326,6 @@ export const vmIds = { // CI runner SSH private key — consumed by k8s-bootstrap via StackReference. export const ciRunnerPrivateKey = pulumi.secret(ciRunnerKey.privateKeyOpenssh); -// Proxmox API credentials — consumed by k8s-bootstrap via StackReference. export { pve1Endpoint, pve1ApiToken, pve2Endpoint, pve2ApiToken }; -//k3s instance ips consumed by k8s-bootstrap. export { master1Ip, master2Ip, worker1Ip, master3Ip, worker2Ip }; diff --git a/03-k8s-infra/CLAUDE.md b/03-k8s-infra/CLAUDE.md index 0015da2..0b0edfd 100644 --- a/03-k8s-infra/CLAUDE.md +++ b/03-k8s-infra/CLAUDE.md @@ -26,7 +26,7 @@ CI installs the `helm` CLI (`azure/setup-helm`) before running Pulumi. | kube-vip-cloud-provider | Allocates LoadBalancer IPs from a single-address pool (`kubeVipAddress`) — k3s's built-in ServiceLB is not used | | `traefik` ServicePatch | Pins Traefik's LoadBalancer IP to `kubeVipAddress` | -**Export**: `storageClass = "truenas-nfs"`. +**Export**: `nfsStorageClass = "truenas-nfs"`. ## Required Pulumi config diff --git a/03-k8s-infra/index.ts b/03-k8s-infra/index.ts index d848140..7e8bef3 100644 --- a/03-k8s-infra/index.ts +++ b/03-k8s-infra/index.ts @@ -8,10 +8,14 @@ const bootstrapRef = new pulumi.StackReference( ); const kubeconfig = bootstrapRef.requireOutput("kubeconfig"); + +export const nfsStorageClass = "truenas-nfs"; const truenasHost = config.requireSecret("truenasHost"); const truenasNfsPath = config.requireSecret("truenasNfsPath"); + const cloudflareToken = config.requireSecret("cloudflareApiToken"); const letsencryptEmail = config.requireSecret("letsencryptEmail"); + const kubeVipAddress = config.requireSecret("kubeVipAddress"); const kubeVipInterface = config.require("kubeVipInterface"); @@ -41,9 +45,9 @@ const nfsCsiDriver = new k8s.helm.v3.Release( ); new k8s.storage.v1.StorageClass( - "truenas-nfs", + nfsStorageClass, { - metadata: { name: "truenas-nfs" }, + metadata: { name: nfsStorageClass }, provisioner: "nfs.csi.k8s.io", parameters: { server: truenasHost, @@ -321,6 +325,11 @@ const cloudProviderClusterRoleBinding = new k8s.rbac.v1.ClusterRoleBinding( opts(), ); +const kubeVipCloudProviderLabels = { + app: "kube-vip", + component: "kube-vip-cloud-provider", +}; + // IP pool the cloud-provider allocates from — scoped to exactly the one VIP we // want, so it can never hand the address to some other LoadBalancer Service. const kubeVipPool = new k8s.core.v1.ConfigMap( @@ -339,11 +348,11 @@ const kubeVipCloudProvider = new k8s.apps.v1.Deployment( spec: { replicas: 1, selector: { - matchLabels: { app: "kube-vip", component: "kube-vip-cloud-provider" }, + matchLabels: kubeVipCloudProviderLabels, }, template: { metadata: { - labels: { app: "kube-vip", component: "kube-vip-cloud-provider" }, + labels: kubeVipCloudProviderLabels, }, spec: { serviceAccountName: cloudProviderServiceAccount.metadata.name, @@ -379,4 +388,3 @@ new k8s.core.v1.ServicePatch( opts({ dependsOn: [kubeVip, kubeVipCloudProvider] }), ); -export const storageClass = "truenas-nfs"; diff --git a/04-k8s-apps/index.ts b/04-k8s-apps/index.ts index c002a63..5bd8b8c 100644 --- a/04-k8s-apps/index.ts +++ b/04-k8s-apps/index.ts @@ -16,7 +16,7 @@ const opts = (extras?: pulumi.ResourceOptions): pulumi.ResourceOptions => ({ ...extras, }); -const ns = new k8s.core.v1.Namespace( +const heimdallNs = new k8s.core.v1.Namespace( "heimdall", { metadata: { name: "heimdall" } }, opts(), @@ -25,7 +25,7 @@ const ns = new k8s.core.v1.Namespace( const pvc = new k8s.core.v1.PersistentVolumeClaim( "heimdall-config", { - metadata: { name: "heimdall-config", namespace: ns.metadata.name }, + metadata: { name: "heimdall-config", namespace: heimdallNs.metadata.name }, spec: { accessModes: ["ReadWriteOnce"], storageClassName: "longhorn", @@ -42,7 +42,7 @@ new k8s.apps.v1.Deployment( { metadata: { name: "heimdall", - namespace: ns.metadata.name, + namespace: heimdallNs.metadata.name, annotations: { "pulumi.com/patchForce": "true" }, }, spec: { @@ -80,7 +80,7 @@ new k8s.apps.v1.Deployment( const svc = new k8s.core.v1.Service( "heimdall", { - metadata: { name: "heimdall", namespace: ns.metadata.name }, + metadata: { name: "heimdall", namespace: heimdallNs.metadata.name }, spec: { selector: labels, ports: [{ port: 80, targetPort: 80 }], @@ -97,7 +97,7 @@ new k8s.networking.v1.Ingress( { metadata: { name: "heimdall", - namespace: ns.metadata.name, + namespace: heimdallNs.metadata.name, annotations: { "cert-manager.io/cluster-issuer": "letsencrypt-prod", }, diff --git a/05-monitoring/index.ts b/05-monitoring/index.ts index fa2ef68..2faaa1e 100644 --- a/05-monitoring/index.ts +++ b/05-monitoring/index.ts @@ -16,7 +16,7 @@ const grafanaAdminPassword = config.requireSecret("grafanaAdminPassword"); const k8sProvider = new k8s.Provider("k3s", { kubeconfig }); -const ns = new k8s.core.v1.Namespace( +const monitoringNs = new k8s.core.v1.Namespace( "monitoring", { metadata: { name: "monitoring" } }, { provider: k8sProvider, import: "monitoring" }, @@ -30,7 +30,7 @@ new k8s.helm.v3.Release( name: "kube-prometheus-stack", chart: "kube-prometheus-stack", version: "86.2.0", - namespace: ns.metadata.name, + namespace: monitoringNs.metadata.name, repositoryOpts: { repo: "https://prometheus-community.github.io/helm-charts", },