viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

add oidc to headscale and move technitium to a nodeport service [ci skip]

Browse source
This commit is contained in:
Viktor Barzin 2023-09-15 22:55:13 +00:00
parent f1714a9baf
commit fae0f42407
1 changed files with 13 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

23
modules/kubernetes/technitium/main.tf
View file

@ -12,8 +12,8 @@ module "tls_secret" {
tls_secret_name = var.tls_secret_name tls_secret_name = var.tls_secret_name
} }
# resource "kubernetes_deployment" "technitium" { resource "kubernetes_deployment" "technitium" {
resource "kubernetes_daemonset" "technitium" { # resource "kubernetes_daemonset" "technitium" {
metadata { metadata {
name = "technitium" name = "technitium"
namespace = "technitium" namespace = "technitium"
@ -35,6 +35,7 @@ resource "kubernetes_daemonset" "technitium" {
} }
} }
spec { spec {
node_name = "k8s-node1" # Horrible hack but only way I found to preserve client ip
container { container {
image = "technitium/dns-server:latest" image = "technitium/dns-server:latest"
name = "technitium" name = "technitium"
@ -111,18 +112,20 @@ resource "kubernetes_service" "technitium-dns" {
} }
spec { spec {
type = "LoadBalancer" # type = "LoadBalancer"
# external_traffic_policy = "Cluster" # external_traffic_policy = "Cluster"
type = "NodePort"
port {
name = "technitium-dns"
port = 53
node_port = 30053
protocol = "UDP"
}
external_traffic_policy = "Local" external_traffic_policy = "Local"
selector = { selector = {
app = "technitium" app = "technitium"
} }
port {
name = "technitium-dns"
port = "53"
protocol = "UDP"
}
} }
} }
@ -131,8 +134,8 @@ resource "kubernetes_ingress_v1" "technitium" {
name = "technitium-ingress" name = "technitium-ingress"
namespace = "technitium" namespace = "technitium"
annotations = { annotations = {
"kubernetes.io/ingress.class" = "nginx" "kubernetes.io/ingress.class" = "nginx"
"nginx.ingress.kubernetes.io/affinity" = "cookie" "nginx.ingress.kubernetes.io/affinity" = "cookie"
"nginx.ingress.kubernetes.io/auth-tls-verify-client" = "on" "nginx.ingress.kubernetes.io/auth-tls-verify-client" = "on"
"nginx.ingress.kubernetes.io/auth-tls-secret" = "default/ca-secret" "nginx.ingress.kubernetes.io/auth-tls-secret" = "default/ca-secret"
} }