+ Architecture
+
+
+ Overview
+ The infrastructure runs on a single Dell R730 server (22 CPU cores, 142GB RAM) using Proxmox to manage virtual machines. Five of those VMs form a Kubernetes cluster that runs 70+ services.
+
+Proxmox (Dell R730)
+ ├── k8s-master (10.0.20.100) — control plane
+ ├── k8s-node1 (10.0.20.101) — GPU node (Tesla T4)
+ ├── k8s-node2 (10.0.20.102) — worker
+ ├── k8s-node3 (10.0.20.103) — worker
+ ├── k8s-node4 (10.0.20.104) — worker
+ ├── TrueNAS (10.0.10.15) — storage (NFS + iSCSI)
+ └── pfSense (10.0.20.1) — firewall + gateway
+
+
+
+ Networking
+
+ - Public domain:
viktorbarzin.me — managed by Cloudflare
+ - Internal domain:
viktorbarzin.lan — managed by Technitium DNS
+ - Ingress: Cloudflare → Traefik → services
+ - VPN: Headscale (self-hosted Tailscale)
+
+
+
+
+ Storage
+
+ - NFS (
nfs-truenas) — for app data (files, configs, media). Stored on TrueNAS.
+ - iSCSI (
iscsi-truenas) — for databases (PostgreSQL, MySQL). Block storage.
+
+
+
+
+ Service Tiers
+ Services are organized into tiers that control resource limits and restart priority:
+
+ | Tier | Examples | Priority |
|---|
+
+ | 0-core | Traefik, DNS, VPN, Auth | Highest — never evicted |
+ | 1-cluster | Redis, Prometheus, CrowdSec | High |
+ | 2-gpu | Ollama, Immich ML, Whisper | Medium |
+ | 3-edge | Nextcloud, Paperless, Grafana | Normal |
+ | 4-aux | Dashy, PrivateBin, CyberChef | Low — evicted first under pressure |
+
+
+
+
+
+ Infrastructure as Code
+ Everything is managed with Terraform (via Terragrunt). Each service has its own stack:
+ stacks/
+ ├── platform/ ← core infra (22 modules)
+ ├── url/ ← URL shortener (Shlink)
+ ├── immich/ ← photo library
+ ├── nextcloud/ ← file storage
+ └── ... (70+ more)
+ Changes go through git: branch → PR → review → merge → CI applies automatically.
+
+
+
+
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/contributing/+page.svelte b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/contributing/+page.svelte
new file mode 100644
index 00000000..2375a2cb
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/contributing/+page.svelte
@@ -0,0 +1,115 @@
+
+ How to Contribute
+
+
+ Workflow
+
+ - Create a branch:
git checkout -b fix/my-change
+ - Make your changes in
stacks/<service>/main.tf
+ - Push and open a PR:
git push -u origin fix/my-change
+ - Viktor reviews and merges
+ - CI applies automatically — Slack notification when done
+
+
+
+
+ What you CAN change
+
+ - Service configurations (image tags, environment variables, resource limits)
+ - New services (add a new stack under
stacks/)
+ - Ingress routes, health probes, replica counts
+
+
+
+
+ What needs Viktor's review
+
+ - CI pipeline changes (
.woodpecker/)
+ - Terragrunt configuration (
terragrunt.hcl)
+ - Secrets configuration (
.sops.yaml)
+ - Core platform modules (
stacks/platform/)
+
+
+
+
+
+
+
+ - Never
kubectl apply/edit/patch — all changes go through Terraform
+ - Never put secrets in code — ask Viktor to add them to the encrypted secrets file
+ - Never restart NFS on TrueNAS — causes cluster-wide mount failures
+ - Never push directly to master — always use a PR
+
+
Need a new secret?
+ Comment on your PR: "I need a database password for my-service." Viktor will add it to the encrypted secrets file and push to your branch.
+ Then reference it in your Terraform: var.my_service_db_password
+
+
+
+ Namespace Owner Workflow
+ If you are a namespace owner, you can deploy your own apps:
+
+ - Clone the infra repo:
git clone https://github.com/ViktorBarzin/infra.git
+ - Copy the template:
cp -r stacks/_template stacks/your-app
+ - Rename:
mv stacks/your-app/main.tf.example stacks/your-app/main.tf
+ - Edit
main.tf — replace all <placeholders>
+ - Store secrets in Vault:
vault kv put secret/your-username/your-app KEY=value
+ - Add your app domain to your
domains list in Vault KV
+ - Submit a PR, get it reviewed
+ - After merge, admin runs
terragrunt apply
+
+
+
+
+ CI Pipeline Template
+ Create a .woodpecker.yml in your app's Forgejo repo:
+ {`steps:
+ - name: build
+ image: woodpeckerci/plugin-docker-buildx
+ settings:
+ repo: your-dockerhub-user/myapp
+ tag: ["\${CI_PIPELINE_NUMBER}", "latest"]
+ username:
+ from_secret: dockerhub-username
+ password:
+ from_secret: dockerhub-token
+ platforms: linux/amd64
+
+ - name: deploy
+ image: hashicorp/vault:1.18.1
+ commands:
+ - export VAULT_ADDR=http://vault-active.vault.svc.cluster.local:8200
+ - export VAULT_TOKEN=$(vault write -field=token auth/kubernetes/login
+ role=ci jwt=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token))
+ - KUBE_TOKEN=$(vault write -field=service_account_token
+ kubernetes/creds/YOUR_NAMESPACE-deployer
+ kubernetes_namespace=YOUR_NAMESPACE)
+ - kubectl --server=https://kubernetes.default.svc
+ --token=$KUBE_TOKEN
+ --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+ -n YOUR_NAMESPACE set image deployment/myapp
+ myapp=your-dockerhub-user/myapp:\${CI_PIPELINE_NUMBER}`}
+
+
+
+ Need a secret for your app?
+ As a namespace owner, you manage your own secrets in Vault:
+ vault kv put secret/your-username/your-app DB_PASSWORD=mysecret API_KEY=abc123
+ Then reference them in your Terraform using a data "vault_kv_secret_v2" block.
+
+
+
+
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/download/+server.ts b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/download/+server.ts
new file mode 100644
index 00000000..28981156
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/download/+server.ts
@@ -0,0 +1,58 @@
+import type { RequestHandler } from './$types';
+import { readFileSync } from 'fs';
+
+const CLUSTER_SERVER = 'https://10.0.20.100:6443';
+const OIDC_ISSUER = 'https://authentik.viktorbarzin.me/application/o/kubernetes/';
+const OIDC_CLIENT_ID = 'kubernetes';
+
+export const GET: RequestHandler = async ({ request }) => {
+ const email = request.headers.get('x-authentik-email') || 'user';
+
+ // Read CA cert from mounted ConfigMap
+ let caCert = '';
+ try {
+ caCert = readFileSync('/config/ca.crt', 'utf-8');
+ } catch {
+ // CA cert not available
+ }
+
+ const caCertBase64 = Buffer.from(caCert).toString('base64');
+ const sanitizedEmail = email.replace(/[^a-zA-Z0-9@._-]/g, '');
+
+ const kubeconfig = `apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+ server: ${CLUSTER_SERVER}
+ certificate-authority-data: ${caCertBase64}
+ name: home-cluster
+contexts:
+- context:
+ cluster: home-cluster
+ user: oidc-${sanitizedEmail}
+ name: home-cluster
+current-context: home-cluster
+users:
+- name: oidc-${sanitizedEmail}
+ user:
+ exec:
+ apiVersion: client.authentication.k8s.io/v1beta1
+ command: kubectl
+ args:
+ - oidc-login
+ - get-token
+ - --oidc-issuer-url=${OIDC_ISSUER}
+ - --oidc-client-id=${OIDC_CLIENT_ID}
+ - --oidc-extra-scope=email
+ - --oidc-extra-scope=profile
+ - --oidc-extra-scope=groups
+ interactiveMode: IfAvailable
+`;
+
+ return new Response(kubeconfig, {
+ headers: {
+ 'Content-Type': 'application/yaml',
+ 'Content-Disposition': `attachment; filename="kubeconfig-home-cluster.yaml"`
+ }
+ });
+};
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/onboarding/+page.svelte b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/onboarding/+page.svelte
new file mode 100644
index 00000000..812ea24e
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/onboarding/+page.svelte
@@ -0,0 +1,146 @@
+
+
+
+ Getting Started
+ Welcome! Follow these steps to get access to the home Kubernetes cluster.
+
+
+
+
+ Step 0 — Join the VPN
+ The cluster is on a private network (10.0.20.0/24). You need VPN access first.
+
+ - Install Tailscale for your OS
+ - Run this in your terminal:
+
tailscale login --login-server https://headscale.viktorbarzin.me
+
+ - A browser window will open with a registration URL
+ - Send that URL to Viktor via email (vbarzin@gmail.com) or Slack
+ - Wait for approval (usually within a few hours)
+ - Once approved, test:
ping 10.0.20.100
+
+
+
+
+ Step 1 — Log in to the portal
+ Visit k8s-portal.viktorbarzin.me and sign in with your Authentik account.
+ If you don't have an account yet, ask Viktor to create one.
+
+
+
+ Step 2 — Set up kubectl
+ Run one of these commands in your terminal to install everything automatically:
+ macOS
+ Requires Homebrew. Install it first if you don't have it.
+ bash <(curl -fsSL https://k8s-portal.viktorbarzin.me/setup/script?os=mac)
+ Linux
+ bash <(curl -fsSL https://k8s-portal.viktorbarzin.me/setup/script?os=linux)
+ Windows
+ Use WSL2 and follow the Linux instructions.
+
+
+ {#if showNamespaceOwner}
+
+ Step 3 — Log into Vault
+ Vault manages your secrets and issues dynamic Kubernetes credentials.
+ vault login -method=oidc
+ This opens your browser for Authentik SSO. After login, your token is saved to ~/.vault-token.
+
+
+
+ Step 4 — Verify kubectl access
+ Run this command. It will open your browser for OIDC login the first time:
+ kubectl get pods -n YOUR_NAMESPACE
+ You should see an empty list (no resources) or your running pods.
+
+
+
+ Step 5 — Clone the infra repo
+ git clone https://github.com/ViktorBarzin/infra.git
+cd infra
+ This is where all the infrastructure configuration lives.
+
+
+
+ Step 6 — Create your first app stack
+
+ - Copy the template:
cp -r stacks/_template stacks/myapp
+mv stacks/myapp/main.tf.example stacks/myapp/main.tf
+ - Edit
stacks/myapp/main.tf — replace all <placeholders>
+ - Store secrets in Vault:
+
vault kv put secret/YOUR_USERNAME/myapp DB_PASSWORD=secret123
+
+ - Add your app domain to
domains list in Vault KV k8s_users
+ - Submit a PR:
+
git checkout -b feat/myapp
+git add stacks/myapp/
+git commit -m "add myapp stack"
+git push -u origin feat/myapp
+
+ - Viktor reviews and merges
+ - After merge:
cd stacks/myapp && terragrunt apply
+
+
+ {:else}
+
+ Step 3 — Verify access
+ Run this command. It will open your browser for login the first time:
+ kubectl get namespaces
+ You should see output like:
+ NAME STATUS AGE
+default Active 200d
+kube-system Active 200d
+monitoring Active 200d
+...
+ If you get a connection error, make sure your VPN is connected (tailscale status).
+
+
+
+ Step 4 — Clone the repo
+ git clone https://github.com/ViktorBarzin/infra.git
+cd infra
+ This is where all the infrastructure configuration lives.
+
+
+
+ Step 5 — Install your AI assistant (optional)
+ Install Codex CLI for AI-assisted cluster management:
+ npm install -g @openai/codex
+ Codex reads the AGENTS.md file in the repo and knows how to work with the cluster.
+
+
+
+ Step 6 — Your first change
+
+ - Create a branch:
git checkout -b my-first-change
+ - Edit a service file (e.g., change an image tag in
stacks/echo/main.tf)
+ - Commit and push:
git add . && git commit -m "my first change" && git push -u origin my-first-change
+ - Open a Pull Request on GitHub
+ - Viktor reviews and merges
+ - Woodpecker CI automatically applies the change to the cluster
+ - Slack notification confirms it worked
+
+
+ {/if}
+
+
+
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/services/+page.svelte b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/services/+page.svelte
new file mode 100644
index 00000000..e9648bde
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/services/+page.svelte
@@ -0,0 +1,58 @@
+
+ Service Catalog
+ 70+ services running on the cluster. Here are the most commonly used:
+
+
+
+
+ User-Facing Services
+
+
+
+
+
+
+
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/src/routes/setup/+page.svelte b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/setup/+page.svelte
new file mode 100644
index 00000000..520681d4
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/src/routes/setup/+page.svelte
@@ -0,0 +1,69 @@
+
+ Troubleshooting
+
+
+ "kubectl can't connect to the server"
+
+ - Check your VPN:
tailscale status — should show "connected"
+ - Check KUBECONFIG:
echo $KUBECONFIG — should be ~/.kube/config-home
+ - Test connectivity:
ping 10.0.20.100
+ - If ping works but kubectl doesn't, re-run the setup script
+
+
+
+
+ "Forbidden" or "Permission denied"
+ You may not have access to that namespace. Your access is scoped to specific namespaces.
+ Try: kubectl get namespaces to see which namespaces you can access.
+ Need access to another namespace? Ask Viktor.
+
+
+
+ "Pod is CrashLoopBackOff"
+
+ - Check pod logs:
kubectl logs -n <namespace> <pod-name> --tail=50
+ - Check previous crash:
kubectl logs -n <namespace> <pod-name> --previous
+ - Check events:
kubectl describe pod -n <namespace> <pod-name>
+ - Common causes: OOMKilled (need more memory), bad config, database connection failure
+
+
+
+
+ "PR CI failed"
+
+ - Check the Woodpecker CI dashboard: ci.viktorbarzin.me
+ - Read the build logs — the error is usually at the bottom
+ - Fix the issue, commit, and push — CI will re-run
+
+
+
+
+ "I need a new secret / database password"
+ Secrets are managed by Viktor in an encrypted file. You cannot add them yourself.
+
+ - Comment on your PR: "Need DB password for <service>"
+ - Viktor adds the secret and pushes to your branch
+ - Reference it as
var.<service>_db_password in your Terraform
+
+
+
+
+
+
+
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/static/robots.txt b/stacks/k8s-portal/modules/k8s-portal/files/static/robots.txt
new file mode 100644
index 00000000..b6dd6670
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/static/robots.txt
@@ -0,0 +1,3 @@
+# allow crawling everything by default
+User-agent: *
+Disallow:
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/svelte.config.js b/stacks/k8s-portal/modules/k8s-portal/files/svelte.config.js
new file mode 100644
index 00000000..6bfb3c40
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/svelte.config.js
@@ -0,0 +1,10 @@
+import adapter from '@sveltejs/adapter-node';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+ kit: {
+ adapter: adapter()
+ }
+};
+
+export default config;
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/tsconfig.json b/stacks/k8s-portal/modules/k8s-portal/files/tsconfig.json
new file mode 100644
index 00000000..2c2ed3c4
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/tsconfig.json
@@ -0,0 +1,20 @@
+{
+ "extends": "./.svelte-kit/tsconfig.json",
+ "compilerOptions": {
+ "rewriteRelativeImportExtensions": true,
+ "allowJs": true,
+ "checkJs": true,
+ "esModuleInterop": true,
+ "forceConsistentCasingInFileNames": true,
+ "resolveJsonModule": true,
+ "skipLibCheck": true,
+ "sourceMap": true,
+ "strict": true,
+ "moduleResolution": "bundler"
+ }
+ // Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+ // except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+ //
+ // To make changes to top-level options such as include and exclude, we recommend extending
+ // the generated config; see https://svelte.dev/docs/kit/configuration#typescript
+}
diff --git a/stacks/k8s-portal/modules/k8s-portal/files/vite.config.ts b/stacks/k8s-portal/modules/k8s-portal/files/vite.config.ts
new file mode 100644
index 00000000..bbf8c7da
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/files/vite.config.ts
@@ -0,0 +1,6 @@
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+ plugins: [sveltekit()]
+});
diff --git a/stacks/k8s-portal/modules/k8s-portal/main.tf b/stacks/k8s-portal/modules/k8s-portal/main.tf
new file mode 100644
index 00000000..53c375d6
--- /dev/null
+++ b/stacks/k8s-portal/modules/k8s-portal/main.tf
@@ -0,0 +1,166 @@
+variable "tls_secret_name" {}
+variable "tier" { type = string }
+variable "k8s_ca_cert" {
+ type = string
+ default = ""
+}
+
+resource "kubernetes_namespace" "k8s_portal" {
+ metadata {
+ name = "k8s-portal"
+ labels = {
+ tier = var.tier
+ }
+ }
+}
+
+module "tls_secret" {
+ source = "../../../../modules/kubernetes/setup_tls_secret"
+ namespace = kubernetes_namespace.k8s_portal.metadata[0].name
+ tls_secret_name = var.tls_secret_name
+}
+
+resource "kubernetes_config_map" "k8s_portal_config" {
+ metadata {
+ name = "k8s-portal-config"
+ namespace = kubernetes_namespace.k8s_portal.metadata[0].name
+ }
+
+ data = {
+ "ca.crt" = var.k8s_ca_cert
+ }
+}
+
+resource "kubernetes_deployment" "k8s_portal" {
+ metadata {
+ name = "k8s-portal"
+ namespace = kubernetes_namespace.k8s_portal.metadata[0].name
+ labels = {
+ app = "k8s-portal"
+ tier = var.tier
+ }
+ }
+
+ spec {
+ replicas = 1
+ strategy {
+ type = "Recreate"
+ }
+ revision_history_limit = 3
+ selector {
+ match_labels = {
+ app = "k8s-portal"
+ }
+ }
+
+ template {
+ metadata {
+ labels = {
+ app = "k8s-portal"
+ }
+ }
+
+ spec {
+ container {
+ name = "portal"
+ image = "viktorbarzin/k8s-portal:latest"
+ port {
+ container_port = 3000
+ }
+
+ volume_mount {
+ name = "config"
+ mount_path = "/config/ca.crt"
+ sub_path = "ca.crt"
+ read_only = true
+ }
+ volume_mount {
+ name = "user-roles"
+ mount_path = "/config/users.json"
+ sub_path = "users.json"
+ read_only = true
+ }
+ resources {
+ requests = {
+ cpu = "10m"
+ memory = "128Mi"
+ }
+ limits = {
+ memory = "128Mi"
+ }
+ }
+ }
+
+ volume {
+ name = "config"
+ config_map {
+ name = kubernetes_config_map.k8s_portal_config.metadata[0].name
+ }
+ }
+ volume {
+ name = "user-roles"
+ config_map {
+ name = "k8s-user-roles"
+ }
+ }
+ dns_config {
+ option {
+ name = "ndots"
+ value = "2"
+ }
+ }
+ }
+ }
+ }
+ lifecycle {
+ ignore_changes = [
+ spec[0].template[0].spec[0].dns_config,
+ spec[0].template[0].spec[0].container[0].image, # CI updates image tag
+ ]
+ }
+}
+
+resource "kubernetes_service" "k8s_portal" {
+ metadata {
+ name = "k8s-portal"
+ namespace = kubernetes_namespace.k8s_portal.metadata[0].name
+ }
+
+ spec {
+ selector = {
+ app = "k8s-portal"
+ }
+ port {
+ port = 80
+ target_port = 3000
+ }
+ }
+}
+
+module "ingress" {
+ source = "../../../../modules/kubernetes/ingress_factory"
+ namespace = kubernetes_namespace.k8s_portal.metadata[0].name
+ name = "k8s-portal"
+ tls_secret_name = var.tls_secret_name
+ protected = true # Require Authentik login
+ extra_annotations = {
+ "gethomepage.dev/enabled" = "true"
+ "gethomepage.dev/name" = "K8s Portal"
+ "gethomepage.dev/description" = "Kubernetes portal"
+ "gethomepage.dev/icon" = "kubernetes.png"
+ "gethomepage.dev/group" = "Core Platform"
+ "gethomepage.dev/pod-selector" = ""
+ }
+}
+
+# Unprotected ingress for the setup script and agent endpoint (needs to be curl-able without auth)
+module "ingress_setup_script" {
+ source = "../../../../modules/kubernetes/ingress_factory"
+ namespace = kubernetes_namespace.k8s_portal.metadata[0].name
+ name = "k8s-portal-setup"
+ host = "k8s-portal"
+ service_name = "k8s-portal"
+ ingress_path = ["/setup/script", "/agent"]
+ tls_secret_name = var.tls_secret_name
+ protected = false
+}
diff --git a/stacks/k8s-portal/secrets b/stacks/k8s-portal/secrets
new file mode 120000
index 00000000..ca54a7cf
--- /dev/null
+++ b/stacks/k8s-portal/secrets
@@ -0,0 +1 @@
+../../secrets
\ No newline at end of file
diff --git a/stacks/k8s-portal/terragrunt.hcl b/stacks/k8s-portal/terragrunt.hcl
new file mode 100644
index 00000000..4f16dddf
--- /dev/null
+++ b/stacks/k8s-portal/terragrunt.hcl
@@ -0,0 +1,8 @@
+include "root" {
+ path = find_in_parent_folders()
+}
+
+dependency "infra" {
+ config_path = "../infra"
+ skip_outputs = true
+}
diff --git a/stacks/k8s-portal/tiers.tf b/stacks/k8s-portal/tiers.tf
new file mode 100644
index 00000000..eb0f8083
--- /dev/null
+++ b/stacks/k8s-portal/tiers.tf
@@ -0,0 +1,10 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+locals {
+ tiers = {
+ core = "0-core"
+ cluster = "1-cluster"
+ gpu = "2-gpu"
+ edge = "3-edge"
+ aux = "4-aux"
+ }
+}
diff --git a/stacks/metallb/main.tf b/stacks/metallb/main.tf
new file mode 100644
index 00000000..54d21f69
--- /dev/null
+++ b/stacks/metallb/main.tf
@@ -0,0 +1,4 @@
+module "metallb" {
+ source = "./modules/metallb"
+ tier = local.tiers.core
+}
diff --git a/stacks/metallb/modules/metallb/main.tf b/stacks/metallb/modules/metallb/main.tf
new file mode 100644
index 00000000..1659f08e
--- /dev/null
+++ b/stacks/metallb/modules/metallb/main.tf
@@ -0,0 +1,40 @@
+# Creates namespace and everythin needed
+# Do not use until https://github.com/colinwilson/terraform-kubernetes-metallb/issues/5 is solved
+# module "metallb" {
+# source = "colinwilson/metallb/kubernetes"
+# version = "0.1.7"
+# }
+variable "tier" { type = string }
+
+resource "kubernetes_namespace" "metallb" {
+ metadata {
+ name = "metallb-system"
+ labels = {
+ app = "metallb"
+ # "istio-injection" : "disabled"
+ # tier = var.tier
+ }
+ }
+}
+
+module "metallb" {
+ source = "ViktorBarzin/metallb/kubernetes"
+ version = "0.1.5"
+ depends_on = [kubernetes_namespace.metallb]
+}
+
+resource "kubernetes_config_map" "config" {
+ metadata {
+ name = "config"
+ namespace = kubernetes_namespace.metallb.metadata[0].name
+ }
+ data = {
+ config = <