https://alwaldend.com/tags/ingress/ Recent content in Ingress on Alwaldend Hugo en https://alwaldend.com/docs/infra/ingress/ Mon, 01 Jan 0001 00:00:00 +0000 https://alwaldend.com/docs/infra/ingress/ <h2 id="run-ansible">Run ansible<a class="td-heading-self-link" href="#run-ansible" aria-label="Heading self-link"></a></h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>bazel run //infra/ingress/ansible </span></span></code></pre></div><p>Services in <code>traefik_services</code> must use a backend <code>target</code> that resolves from the ingress hosts without resolving back to ingress. Define a dedicated site-local address, conventionally prefixed with <code>dc1.</code>, in the owning service&rsquo;s DNS configuration and use that address as the target.</p> <h2 id="apply-terraform">Apply terraform<a class="td-heading-self-link" href="#apply-terraform" aria-label="Heading self-link"></a></h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>bazel run //infra/ingress/tf </span></span></code></pre></div><h2 id="update-signed-image-url">Update signed image url<a class="td-heading-self-link" href="#update-signed-image-url" aria-label="Heading self-link"></a></h2><ul> <li>Create a signed url: <a href="https://yandex.cloud/ru/docs/storage/operations/objects/link-for-download">https://yandex.cloud/ru/docs/storage/operations/objects/link-for-download</a></li> <li>Update the secret: <code>alwaldend.com/vault1/approles/src_infra_ingress/image</code></li> </ul> <h2 id="recreate-vms">Recreate VMs<a class="td-heading-self-link" href="#recreate-vms" aria-label="Heading self-link"></a></h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>bazel run infra/ingress/tf -- -replace <span style="color:#e6db74">&#39;yandex_compute_disk.vpc[&#34;*&#34;]&#39;</span> </span></span></code></pre></div><h2 id="regenerate-wireguard-keys">Regenerate wireguard keys<a class="td-heading-self-link" href="#regenerate-wireguard-keys" aria-label="Heading self-link"></a></h2><ul> <li>Regenerate private and public keys: <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-sh" data-lang="sh"><span style="display:flex;"><span>wg genkey | tee host1.privatekey.txt | wg pubkey &gt;host1.publickey.txt </span></span><span style="display:flex;"><span>wg genkey | tee host2.privatekey.txt | wg pubkey &gt;host2.publickey.txt </span></span><span style="display:flex;"><span>wg genkey | tee router.privatekey.txt | wg pubkey &gt;router.publickey.txt </span></span><span style="display:flex;"><span>cat - &gt;data.json <span style="color:#e6db74">&lt;&lt;EOF </span></span></span><span style="display:flex;"><span><span style="color:#e6db74">{ </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;wg_public_keys&#34;: { </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;host1&#34;: &#34;$(cat host1.publickey.txt)&#34;, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;host2&#34;: &#34;$(cat host2.publickey.txt)&#34;, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;router&#34;: &#34;$(cat router.publickey.txt)&#34; </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> }, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;wg_private_keys&#34;: { </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;host1&#34;: &#34;$(cat host1.privatekey.txt)&#34;, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;host2&#34;: &#34;$(cat host2.privatekey.txt)&#34;, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;router&#34;: &#34;$(cat router.privatekey.txt)&#34; </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> }, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;wg_preshared_keys&#34;: { </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;host1&#34;: &#34;$(openssl rand 32 | base64)&#34;, </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> &#34;host2&#34;: &#34;$(openssl rand 32 | base64)&#34; </span></span></span><span style="display:flex;"><span><span style="color:#e6db74"> } </span></span></span><span style="display:flex;"><span><span style="color:#e6db74">} </span></span></span><span style="display:flex;"><span><span style="color:#e6db74">EOF</span> </span></span><span style="display:flex;"><span>bazel run infra/ingress:vault.kv_put -- -format json alwaldend.com/vault1/approles/src_infra_ingress/wireguard <span style="color:#e6db74">&#34;@</span><span style="color:#e6db74">${</span>PWD<span style="color:#e6db74">}</span><span style="color:#e6db74">/data.json&#34;</span> </span></span><span style="display:flex;"><span>rm data.json *.privatekey.txt *.publickey.txt </span></span></code></pre></div></li> </ul>