feat: hcloud components

sergelogvinov · Dec 15, 2024 · 11190f5 · 11190f5
1 parent 8858f6b
commit 11190f5
Show file tree

Hide file tree

Showing 18 changed files with 957 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -42,6 +42,8 @@ Cloud platform integrations:
 * [Azure CSI](apps/clouds/azure-csi)
 * [GCP CCM](apps/clouds/gcp-ccm)
 * [GCP CSI](apps/clouds/gcp-csi)
+* [Hetzner Cloud CCM](apps/clouds/hcloud-ccm)
+* [Hetzner Cloud CSI](apps/clouds/hcloud-csi)
 * [Oracle CCM](apps/clouds/oracle-ccm)
 * [Oracle CSI](apps/clouds/oracle-csi)
 * [OVHCloud CCM](apps/clouds/ovh-ccm)
@@ -56,6 +58,7 @@ Cloud platform integrations:
 * [Cluster Node AutoScaler](apps/clouds/cluster-autoscaler)
     * [Azure](apps/clouds/cluster-autoscaler/azure)
     * [GCP](apps/clouds/cluster-autoscaler/gcp)
+    * [Hetzner Cloud](apps/clouds/cluster-autoscaler/hcloud)
     * [Oracle](apps/clouds/cluster-autoscaler/oracle)
 
 Cluster logging:

diff --git a/apps/clouds/cluster-autoscaler/hcloud/helmrelease.yaml b/apps/clouds/cluster-autoscaler/hcloud/helmrelease.yaml
@@ -0,0 +1,82 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cluster-autoscaler-gcp
+  namespace: kube-system
+spec:
+  interval: 60h
+
+  maxHistory: 2
+  driftDetection:
+    mode: enabled
+
+  chart:
+    spec:
+      chart: cluster-autoscaler
+      version: 9.43.2
+      sourceRef:
+        kind: HelmRepository
+        name: autoscaler
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+
+  valuesFrom:
+    - kind: ConfigMap
+      name: cluster-autoscaler-hcloud-helm-values
+
+  values:
+    fullnameOverride: cluster-autoscaler-hcloud
+    priorityClassName: system-cluster-critical
+
+    image:
+      repository: ghcr.io/sergelogvinov/cluster-autoscaler
+      tag: "1.31"
+
+    cloudProvider: hetzner
+
+    extraArgs:
+      regional: true
+      balance-similar-node-groups: true
+      logtostderr: true
+      stderrthreshold: info
+      scan-interval: 15s
+      scale-down-delay-after-add: 5m
+      v: 4
+
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      seccompProfile:
+        type: RuntimeDefault
+      capabilities:
+        drop: ["ALL"]
+
+    resources:
+      limits:
+        cpu: 100m
+        memory: 300Mi
+      requests:
+        cpu: 100m
+        memory: 300Mi
+
+    affinity:
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - preference:
+              matchExpressions:
+                - key: node.cloudprovider.kubernetes.io/platform
+                  operator: In
+                  values:
+                    - hcloud
+            weight: 100
+    nodeSelector:
+      node-role.kubernetes.io/control-plane: ""
+    tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        effect: NoSchedule
diff --git a/apps/clouds/cluster-autoscaler/hcloud/kustomization.yaml b/apps/clouds/cluster-autoscaler/hcloud/kustomization.yaml
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+resources:
+  - ./helmrelease.yaml
diff --git a/apps/clouds/hcloud-ccm/app/hcloud-ccm.yaml b/apps/clouds/hcloud-ccm/app/hcloud-ccm.yaml
@@ -0,0 +1,159 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cloud-controller-manager-hcloud
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:cloud-controller-manager-hcloud
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - create
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/status
+    verbs:
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts
+    verbs:
+      - create
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts/token
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: system:cloud-controller-manager:extension-apiserver-authentication-reader-hcloud
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - kind: ServiceAccount
+    name: cloud-controller-manager-hcloud
+    namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:cloud-controller-manager-hcloud
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:cloud-controller-manager-hcloud
+subjects:
+  - kind: ServiceAccount
+    name: cloud-controller-manager-hcloud
+    namespace: kube-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloud-controller-manager-hcloud
+  namespace: kube-system
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: hcloud-cloud-controller-manager
+      app.kubernetes.io/name: cloud-controller-manager-hcloud
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: hcloud-cloud-controller-manager
+        app.kubernetes.io/name: cloud-controller-manager-hcloud
+    spec:
+      containers:
+        - args:
+            - --allow-untagged-cloud
+            - --cloud-provider=hcloud
+            - --controllers=cloud-node-lifecycle
+            - --route-reconciliation-period=30s
+            - --webhook-secure-port=0
+            - --leader-elect=false
+          env:
+            - name: HCLOUD_INSTANCES_ADDRESS_FAMILY
+              value: dualstack
+            - name: HCLOUD_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  key: token
+                  name: hcloud
+            - name: ROBOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: robot-password
+                  name: hcloud
+                  optional: true
+            - name: ROBOT_USER
+              valueFrom:
+                secretKeyRef:
+                  key: robot-user
+                  name: hcloud
+                  optional: true
+          image: docker.io/hetznercloud/hcloud-cloud-controller-manager:v1.21.0
+          name: hcloud-cloud-controller-manager
+          ports:
+            - containerPort: 8233
+              name: metrics
+          resources:
+            requests:
+              cpu: 100m
+              memory: 50Mi
+      dnsPolicy: Default
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: ""
+      priorityClassName: system-cluster-critical
+      serviceAccountName: cloud-controller-manager-hcloud
+      tolerations:
+        - effect: NoSchedule
+          key: node.cloudprovider.kubernetes.io/uninitialized
+          value: "true"
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+          operator: Exists
+        - effect: NoExecute
+          key: node.kubernetes.io/not-ready
diff --git a/apps/clouds/hcloud-ccm/app/kustomization.yaml b/apps/clouds/hcloud-ccm/app/kustomization.yaml
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+resources:
+  - ./hcloud-ccm.yaml
diff --git a/apps/clouds/hcloud-ccm/fluxcd.yaml b/apps/clouds/hcloud-ccm/fluxcd.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app hcloud-ccm
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./apps/clouds/hcloud-ccm/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: gitops-clusters
+  wait: true
+  interval: 30m
+  retryInterval: 5m
diff --git a/apps/clouds/hcloud-ccm/generate/.gitignore b/apps/clouds/hcloud-ccm/generate/.gitignore
@@ -0,0 +1 @@
+charts/
diff --git a/apps/clouds/hcloud-ccm/generate/kustomization.yaml b/apps/clouds/hcloud-ccm/generate/kustomization.yaml
@@ -0,0 +1,46 @@
+---
+# kubectl kustomize --enable-helm apps/clouds/hcloud-ccm/generate > apps/clouds/hcloud-ccm/app/hcloud-ccm.yaml
+#
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - role.yaml
+  - rolebinding.yaml
+helmCharts:
+  - name: hcloud-cloud-controller-manager
+    valuesInline:
+      nameOverride: cloud-controller-manager-hcloud
+
+      args:
+        controllers: cloud-node-lifecycle
+
+      env:
+        HCLOUD_TOKEN:
+          valueFrom:
+            secretKeyRef:
+              name: hcloud
+              key: token
+        HCLOUD_INSTANCES_ADDRESS_FAMILY:
+          value: dualstack
+
+      robot:
+        enabled: false
+
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: ""
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          effect: NoSchedule
+    releaseName: hcloud-cloud-controller-manager
+    version: 1.21.0
+    repo: https://charts.hetzner.cloud
+namespace: kube-system
+patches:
+  - patch: |
+      - op: replace
+        path: /roleRef/name
+        value: system:cloud-controller-manager-hcloud
+    target:
+      kind: ClusterRoleBinding
+      name: system:cloud-controller-manager-hcloud
diff --git a/apps/clouds/hcloud-ccm/generate/role.yaml b/apps/clouds/hcloud-ccm/generate/role.yaml
@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:cloud-controller-manager-hcloud
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - create
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/status
+    verbs:
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts
+    verbs:
+      - create
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts/token
+    verbs:
+      - create