kubernetes deployment strategy notes

teleport/README.md

@@ -0,0 +1 @@
+no AI here.  literally just followed the instructions https://goteleport.com/docs/installation/self-hosted/helm-deployments/kubernetes-cluster/

teleport/certificate.yaml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  name: letsencrypt
+  namespace: teleport-cluster
+spec:
+  commonName: 'teleport.k8s.lab.cudanet.org'
+  dnsNames:
+  - 'teleport.k8s.lab.cudanet.org'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt
+  renewBefore: 360h0m0s
+  secretName: letsencrypt
+  usages:
+  - server auth
+  - client auth

teleport/ingress.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: teleport-ingress
+  namespace: teleport-cluster
+  annotations:
+spec:
+  tls:
+    - hosts:
+        - teleport.k8s.lab.cudanet.org
+      secretName: letsencrypt
+  rules:
+    - host: teleport.k8s.lab.cudanet.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: teleport-cluster
+                port:
+                  number: 443

teleport/ingressroute.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: teleport-backend-transport
+  namespace: teleport-cluster
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: teleport-web
+  namespace: teleport-cluster
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`teleport.k8s.lab.cudanet.org`)
+      kind: Rule
+      services:
+        - name: teleport-cluster
+          port: 443
+          scheme: https # Crucial if Teleport expects HTTPS internally
+  tls:
+    secretName: letsencrypt

teleport/middlewares.yaml

@@ -0,0 +1,10 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: teleport-headers
+  namespace: teleport-cluster
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      X-Forwarded-Ssl: "on"

teleport/teleport-cluster-values.yaml

@@ -0,0 +1,3 @@
+clusterName: clusterName
+proxyListenerMode: multiplex
+acme: false