From bf4d7e8efc560462ac7269cd5684e6bd4b50d9e4 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 17 Mar 2026 20:17:56 +1100 Subject: [PATCH] feat: complete puppet infrastructure complete the implementation of puppet in kubernetes, taking many features from the openvox helm chart and improving on them. changes from helm are: - using vault for storing secrets - using g10k instead of r10k - using a single shared g10k cronjob for all masters/compilers - using a single shared /etc/puppetlabs/code directory (shared, cephfs) changes: - deploy puppet master and compiler servers with statefulset/deployment - deploy puppetdb with postgresql backend, taking advantage of cnpg cluster and pooler - deploy puppetboard - all supporting configmaps, services, ingresses, and hpas - added vaultstaticsecret for eyaml private keys - configured secure mounting of eyaml keys at /var/lib/puppet/keys/ - updated base kustomization to include all 23 new puppet resource files --- .../puppet/configmap_puppetboard-config.yaml | 23 +++ .../puppet/configmap_puppetdb-config.yaml | 19 ++ ...onfigmap_puppetserver-compiler-config.yaml | 19 ++ .../configmap_puppetserver-init-config.yaml | 15 ++ ...gmap_puppetserver-init-masters-config.yaml | 28 +++ .../configmap_puppetserver-master-config.yaml | 18 ++ apps/base/puppet/deployment_puppetboard.yaml | 57 ++++++ apps/base/puppet/deployment_puppetdb.yaml | 151 +++++++++++++++ .../deployment_puppetserver-master.yaml | 164 ++++++++++++++++ ...ler_puppetserver-compilers-autoscaler.yaml | 37 ++++ ...caler_puppetserver-masters-autoscaler.yaml | 37 ++++ ...r_puppetserver-puppetboard-autoscaler.yaml | 44 +++++ ...aler_puppetserver-puppetdb-autoscaler.yaml | 44 +++++ apps/base/puppet/ingress_puppetboard.yaml | 34 ++++ apps/base/puppet/ingress_puppetdb.yaml | 28 +++ .../ingress_puppetserver-compilers.yaml | 28 +++ .../puppet/ingress_puppetserver-masters.yaml | 28 +++ apps/base/puppet/kustomization.yaml | 24 +++ ...service_puppetserver-agents-to-puppet.yaml | 18 ++ ...uppetserver-puppet-compilers-headless.yaml | 20 ++ ...service_puppetserver-puppet-compilers.yaml | 18 ++ .../puppet/service_puppetserver-puppet.yaml | 18 ++ .../service_puppetserver-puppetboard.yaml | 21 ++ .../puppet/service_puppetserver-puppetdb.yaml | 23 +++ .../statefulset_puppetserver-compiler.yaml | 183 ++++++++++++++++++ apps/base/puppet/vaultstaticsecret.yaml | 17 ++ 26 files changed, 1116 insertions(+) create mode 100644 apps/base/puppet/configmap_puppetboard-config.yaml create mode 100644 apps/base/puppet/configmap_puppetdb-config.yaml create mode 100644 apps/base/puppet/configmap_puppetserver-compiler-config.yaml create mode 100644 apps/base/puppet/configmap_puppetserver-init-config.yaml create mode 100644 apps/base/puppet/configmap_puppetserver-init-masters-config.yaml create mode 100644 apps/base/puppet/configmap_puppetserver-master-config.yaml create mode 100644 apps/base/puppet/deployment_puppetboard.yaml create mode 100644 apps/base/puppet/deployment_puppetdb.yaml create mode 100644 apps/base/puppet/deployment_puppetserver-master.yaml create mode 100644 apps/base/puppet/horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml create mode 100644 apps/base/puppet/horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml create mode 100644 apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml create mode 100644 apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml create mode 100644 apps/base/puppet/ingress_puppetboard.yaml create mode 100644 apps/base/puppet/ingress_puppetdb.yaml create mode 100644 apps/base/puppet/ingress_puppetserver-compilers.yaml create mode 100644 apps/base/puppet/ingress_puppetserver-masters.yaml create mode 100644 apps/base/puppet/service_puppetserver-agents-to-puppet.yaml create mode 100644 apps/base/puppet/service_puppetserver-puppet-compilers-headless.yaml create mode 100644 apps/base/puppet/service_puppetserver-puppet-compilers.yaml create mode 100644 apps/base/puppet/service_puppetserver-puppet.yaml create mode 100644 apps/base/puppet/service_puppetserver-puppetboard.yaml create mode 100644 apps/base/puppet/service_puppetserver-puppetdb.yaml create mode 100644 apps/base/puppet/statefulset_puppetserver-compiler.yaml diff --git a/apps/base/puppet/configmap_puppetboard-config.yaml b/apps/base/puppet/configmap_puppetboard-config.yaml new file mode 100644 index 0000000..c68b7a3 --- /dev/null +++ b/apps/base/puppet/configmap_puppetboard-config.yaml @@ -0,0 +1,23 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetboard-config + namespace: puppet +data: + PUPPETDB_HOST: "puppetdb" + PUPPETDB_PORT: "8080" + LOGLEVEL: "info" + PUPPETDB_TIMEOUT: "20" + UNRESPONSIVE_HOURS: "3" + ENABLE_CATALOG: "False" + ENABLE_QUERY: "True" + LOCALISE_TIMESTAMP: "True" + OFFLINE_MODE: "True" + DEFAULT_ENVIRONMENT: "*" + REPORTS_COUNT: "40" diff --git a/apps/base/puppet/configmap_puppetdb-config.yaml b/apps/base/puppet/configmap_puppetdb-config.yaml new file mode 100644 index 0000000..3f32e8c --- /dev/null +++ b/apps/base/puppet/configmap_puppetdb-config.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetdb-config + namespace: puppet +data: + OPENVOXSERVER_HOSTNAME: "puppetca" + OPENVOXSERVER_PORT: "8140" + DNS_ALT_NAMES: "openvoxdb,puppetdb,puppetdb.k8s.syd1.au.unkin.net,puppetdb.puppet.svc.cluster.local" + OPENVOXDB_POSTGRES_HOSTNAME: "puppet-postgres-pooler" + OPENVOXDB_POSTGRES_DATABASE: "puppetdb" + OPENVOXDB_POSTGRES_PORT: "5432" + PUPPETDB_JAVA_ARGS: "" diff --git a/apps/base/puppet/configmap_puppetserver-compiler-config.yaml b/apps/base/puppet/configmap_puppetserver-compiler-config.yaml new file mode 100644 index 0000000..fad66f2 --- /dev/null +++ b/apps/base/puppet/configmap_puppetserver-compiler-config.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler-config + namespace: puppet +data: + OPENVOXSERVER_PORT: "8140" + DNS_ALT_NAMES: "puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppetserver-compiler,puppet,puppet.k8s.syd1.au.unkin.net" + OPENVOXDB_SERVER_URLS: "https://puppetdb:8081" + CA_ENABLED: "false" + CA_HOSTNAME: "puppetca" + CA_PORT: "8140" + PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false" diff --git a/apps/base/puppet/configmap_puppetserver-init-config.yaml b/apps/base/puppet/configmap_puppetserver-init-config.yaml new file mode 100644 index 0000000..b93aea8 --- /dev/null +++ b/apps/base/puppet/configmap_puppetserver-init-config.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: puppetserver-init + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-init-config + namespace: puppet +data: + PUPPET_DATA_DIR: "/etc/puppetlabs/code/environments" + PUPPET_SSL_DIR: "/etc/puppetlabs/puppet/ssl/certs" + PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false" diff --git a/apps/base/puppet/configmap_puppetserver-init-masters-config.yaml b/apps/base/puppet/configmap_puppetserver-init-masters-config.yaml new file mode 100644 index 0000000..5e4cbcc --- /dev/null +++ b/apps/base/puppet/configmap_puppetserver-init-masters-config.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +data: + check_for_masters.sh: | + #!/usr/bin/env bash + if [[ -d "$PUPPET_SSL_DIR" ]]; then + ls -la /etc/puppetlabs/puppet/ssl/certs/ + echo "A Puppetserver master has already started running." + echo "Waiting to finish the generation of the Puppet SSL certs..." + sleep 5 + while ! [[ -n "$(find /etc/puppetlabs/puppet/ssl/certs -name 'puppet*.pem' | head -1)" ]]; + do + echo "Still waiting..." + sleep 5 + done + sleep 15 + echo "Puppet SSL certs have been generated. Continuing..." + else + echo "No other Puppetserver master is running. Continuing..." + fi +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-init-masters-config + namespace: puppet diff --git a/apps/base/puppet/configmap_puppetserver-master-config.yaml b/apps/base/puppet/configmap_puppetserver-master-config.yaml new file mode 100644 index 0000000..1eddd51 --- /dev/null +++ b/apps/base/puppet/configmap_puppetserver-master-config.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-master-config + namespace: puppet +data: + OPENVOXSERVER_HOSTNAME: "puppet" + OPENVOXSERVER_PORT: "8140" + DNS_ALT_NAMES: "puppet,puppetserver-agents-to-puppet,puppetca,puppet-compilers,puppetca.k8s.syd1.au.unkin.net,puppet.k8s.syd1.au.unkin.net" + OPENVOXDB_SERVER_URLS: "https://puppetdb:8081" + CA_ALLOW_SUBJECT_ALT_NAMES: "true" + PUPPETSERVER_JAVA_ARGS: "-Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false" diff --git a/apps/base/puppet/deployment_puppetboard.yaml b/apps/base/puppet/deployment_puppetboard.yaml new file mode 100644 index 0000000..57858e6 --- /dev/null +++ b/apps/base/puppet/deployment_puppetboard.yaml @@ -0,0 +1,57 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetboard + namespace: puppet +spec: + selector: + matchLabels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/name: puppetserver + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + annotations: + reloader.stakater.com/auto: "true" + labels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + spec: + containers: + - name: puppetboard + image: ghcr.io/voxpupuli/puppetboard:7.0.1 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 9090 + name: puppetboard + envFrom: + - configMapRef: + name: puppetboard-config + - secretRef: + name: puppetboard-secrets + resources: + requests: + memory: 350Mi + cpu: 100m + limits: + memory: 1024Mi + cpu: 500m + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + allowPrivilegeEscalation: false + capabilities: + drop: + - all diff --git a/apps/base/puppet/deployment_puppetdb.yaml b/apps/base/puppet/deployment_puppetdb.yaml new file mode 100644 index 0000000..7c01213 --- /dev/null +++ b/apps/base/puppet/deployment_puppetdb.yaml @@ -0,0 +1,151 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetdb + namespace: puppet +spec: + selector: + matchLabels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/name: puppetserver + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + annotations: + reloader.stakater.com/auto: "true" + labels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + spec: + hostname: puppetdb + imagePullSecrets: null + containers: + - name: puppetdb + image: ghcr.io/openvoxproject/openvoxdb:8.9.0-main + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 1 + memory: 1536Mi + requests: + cpu: 250m + memory: 512Mi + ports: + - containerPort: 8080 + name: pdb-http + - containerPort: 8081 + name: pdb-https + envFrom: + - configMapRef: + name: puppetdb-config + env: + - name: OPENVOXDB_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + key: password + name: postgres-credentials + - name: OPENVOXDB_POSTGRES_USER + valueFrom: + secretKeyRef: + key: username + name: postgres-credentials + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - CAP_FOWNER + - CAP_CHOWN + - CAP_SETUID + - CAP_SETGID + - CAP_DAC_OVERRIDE + - FOWNER + - CHOWN + - SETUID + - SETGID + - DAC_OVERRIDE + drop: + - all + volumeMounts: + - mountPath: /opt/puppetlabs/server/data/puppetdb + name: puppetdb-storage + initContainers: + - name: create-log-dir + image: docker.io/busybox:1.37 + command: + - sh + - -c + - mkdir -p /opt/puppetlabs/server/data/puppetdb/logs && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs + volumeMounts: + - mountPath: /opt/puppetlabs/server/data/puppetdb + name: puppetdb-storage + securityContext: + runAsUser: 0 + resources: + limits: + cpu: 20m + memory: 32Mi + requests: + cpu: 20m + memory: 32Mi + - command: + - sh + - -c + - | + echo 'Waiting for PostgreSQL to become ready...' + until printf "." && nc -z -w 2 puppet-postgres-pooler 5432; do + sleep 2; + done; + echo 'PostgreSQL OK ✓' + image: docker.io/busybox:1.37 + imagePullPolicy: IfNotPresent + name: pgchecker + resources: + limits: + cpu: 20m + memory: 32Mi + requests: + cpu: 20m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + - command: + - sh + - -c + - | + echo 'Waiting for puppetserver to become ready...' + until printf "." && curl --silent --fail --insecure 'https://puppetserver-puppet:8140/status/v1/simple' | grep -q '^running$'; do + sleep 2; + done; + echo 'Puppetserver OK ✓' + image: curlimages/curl:8.11.1 + imagePullPolicy: IfNotPresent + name: wait-puppetserver + resources: + limits: + cpu: 20m + memory: 32Mi + requests: + cpu: 20m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + volumes: + - name: puppetdb-storage + persistentVolumeClaim: + claimName: puppetserver-puppetdb-claim diff --git a/apps/base/puppet/deployment_puppetserver-master.yaml b/apps/base/puppet/deployment_puppetserver-master.yaml new file mode 100644 index 0000000..dc1089a --- /dev/null +++ b/apps/base/puppet/deployment_puppetserver-master.yaml @@ -0,0 +1,164 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + reloader.stakater.com/auto: "true" + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-master + namespace: puppet +spec: + selector: + matchLabels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/name: puppetserver + strategy: + type: RollingUpdate + template: + metadata: + annotations: + reloader.stakater.com/auto: "true" + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + spec: + hostname: puppet + imagePullSecrets: null + containers: + - name: puppetserver + image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 2 + memory: 3500Mi + requests: + cpu: 250m + memory: 1024Mi + ports: + - containerPort: 8140 + envFrom: + - configMapRef: + name: puppetserver-master-config + livenessProbe: + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + tcpSocket: + port: 8140 + timeoutSeconds: 10 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /status/v1/simple + port: 8140 + scheme: HTTPS + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 20 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - CAP_CHOWN + - CAP_SETUID + - CAP_SETGID + - CAP_DAC_OVERRIDE + - CAP_AUDIT_WRITE + - CAP_FOWNER + - CHOWN + - SETUID + - SETGID + - DAC_OVERRIDE + - AUDIT_WRITE + - FOWNER + drop: + - all + startupProbe: + failureThreshold: 30 + periodSeconds: 60 + tcpSocket: + port: 8140 + volumeMounts: + - mountPath: /etc/puppetlabs/puppet/ + name: puppet-puppet-storage + - mountPath: /etc/puppetlabs/puppetserver/ca/ + name: puppet-ca-storage + - mountPath: /var/lib/puppet/keys/ + name: eyaml-keys + readOnly: true + initContainers: + - args: + - mkdir -p /etc/puppetlabs/puppet/eyaml/keys; + cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh; + chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh; + chmod +x /etc/puppetlabs/puppet/check_for_masters.sh; + bash /etc/puppetlabs/puppet/check_for_masters.sh; + mkdir -p /etc/puppetlabs/code/environments; + mkdir -p /etc/puppetlabs/puppet/manifests; + chown -R puppet:puppet /etc/puppetlabs; + mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/; + touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde; + chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/; + command: + - sh + - -c + envFrom: + - configMapRef: + name: puppetserver-init-config + image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main + imagePullPolicy: IfNotPresent + name: perms-and-dirs + resources: + limits: + cpu: 300m + memory: 256Mi + requests: + cpu: 200m + memory: 128Mi + securityContext: + capabilities: + add: + - CAP_CHOWN + - CAP_SETUID + - CAP_SETGID + - CAP_DAC_OVERRIDE + - CAP_AUDIT_WRITE + - CAP_FOWNER + - CHOWN + - SETUID + - SETGID + - DAC_OVERRIDE + - AUDIT_WRITE + - FOWNER + drop: + - all + runAsNonRoot: false + runAsUser: 0 + volumeMounts: + - mountPath: /etc/puppetlabs/puppet/ + name: puppet-puppet-storage + - mountPath: /tmp/puppet/configmap/check_for_masters.sh + name: init-masters-volume + subPath: check_for_masters.sh + securityContext: + fsGroup: 999 + volumes: + - name: puppet-ca-storage + persistentVolumeClaim: + claimName: puppetserver-ca-claim + - name: puppet-puppet-storage + persistentVolumeClaim: + claimName: puppetserver-puppet-claim + - configMap: + name: puppetserver-init-masters-config + name: init-masters-volume + - name: eyaml-keys + secret: + secretName: eyaml-keys + defaultMode: 0600 diff --git a/apps/base/puppet/horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml b/apps/base/puppet/horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml new file mode 100644 index 0000000..f28e373 --- /dev/null +++ b/apps/base/puppet/horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml @@ -0,0 +1,37 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler-autoscaler + namespace: puppet +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: StatefulSet + name: puppetserver-compiler + minReplicas: 2 + maxReplicas: 5 + metrics: + - resource: + name: cpu + target: + averageUtilization: 75 + type: Utilization + type: Resource + behavior: + scaleUp: + stabilizationWindowSeconds: 60 + policies: + - type: Percent + value: 50 + periodSeconds: 15 + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Percent + value: 25 + periodSeconds: 60 diff --git a/apps/base/puppet/horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml b/apps/base/puppet/horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml new file mode 100644 index 0000000..028b2ef --- /dev/null +++ b/apps/base/puppet/horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml @@ -0,0 +1,37 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-masters-autoscaler + namespace: puppet +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: puppetserver-master + minReplicas: 2 + maxReplicas: 5 + metrics: + - resource: + name: cpu + target: + averageUtilization: 75 + type: Utilization + type: Resource + behavior: + scaleUp: + stabilizationWindowSeconds: 60 + policies: + - type: Percent + value: 50 + periodSeconds: 15 + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Percent + value: 25 + periodSeconds: 60 diff --git a/apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml b/apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml new file mode 100644 index 0000000..209e848 --- /dev/null +++ b/apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml @@ -0,0 +1,44 @@ +--- +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + labels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-puppetboard-autoscaler + namespace: puppet +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: puppetboard + minReplicas: 2 + maxReplicas: 5 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 70 + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: 90 + behavior: + scaleUp: + stabilizationWindowSeconds: 60 + policies: + - type: Percent + value: 100 + periodSeconds: 15 + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Percent + value: 50 + periodSeconds: 60 diff --git a/apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml b/apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml new file mode 100644 index 0000000..17d9152 --- /dev/null +++ b/apps/base/puppet/horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml @@ -0,0 +1,44 @@ +--- +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + labels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-puppetdb-autoscaler + namespace: puppet +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: puppetdb + minReplicas: 2 + maxReplicas: 5 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 70 + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: 90 + behavior: + scaleUp: + stabilizationWindowSeconds: 60 + policies: + - type: Percent + value: 100 + periodSeconds: 15 + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Percent + value: 50 + periodSeconds: 60 diff --git a/apps/base/puppet/ingress_puppetboard.yaml b/apps/base/puppet/ingress_puppetboard.yaml new file mode 100644 index 0000000..38f86b4 --- /dev/null +++ b/apps/base/puppet/ingress_puppetboard.yaml @@ -0,0 +1,34 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + kubernetes.io/ingress.class: nginx + external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net + external-dns.alpha.kubernetes.io/target: 198.18.200.0 + cert-manager.io/cluster-issuer: vault-issuer + cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net + cert-manager.io/private-key-size: "4096" + labels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-puppetboard + namespace: puppet +spec: + rules: + - host: puppetboard.k8s.syd1.au.unkin.net + http: + paths: + - backend: + service: + name: puppetboard + port: + number: 9090 + path: / + pathType: Prefix + tls: + - hosts: + - puppetboard.k8s.syd1.au.unkin.net + secretName: puppetboard-tls diff --git a/apps/base/puppet/ingress_puppetdb.yaml b/apps/base/puppet/ingress_puppetdb.yaml new file mode 100644 index 0000000..8f4793e --- /dev/null +++ b/apps/base/puppet/ingress_puppetdb.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + kubernetes.io/ingress.class: nginx + external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net + external-dns.alpha.kubernetes.io/target: 198.18.200.0 + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + labels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetdb + namespace: puppet +spec: + rules: + - host: puppetdb.k8s.syd1.au.unkin.net + http: + paths: + - backend: + service: + name: puppetdb + port: + number: 8081 + path: / + pathType: Prefix diff --git a/apps/base/puppet/ingress_puppetserver-compilers.yaml b/apps/base/puppet/ingress_puppetserver-compilers.yaml new file mode 100644 index 0000000..70ed43c --- /dev/null +++ b/apps/base/puppet/ingress_puppetserver-compilers.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + external-dns.alpha.kubernetes.io/hostname: puppet.k8s.syd1.au.unkin.net + external-dns.alpha.kubernetes.io/target: 198.18.200.0 + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/proxy-read-timeout: "600" + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler + namespace: puppet +spec: + rules: + - host: puppet.k8s.syd1.au.unkin.net + http: + paths: + - backend: + service: + name: puppetserver-compiler + port: + number: 8140 + path: / + pathType: ImplementationSpecific diff --git a/apps/base/puppet/ingress_puppetserver-masters.yaml b/apps/base/puppet/ingress_puppetserver-masters.yaml new file mode 100644 index 0000000..f8a20ef --- /dev/null +++ b/apps/base/puppet/ingress_puppetserver-masters.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + external-dns.alpha.kubernetes.io/hostname: puppetca.k8s.syd1.au.unkin.net + external-dns.alpha.kubernetes.io/target: 198.18.200.0 + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/proxy-read-timeout: "600" + nginx.ingress.kubernetes.io/ssl-passthrough: "true" + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-masters + namespace: puppet +spec: + rules: + - host: puppetca.k8s.syd1.au.unkin.net + http: + paths: + - backend: + service: + name: puppetserver-puppet + port: + number: 8140 + path: / + pathType: ImplementationSpecific diff --git a/apps/base/puppet/kustomization.yaml b/apps/base/puppet/kustomization.yaml index 6a93a19..28bea5e 100644 --- a/apps/base/puppet/kustomization.yaml +++ b/apps/base/puppet/kustomization.yaml @@ -10,3 +10,27 @@ resources: - persistentvolumeclaims.yaml - vaultauth.yaml - vaultstaticsecret.yaml + - configmap_puppetboard-config.yaml + - configmap_puppetdb-config.yaml + - configmap_puppetserver-compiler-config.yaml + - configmap_puppetserver-init-config.yaml + - configmap_puppetserver-init-masters-config.yaml + - configmap_puppetserver-master-config.yaml + - deployment_puppetboard.yaml + - deployment_puppetdb.yaml + - deployment_puppetserver-master.yaml + - horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml + - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml + - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml + - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml + - ingress_puppetboard.yaml + - ingress_puppetdb.yaml + - ingress_puppetserver-compilers.yaml + - ingress_puppetserver-masters.yaml + - service_puppetserver-agents-to-puppet.yaml + - service_puppetserver-puppet-compilers-headless.yaml + - service_puppetserver-puppet-compilers.yaml + - service_puppetserver-puppet.yaml + - service_puppetserver-puppetboard.yaml + - service_puppetserver-puppetdb.yaml + - statefulset_puppetserver-compiler.yaml diff --git a/apps/base/puppet/service_puppetserver-agents-to-puppet.yaml b/apps/base/puppet/service_puppetserver-agents-to-puppet.yaml new file mode 100644 index 0000000..d29f4c3 --- /dev/null +++ b/apps/base/puppet/service_puppetserver-agents-to-puppet.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-agents-to-puppet + namespace: puppet +spec: + ports: + - name: puppetserver + port: 8140 + selector: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/name: puppetserver + type: ClusterIP diff --git a/apps/base/puppet/service_puppetserver-puppet-compilers-headless.yaml b/apps/base/puppet/service_puppetserver-puppet-compilers-headless.yaml new file mode 100644 index 0000000..aad7609 --- /dev/null +++ b/apps/base/puppet/service_puppetserver-puppet-compilers-headless.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler-headless + namespace: puppet +spec: + clusterIP: None + ports: + - name: https + port: 443 + protocol: TCP + targetPort: 8140 + selector: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/name: puppetserver diff --git a/apps/base/puppet/service_puppetserver-puppet-compilers.yaml b/apps/base/puppet/service_puppetserver-puppet-compilers.yaml new file mode 100644 index 0000000..e85409b --- /dev/null +++ b/apps/base/puppet/service_puppetserver-puppet-compilers.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler + namespace: puppet +spec: + ports: + - name: puppetserver + port: 8140 + selector: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/name: puppetserver + type: ClusterIP diff --git a/apps/base/puppet/service_puppetserver-puppet.yaml b/apps/base/puppet/service_puppetserver-puppet.yaml new file mode 100644 index 0000000..2be6049 --- /dev/null +++ b/apps/base/puppet/service_puppetserver-puppet.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetca + namespace: puppet +spec: + ports: + - name: puppetserver + port: 8140 + selector: + app.kubernetes.io/component: puppetserver + app.kubernetes.io/name: puppetserver + type: ClusterIP diff --git a/apps/base/puppet/service_puppetserver-puppetboard.yaml b/apps/base/puppet/service_puppetserver-puppetboard.yaml new file mode 100644 index 0000000..8c0c9e2 --- /dev/null +++ b/apps/base/puppet/service_puppetserver-puppetboard.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetboard + namespace: puppet +spec: + ports: + - name: puppetboard + port: 9090 + protocol: TCP + targetPort: puppetboard + selector: + app.kubernetes.io/component: puppetboard + app.kubernetes.io/name: puppetserver + type: ClusterIP diff --git a/apps/base/puppet/service_puppetserver-puppetdb.yaml b/apps/base/puppet/service_puppetserver-puppetdb.yaml new file mode 100644 index 0000000..2c6ddda --- /dev/null +++ b/apps/base/puppet/service_puppetserver-puppetdb.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetdb + namespace: puppet +spec: + clusterIP: null + ports: + - name: pdb-http + port: 8080 + targetPort: pdb-http + - name: pdb-https + port: 8081 + targetPort: pdb-https + selector: + app.kubernetes.io/component: puppetdb + app.kubernetes.io/name: puppetserver + type: ClusterIP diff --git a/apps/base/puppet/statefulset_puppetserver-compiler.yaml b/apps/base/puppet/statefulset_puppetserver-compiler.yaml new file mode 100644 index 0000000..359249a --- /dev/null +++ b/apps/base/puppet/statefulset_puppetserver-compiler.yaml @@ -0,0 +1,183 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + annotations: + reloader.stakater.com/auto: "true" + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + name: puppetserver-compiler + namespace: puppet +spec: + podManagementPolicy: OrderedReady + selector: + matchLabels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/name: puppetserver + serviceName: puppet-compilers-headless + template: + metadata: + labels: + app.kubernetes.io/component: puppetserver-compilers + app.kubernetes.io/instance: puppetserver + app.kubernetes.io/name: puppetserver + app.kubernetes.io/version: 8.8.0 + spec: + hostname: puppetserver-compiler + imagePullSecrets: null + containers: + - name: puppetserver + image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main + imagePullPolicy: IfNotPresent + resources: + limits: + cpu: 2 + memory: 3072Mi + requests: + cpu: 500m + memory: 1024Mi + ports: + - containerPort: 8140 + envFrom: null + env: + - name: OPENVOXSERVER_HOSTNAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPENVOXSERVER_PORT + value: "8140" + - name: DNS_ALT_NAMES + value: puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppet-compilers,puppet,puppet.k8s.syd1.au.unkin.net + - name: OPENVOXDB_SERVER_URLS + value: https://puppetdb:8081 + - name: CA_ENABLED + value: "false" + - name: CA_HOSTNAME + value: puppetca + - name: CA_PORT + value: "8140" + - name: PUPPETSERVER_JAVA_ARGS + value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false + livenessProbe: + failureThreshold: 3 + periodSeconds: 30 + successThreshold: 1 + tcpSocket: + port: 8140 + timeoutSeconds: 10 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /status/v1/simple + port: 8140 + scheme: HTTPS + periodSeconds: 60 + successThreshold: 1 + timeoutSeconds: 20 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - CAP_CHOWN + - CAP_SETUID + - CAP_SETGID + - CAP_DAC_OVERRIDE + - CAP_AUDIT_WRITE + - CAP_FOWNER + - CHOWN + - SETUID + - SETGID + - DAC_OVERRIDE + - AUDIT_WRITE + - FOWNER + drop: + - all + startupProbe: + failureThreshold: 30 + periodSeconds: 15 + tcpSocket: + port: 8140 + volumeMounts: + - mountPath: /etc/puppetlabs/code/ + name: puppet-code-volume + - mountPath: /etc/puppetlabs/puppet/ + name: puppet-puppet-volume + - mountPath: /var/lib/puppet/keys/ + name: eyaml-keys + readOnly: true + initContainers: + - args: + - mkdir -p /etc/puppetlabs/puppet/eyaml/keys; + mkdir -p /etc/puppetlabs/code/environments; + mkdir -p /etc/puppetlabs/puppet/manifests; + chown -R puppet:puppet /etc/puppetlabs; + chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml; + mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/; + touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde; + chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/; + command: + - sh + - -c + env: + - name: PUPPETSERVER_JAVA_ARGS + value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false + envFrom: null + image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main + imagePullPolicy: IfNotPresent + name: perms-and-dirs + resources: + limits: + cpu: 300m + memory: 256Mi + requests: + cpu: 200m + memory: 128Mi + securityContext: + capabilities: + add: + - CAP_CHOWN + - CAP_SETUID + - CAP_SETGID + - CAP_DAC_OVERRIDE + - CAP_AUDIT_WRITE + - CAP_FOWNER + - CHOWN + - SETUID + - SETGID + - DAC_OVERRIDE + - AUDIT_WRITE + - FOWNER + drop: + - all + runAsNonRoot: false + runAsUser: 0 + volumeMounts: + - mountPath: /etc/puppetlabs/code/ + name: puppet-code-volume + - mountPath: /etc/puppetlabs/puppet/ + name: puppet-puppet-volume + securityContext: + fsGroup: 999 + volumes: + - name: puppet-code-volume + persistentVolumeClaim: + claimName: puppetserver-code-shared + - name: eyaml-keys + secret: + secretName: eyaml-keys + defaultMode: 0600 + updateStrategy: + type: RollingUpdate + volumeClaimTemplates: + - metadata: + annotations: null + name: puppet-puppet-volume + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + storageClassName: cephrbd-fast-delete diff --git a/apps/base/puppet/vaultstaticsecret.yaml b/apps/base/puppet/vaultstaticsecret.yaml index 002d4d9..a8f68bd 100644 --- a/apps/base/puppet/vaultstaticsecret.yaml +++ b/apps/base/puppet/vaultstaticsecret.yaml @@ -32,3 +32,20 @@ spec: refreshAfter: 5m type: kv-v2 vaultAuthRef: default +--- +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultStaticSecret +metadata: + name: eyaml-keys + namespace: puppet +spec: + destination: + create: true + name: eyaml-keys + overwrite: true + hmacSecretData: true + mount: kv + path: kubernetes/namespace/puppet/default/eyaml-keys + refreshAfter: 5m + type: kv-v2 + vaultAuthRef: default