deploy

Run your own PlonkFW!

This repo is a WIP. You are free to fork and follow along, but expect breaking changes!

Prerequisites

Before deploying PlonkFW, ensure that your environment meets the following requirements:

1. Firewall Operating System: Ubuntu 24.04, "Minimal Server" install.
2. Local Tools: kubectl, flux, and ansible commands available in your local env.

Reference Architecture

The reference architecture for PlonkFW consists of the following components:

1. Hardware: No strong requirements here. SR-IOV capable nics may be required at some point / for some features.
2. Ubuntu 24.04: The primary operating system where RKE2 will be installed and managed.
3. RKE2: A certified Kubernetes distribution that simplifies cluster management and deployment.
4. Cilium: A CNI (Container Network Interface) plugin that provides ebpf-accelerated operation and advanced network policies.
5. Multus: A CNI (Container Network Interface) plugin that enables Kubernetes pods to attach multiple network interfaces.

Setup

First you need a clean Ubuntu 24.04 install on your chosen hardware.

To deploy PlonkFW, you'll want to fork this repo and do some setup steps:

Create ssh key to use as deploy key for FluxCD

# Make a temporary directory and cd to it
TEMPDIR=$(mktemp -d)
cd $TEMPDIR

# Generate a new ssh key
ssh-keygen -t ed25519 -f ./id_ed25519.flux-system.plonkfw

# Copy public key to keyboard
cat ./id_ed25519.flux-system.plonkfw.pub | pbcopy

# Go to https://github.com/<myorg>/<myrepo>/settings/keys/new
# and add as deploy key - write access optional

# Copy private key to where ansible expects it - or override plonkfw['flux_github_ssh_private_key_file'] in extravars
cp ./id_ed25519.flux-system.plonkfw "${REPO_ROOT}/ansible/fluxcd-sshkey/"

Fill in variables where necessary

1. Ansible Inventory: ${REPO_ROOT}/ansible/inventory/inventory.yml
2. Ansible ExtraVars: ${REPO_ROOT}/ansible/var/extravars.yml
3. Flux PostSub Vars/Secrets: TBD

Run ansible/initial-provision.sh

cd ansible

ansible-galaxy collection install -r roles/requirements.yml

bash ./initial-provision.sh