Thanks for sharing your config :)

I wondered what the default boot image menu is for the pxe server you are using, as I cannot get the machines to see the default menu / boot image for pxe.

Thanks

python3 ./configure.py

Text editor (vim): Enter your domain (khuedoan.com): Enter seed repo (https://github.com/khuedoan/homelab): Enter time zone (Asia/Ho_Chi_Minh): Enter your Terraform Workspace, skip if you don't want to use external resources yet (khuedoan): Traceback (most recent call last): File "./configure.py", line 27, in def find_and_replace(pattern: str, replacement: str, paths: list[str]) -> None: TypeError: 'type' object is not subscriptable

I'm working through your netboot solution, and I have an interesting issue where dhcpd.conf.j2 does not render properly (no variables are substituted). All of the other templates work just fine, and the variables used in dhcpd.conf.j2 are available if I run a debug step:

# all variables are present with correct values
- debug:
    var: '{{item}}'
  with_items:
    - ansible_default_ipv4.address
    - ansible_default_ipv4.broadcast
    - ansible_default_ipv4.gateway
    - ansible_default_ipv4.netmask
    - ansible_default_ipv4.network

# no substitution occurs
- name: Render DHCP config
  template:
    src: dhcpd.conf.j2
    dest: "{{ role_path }}/files/dhcp/dhcpd.conf"
    mode: 0644

# substitution occurs correctly
- name: Render GRUB config
  template:
    src: grub.cfg.j2
    dest: "{{ role_path }}/files/data/boot/grub/grub.cfg"
    mode: 0644

Do you have any thoughts?

HI I'am new in kubernetes, I ask myself some question on restauration/secret management if you could help me

• in case of rebuild cluster how to restore data on database or reuse persistant volume?
• if I uninstall and install helm release this will generate new secret not according with database current password how do you manage this?
• I can maybe create some custom secret resource to avoid this but what is best method to create this one?

First, great work and your setup is really something I hope I can achieve one day (or at least fraction of it) :)

I have a question as title says. Have you ever consider moving from k3 on Rocky Linux to pure k3os and remove one layer of complexity (setting up os and then setting up k3?

Keep up the great work!

Michal

Describe the bug

Deploying with the Rocky 8.6 issues stalls complaining of Root account is disable.

• [x] I have read the document

To reproduce

Steps to reproduce the behavior:

1. Run make tools, make configure, supply info for your environment
2. Run make
3. During kickstart installation stalls with "Root account is disabled"

Expected behavior

Kickstart should continue normally, without user intervention.

Screenshots

Additional context

You can move past this error by selecting option 8, providing a password and then selecting b to begin installation.. Installation will complete but will also require user to press enter once installation is complete. Supplying a root password in the kickstart template below, appears to allow the installation to complete as expected.

/homelab/blob/master/metal/roles/pxe_server/templates/kickstart.ks.j2

using the following line:

rootpw --iscrypted <hashed password>

where hashed password is created using something like:

python -c 'import crypt,getpass;pw=getpass.getpass();print(crypt.crypt(pw) if (pw==getpass.getpass("Confirm: ")) else exit())'

When I run:

make tools to build the image based on Arch distribution I get this error and the image bulding stops, trying to troubleshooting,without results.

Step 2/4 : RUN pacman --sync --refresh --noconfirm reflector && reflector --save /etc/pacman.d/mirrorlist --protocol https --latest 20 --sort rate ---> Running in 4687b34d956a error: failed to initialize alpm library: (root: /, dbpath: /var/lib/pacman/) could not find or read directory

Describe the bug

A clear and concise description of what the bug is.

• [x] I have read the document

To reproduce

Steps to reproduce the behavior:

1. Follow the instructions on the repo to deploy the lab and run the external layer.

Expected behavior

Access the lab via my domain.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

I can get to the the hajimari page and see resources found on the apps folder. Argocd & git are not working. I get a cloudflared error( 1033)

Current volume mount assumes all files are contained in your home directory. I assume you wanted people to run make tools and then make inside the docker. This PR drops them right into the files they would need for this.

First it determines the absolute path to the parent directory (project root) of the Makefile. Then we mount the project root directory (instead of the user's home) into the docker user's home and also use it as workdir.

Hey there!

I've got a Kubernetes cluster I've deployed myself, and am not hugely keen on PXE booting. It would be super awesome if there was a way to use this project while skipping past the PXE boot and provisioning stuff.

In fact, there basically is already a way! Copy your kube configs into place, then...

make -C bootstrap instead of make, and bam... you've got a khuedoan homelab, kind of.

Maybe you could have a target like "make existing-cluster" or something which officially supports this deployment method?

Manually keeping all dependencies up to date can be a time consuming task which can easily be automated.

One possible solution for this is renovatebot which periodically checks for new versions and can create a pull request for each update found.

It can easily be deployed on kubernetes via helm and works with gitea out of the box.

Hello!

I created a virtualbox to test dev environment and even with docker tools even with nix-shell tried many times in clean install at step "make"

i get the following error:

1st time running make

INFO[0051] Cluster 'homelab-dev' created successfully!  
INFO[0051] You can now use it like this:                
kubectl cluster-info
k3d kubeconfig get homelab-dev > kubeconfig.yaml
make[1]: Leaving directory '/home/vip/homelab/metal'
make -C bootstrap
make[1]: Entering directory '/home/vip/homelab/bootstrap'
kubectl create namespace argocd --dry-run=client --output=yaml \
        | kubectl apply -f -
namespace/argocd created
cd argocd && ./apply.sh
error: error validating "STDIN": error validating data: invalid object to validate; if you choose to ignore these errors, turn validation off with --validate=false
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "applications.argoproj.io" not found
Error from server (NotFound): customresourcedefinitions.apiextensions.k8s.io "applicationsets.argoproj.io" not found
make[1]: *** [Makefile:11: argocd] Error 1
make[1]: Leaving directory '/home/vip/homelab/bootstrap'
make: *** [Makefile:18: bootstrap] Error 2

2nd time trying running make

statefulset.apps/argocd-application-controller created
ingress.networking.k8s.io/argocd-server created
resource mapping not found for name: "argocd-application-controller" namespace: "" from "STDIN": no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
ensure CRDs are installed first
resource mapping not found for name: "argocd-repo-server" namespace: "" from "STDIN": no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
ensure CRDs are installed first
resource mapping not found for name: "argocd-server" namespace: "" from "STDIN": no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
ensure CRDs are installed first
resource mapping not found for name: "argocd-redis" namespace: "" from "STDIN": no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
ensure CRDs are installed first
customresourcedefinition.apiextensions.k8s.io/applications.argoproj.io condition met
customresourcedefinition.apiextensions.k8s.io/applicationsets.argoproj.io condition met
cd root && ./apply.sh
Error from server (NotFound): namespaces "gitea" not found
applicationset.argoproj.io/bootstrap created
applicationset.argoproj.io/system created
applicationset.argoproj.io/platform created
applicationset.argoproj.io/apps created
make[1]: Leaving directory '/home/vip/homelab/bootstrap'
make -C test filter=Smoke
make[1]: Entering directory '/home/vip/homelab/test'
gotestsum --format testname -- -timeout 30m -run "Smoke"
go: downloading github.com/khuedoan/terratest v0.0.0-20220921151310-016fe8e1536b
...
...
...

continuing after few minutes make fails.

If you need any other details ill be happy to send you and help fix it.

Describe the bug

It seems that tekton pipelines want to run as root, but the permissions aren't there.

• [X] I have read the document

To reproduce

Steps to reproduce the behavior:

1. Install
2. go to tekton.<domain_name>
3. Everything is empty
4. trying to import from the web interface fails with the first error in Additional context
5. kubectl apply -k .ci/ fails on check-git-files-changed.yaml having v1alpha1
6. change check-git-files-changed.yaml to be v1beta1
7. kubectl apply -k .ci/ succeeds
8. go to web interface, see second error on run
9. try to run again via the web interface, get third error on run

Expected behavior

That CI would be set up with normal install

Additional context

completionTime: '2022-11-29T10:26:59Z'
conditions:  - lastTransitionTime: '2022-11-29T10:26:59Z'
    message: 'failed to create task run pod "import-resources-1669717619307-import-resources": pods "import-resources-1669717619307-import-resources-pod" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "prepare", "step-git-source-git-source-djgcj", "step-import" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "prepare", "step-git-source-git-source-djgcj", "step-import" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "prepare", "step-git-source-git-source-djgcj", "step-import" must set securityContext.runAsNonRoot=true), runAsUser=0 (container "step-git-source-git-source-djgcj" must not set runAsUser=0), seccompProfile (pod or containers "prepare", "step-git-source-git-source-djgcj", "step-import" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost"). Maybe invalid TaskSpec'
    reason: CouldntGetTask
    status: 'False'
    type: Succeeded
podName: ''
startTime: '2022-11-29T10:26:59Z'
taskSpec:  params:    - default: .
      description: The path from which resources are to be imported
      name: path
      type: string
    - default: tekton-pipelines
      description: The namespace in which to create the resources being imported
      name: target-namespace
      type: string
  resources:    inputs:      - name: git-source
        type: git
  steps:    - args:        - apply
        - '-f'
        - $(resources.inputs.git-source.path)/.ci
        - '-n'
        - tektontutorial
      command:        - kubectl
      image: lachlanevenson/k8s-kubectl:latest
      name: import
      resources: {}

Pipeline tekton-pipelines/homelab can't be Run; it contains Tasks that don't exist: Couldn't retrieve Task "kaniko": tasks.tekton.dev "kaniko" not found

conditions:  - lastTransitionTime: '2022-11-29T10:36:23Z'
    message: 'failed to create task run pod "homelab-r-h2wgf-git-clone": pods "homelab-r-h2wgf-git-clone-pod" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "prepare", "place-scripts", "step-clone" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "prepare", "place-scripts", "step-clone" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "prepare", "place-scripts", "step-clone" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "prepare", "place-scripts", "step-clone" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost"). Maybe missing or invalid Task tekton-pipelines/git-clone'
    reason: CouldntGetTask
    status: 'False'
    type: Succeeded

conditions:  - lastTransitionTime: '2022-11-29T10:46:00Z'
    message: 'failed to create task run pod "homelab-git-clone": pods "homelab-git-clone-pod" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (containers "prepare", "place-scripts", "step-clone" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "prepare", "place-scripts", "step-clone" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "prepare", "place-scripts", "step-clone" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "prepare", "place-scripts", "step-clone" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost"). Maybe missing or invalid Task tekton-pipelines/git-clone'
    reason: CouldntGetTask
    status: 'False'
    type: Succeeded

Hi there

As the k8s-at-home charts are marked as deprecated / archived and wont get updated regularly, i propose we switch to something that still is maintained for the default app-stack.

I mainly played around with a combination of https://github.com/truecharts and linuxserver.io images where i didnt found a suitable image. I mostly had good results and more up to date apps.

If you would like me to get some of the apps ported over, i will gladly make some pull requests.

Best regards gitbute

• fix #90 via documentation
• added myself as contributor

I'm not 100% certain why the prerequisites.md file appears fully 're-written'. I suspect it's related to line endings. It's always line endings...

Describe the bug

Unable to execute 'make tools'.

• [X] I have read the document

To reproduce

Steps to reproduce the behavior:

1. Follow documentation to make tools
2. Observe error error: getting status of shell.nix: Permission denied
3. attempt to run the tools command manually
4. See error -bash: shell: command not found

Expected behavior

Build the tools container environment

Screenshots

Meh, it's all txt at this point...

Additional context

Add any other context about the problem here (hardware, OS, etc.).

Hardware

[user@lenovo-w530-b homelab]$ neofetch
             .',;::::;,'.
         .';:cccccccccccc:;,.            user@lenovo-w530-b
      .;cccccccccccccccccccccc;.         -------------------
    .:cccccccccccccccccccccccccc:.       OS: Fedora Linux 36 (Server Edition) x86_64
  .;ccccccccccccc;.:dddl:.;ccccccc;.     Host: 2447AC4 ThinkPad W530
 .:ccccccccccccc;OWMKOOXMWd;ccccccc:.    Kernel: 5.19.10-200.fc36.x86_64
.:ccccccccccccc;KMMc;cc;xMMc:ccccccc:.   Uptime: 1 hour
,cccccccccccccc;MMM.;cc;;WW::cccccccc,   Packages: 1048 (rpm)
:cccccccccccccc;MMM.;cccccccccccccccc:   Shell: bash 5.1.16
:ccccccc;oxOOOo;MMM0OOk.;cccccccccccc:   Resolution: 1600x900
cccccc:0MMKxdd:;MMMkddc.;cccccccccccc;   Terminal: /dev/pts/0
ccccc:XM0';cccc;MMM.;cccccccccccccccc'   CPU: Intel i7-3740QM (8) @ 3.700GHz
ccccc;MMo;ccccc;MMW.;ccccccccccccccc;    GPU: NVIDIA Quadro K1000M
ccccc;0MNc.ccc.xMMd:ccccccccccccccc;     GPU: Intel 3rd Gen Core processor Graphics Controller
cccccc;dNMWXXXWM0::cccccccccccccc:,      Memory: 466MiB / 15814MiB
cccccccc;.:odl:.;cccccccccccccc:,.
:cccccccccccccccccccccccccccc:'.                                 
.:cccccccccccccccccccccc:;,..                                    
  '::cccccccccccccc::;,.


[user@lenovo-w530-b homelab]$

OS Details

As the nodes will be provisioned with Fedora, I chose Fedora for the Initial controller for consistency. Even the same version.

[user@lenovo-w530-b homelab]$ cat /etc/os-release
NAME="Fedora Linux"
VERSION="36 (Server Edition)"
ID=fedora
VERSION_ID=36
VERSION_CODENAME=""
PLATFORM_ID="platform:f36"
PRETTY_NAME="Fedora Linux 36 (Server Edition)"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:36"
HOME_URL="https://fedoraproject.org/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora/f36/system-administrators-guide/"
SUPPORT_URL="https://ask.fedoraproject.org/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=36
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=36
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="Server Edition"
VARIANT_ID=server
[user@lenovo-w530-b homelab]$

user and groups

[user@lenovo-w530-b homelab]$ id
uid=1000(user) gid=1000(user) groups=1000(user),10(wheel),984(docker) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[user@lenovo-w530-b homelab]$

Original error

[user@lenovo-w530-b homelab]$ make tools
error: getting status of shell.nix: Permission denied
make: *** [Makefile:30: tools] Error 1
[user@lenovo-w530-b homelab]$

SELinux

I honestly think this is it...

[user@lenovo-w530-b homelab]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
[user@lenovo-w530-b homelab]$

It would be nice to have something serverless, like knative.dev , or one of the other CNCF options: https://landscape.cncf.io/card-mode?category=serverless&license=open-source&grouping=category&sort=stars