add k3s over wireguard support

playbook/jobs/init_k3s_cluster

@@ -8,3 +8,4 @@
         name: k3s
       vars:
         group: master
+        namespace: default

playbook/roles/common/tasks/main.yml

@@ -10,6 +10,9 @@
 - name: Update /etc/hosts
   template: src=templates/hosts dest=/etc/hosts owner=root group=root mode=0644 force=yes unsafe_writes=yes
 
+- name: enable ip_forward
+  shell: 'echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf; echo "net.ipv4.conf.all.proxy_arp = 1" >> /etc/sysctl.conf ; sysctl -p /etc/sysctl.conf'
+
 - name: Install packages
   shell: "yum makecache && yum install -y audit"
   when: ansible_facts['distribution'] != "Ubuntu"

playbook/roles/k3s/files/setup-egress.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 ip=$1
+namespace=$2
 
 cat > /tmp/egress.yaml << EOF
 apiVersion: cilium.io/v2
@@ -11,6 +12,7 @@ spec:
   - podSelector:
       matchLabels:
         role: egress-gateway
+        io.kubernetes.pod.namespace: $namespace
   destinationCIDRs:
   - "0.0.0.0/0"
   egressGateway:

playbook/roles/k3s/files/setup-k3s-with-hostpath-sc.sh

@@ -6,6 +6,9 @@ curl -sfL https://get.k3s.io | sh -s - \
 	--disable-kube-proxy                                 \
 	--write-kubeconfig-mode 644                          \
 	--write-kubeconfig ~/.kube/config                    \
+	--node-external-ip 42.xx.xx.12                       \
+	--advertise-address 42.xx.xx.12                      \
+	--node-ip 192.168.1.1                                \
 	--data-dir=/opt/rancher/k3s                          \
 	--kube-apiserver-arg service-node-port-range=0-50000
 
@@ -21,13 +24,18 @@ rm -rf helm.tar.gz* /usr/local/bin/helm || echo true
 sudo wget --no-check-certificate https://mirrors.onwalk.net/tools/linux-${ARCH}/helm.tar.gz && sudo tar -xvpf helm.tar.gz -C /usr/local/bin/
 sudo chmod 755 /usr/local/bin/helm
 
-helm install cilium cilium/cilium --version 1.13.1 \
-	--namespace kube-system           \
-	--set egressGateway.enabled=true  \
-	--set bpf.masquerade=true         \
-	--set kubeProxyReplacement=strict \
-	--set operator.replicas=1 \
-	--set l7Proxy=false
-
+helm repo add cilium https://helm.cilium.io/
 helm repo add artifact https://artifact.onwalk.net/chartrepo/k8s/ | echo true
 helm repo up
+
+helm install cilium cilium/cilium --version 1.13.1 \
+	--namespace kube-system             \
+	--set bpf.masquerade=true           \
+	--set egressGateway.enabled=true    \
+	--set kubeProxyReplacement=strict   \
+	--set operator.replicas=1           \
+	--set devices=eth0                  \
+	--set k8sServiceHost=192.168.31.254 \
+	--set k8sServicePort=6443           \
+	--set ipv4NativeRoutingCIDR=192.168.31.254/32 \
+	--set l7Proxy=false

playbook/roles/k3s/tasks/main.yml

@@ -7,7 +7,7 @@
   when: inventory_hostname in groups[group]
 
 - name: Setup Egress
-  script: files/setup-egress.sh {{ egress_ip }}
+  script: files/setup-egress.sh {{ egress_ip }} {{ namespace }}
   when: inventory_hostname in groups[group]
 
 - name: Setup DNS Provider