55 lines
2.3 KiB
YAML
55 lines
2.3 KiB
YAML
# MetalLB, installed like any other app: an Application pointing at
|
|
# apps/metallb, a Helm chart (see apps/metallb/Chart.yaml) that pulls in the
|
|
# upstream chart and carries this cluster's IPAddressPool, BGPPeer, and
|
|
# BGPAdvertisement templates. Together they let the MikroTik route dedicated
|
|
# 10.10.60.x addresses to LoadBalancer Services—something bare-metal
|
|
# Kubernetes does not provide on its own. See docs/05-metallb.md.
|
|
#
|
|
# Everything — MetalLB's own resources (including its CRDs) and our two
|
|
# custom resources that depend on them — comes from this one Application,
|
|
# in one sync. The ordering that makes that safe lives on the individual
|
|
# resources in apps/metallb/templates/, via the
|
|
# argocd.argoproj.io/sync-wave annotation: MetalLB's chart resources apply
|
|
# at the default wave ("0"), and our IPAddressPool/L2Advertisement are
|
|
# marked wave "1" so Argo CD waits for MetalLB to be synced and healthy
|
|
# (CRDs registered, controller and speaker running) before applying them.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: metallb
|
|
namespace: argocd
|
|
# Without this finalizer, deleting this Application object only makes
|
|
# Argo CD forget about its resources — MetalLB's Pods, CRDs, and our
|
|
# BGPPeer/BGPAdvertisement would keep running, orphaned. This finalizer
|
|
# makes deletion cascade properly. Safe here because MetalLB holds no
|
|
# data of its own — contrast with apps/longhorn.yaml below.
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: default
|
|
|
|
source:
|
|
repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
|
|
targetRevision: main
|
|
path: apps/metallb
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: metallb-system
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
# MetalLB's speaker and FRR Pods use host networking and Linux network
|
|
# capabilities so they can establish BGP sessions. Kubernetes' baseline
|
|
# Pod Security policy rejects those by design; privilege is scoped to this
|
|
# dedicated namespace rather than weakened cluster-wide.
|
|
managedNamespaceMetadata:
|
|
labels:
|
|
pod-security.kubernetes.io/enforce: privileged
|
|
pod-security.kubernetes.io/audit: privileged
|
|
pod-security.kubernetes.io/warn: privileged
|
|
syncOptions:
|
|
- CreateNamespace=true
|