Kubernetes is hard--or is it? This repo is a collection of multi-platform images and container resource definitions for managing a software-dev organization using Kubernetes. These tools make it easy. Contents:
| Directory | Description |
|---|---|
| ansible | build your own Kubernetes cluster |
| images | images which are published to Docker Hub |
| k8s | kubernetes resources and helm charts |
| lib/build | build makefile and tools |
| services | non-clustered docker-compose services |
| ssl | PKI certificate tools (deprecated by k8s) |
Find images at docker hub/instantlinux or ghcr.io/instantlinux. Each image is scanned by trivy to ensure they contain no known CVE vulnerabilities before promotion to ghcr.io and Docker Hub.
Find a lot more details about the Kubernetes bare-metal installer in k8s/README.
The cluster-deployment tools here include helm charts and ansible playbooks to spin up bare-metal or VM master/worker nodes, and a Makefile to add several additional features.
- Direct-attached SSD local storage pools
- Non-default namespace with its own service account (full permissions within namespace, limited read-only in kube-system namespaces)
- Keycloak for OpenID / OAuth2 user authentication / authorization
- Vaultwarden, a self-hosted Bitwarden-compatible password manager
- Helm4
- Mozilla sops with encryption (to keep credentials in local git repo)
- Encryption for internal etcd
- MFA using Authelia and Google Authenticator
- Calico or flannel networking
- ingress-nginx
- Local-volume sync
- Garage object storage
- Pod security policies
- Automatic certificate issuing/renewal with Letsencrypt
- Grafana with prometheus-based alerting
Developer infrastructure
| Service | Version | Notes |
|---|---|---|
| gitea | ** | git repo |
| admin-git |  | sync git repo across cluster |
| gitea | ** | self-hosted git repo with many github features |
| jira | ** | ticket tracking |
| mariadb-galera |  | automatic cluster setup |
| nexus | ** | binary repo with docker registry |
| synapse | ** | self-hosted team chat |
| wordpress | ** |
Networking and support
| Service | Version | Notes |
|---|---|---|
| apache | ** | web server, with webdav example |
| authelia | ** | single-signon multi-factor auth |
| data-sync |  | poor-man's SAN for persistent storage |
| ddclient |  | Dynamic DNS client |
| ez-ipupdate |  | Dynamic DNS client |
| fluent-bit | ** | central logging for Kubernetes |
| garage | ** | S3-compatible object storage |
| grafana | ** | monitoring dashboard with prometheus-based alerting |
| guacamole | ** | authenticated remote-desktop server |
| haproxy-keepalived |  | load balancer |
| headscale | ** | tailscale-compatible VPN control-plane |
| mysqldump |  | per-database alternative to xtrabackup |
| nagios |  | Nagios Core v4 for monitoring |
| nagiosql |  | NagiosQL for configuring Nagios Core v4 |
| node-local-dns | ** | caching resolver for reliable pod DNS |
| nut-upsd |  | Network UPS Tools |
| openldap |  | OpenLDAP authentication server |
| proftpd |  | FTP server |
| radicale | ** | CalDAV / CardDAV for mobile calendar/contacts sync |
| restic | ** | backups |
| rsyslogd |  | logger in a 13MB image |
| samba |  | file server |
| samba-dc |  | Active-Directory compatible domain controller |
| secondshot |  | rsnapshot-based backups |
| splunk | ** | the free version |
| vaultwarden | ** | BitWarden-compatible self-hosted backend |
| virt-manager | ** | GUI and CLI for QEMU/KVM virtual machines |
| Service | Version | Notes |
|---|---|---|
| blacklist |  | a local rbldnsd for spam control |
| dovecot |  | imapd server |
| postfix |  | compact general-purpose image in 11MB |
| postfix-python |  | postfix with spam-control scripts |
| snappymail | ** | webmail, forked from rainloop imapd-client server |
| spamassassin |  | spam control daemon |
Entertainment
| Service | Version | Notes |
|---|---|---|
| davite |  | party-invites manager like eVite |
| immich | ** | immich self-hosted photo/video manager |
| mythtv-backend |  | MythTV backend |
| OwnTone | ** | iTunes server (formerly forked-daapd) |
| weewx |  | Weather station software (Davis VantagePro2 etc.) |
Thank you to the following contributors!
- Mike Neir
- Chad Hedstrom - personal site
- Sean Mollet
- Juan Manuel Carrillo Moreno - personal site
- nicxvan
- Frank Riley
- Devin Bayer
- Daniel Muller
- Brian Hechinger
- David Powers
- Alberto Galera
- Andrew Eacott
If you want to make improvements to this software, see CONTRIBUTING.
Contents created 2017-26 under Apache 2.0 License by Rich Braun.