オンプレミスでHCI環境を構築してサービスを公開するまで

helm upgrade rancher rancher-stable/rancher --install --create-namespace \
        --namespace cattle-system --create-namespace \
        --set hostname=example.com \
        --set replicas=1 \
        --set bootstrapPassword=password \
        --set letsEncrypt.ingress.class=nginx \
        --set ingress.tls.source=letsEncrypt \
        --set [email protected]

helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace

helm install \
        cert-manager jetstack/cert-manager \
        --namespace cert-manager \
        --create-namespace \
        --set crds.enabled=true

apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-controller
data:
  use-forwarded-headers: "true"

#cloud-config
package_update: true
packages:
  - qemu-guest-agent
+  - cifs-utils
+  - nfs-common
runcmd:
  - - systemctl
    - enable
    - '--now'
    - qemu-guest-agent.service

controller:

  # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
  config: {
      "enable-real-ip": "true",
      "use-forwarded-headers": "true",
      "ssl-redirect": "false",
      "client_body_buffer_siz": "32k",
      "proxy-body-size": "0",
      "proxy-connect-timeout": "600",
      "proxy-read-timeout": "600",
      "proxy-send-timeout": "600",
      "allow-snippet-annotations": "true",
      "enable-modsecurity": "true",
      "enable-owasp-modsecurity-crs": "true",
      "modsecurity-snippet": "SecAuditLog /dev/stdout\nSecRequestBodyAccess On\nSecRuleRemoveById 920350\nSecAuditLogFormat JSON",
  }
  service:
    enabled: true

    annotations:
      prometheus.io/port: "10254"
      prometheus.io/scrape: "true"
      cloudprovider.harvesterhci.io/ipam: "dhcp"

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: cert-manager
type: Opaque
stringData:
  api-token: <api-token>

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
  namespace: cert-manager
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [email protected]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - dns01:
        cloudflare:
          email: [email protected] # cloudflareのメールアドレス
          apiTokenSecretRef:
            name: cloudflare-api-token-secret
            key: api-token
      selector:
        dnsZones:
        - 'example.com'

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: bootcamp
  name: bootcamp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: bootcamp
  template:
    metadata:
      labels:
        app: bootcamp
    spec:
      containers:
      - image: gcr.io/google-samples/kubernetes-bootcamp:v1
        name: bootcamp
        ports:
        - containerPort: 8080
      dnsPolicy: ClusterFirst
      restartPolicy: Always

---

apiVersion: v1
kind: Service
metadata:
  name: bootcamp
  labels:
    app: bootcamp
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: bootcamp

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: bootcamp
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    secretName: bootcamp-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: bootcamp
            port:
              number: 80