Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
7a9ed39f97 |
@@ -1,273 +0,0 @@
|
||||
---
|
||||
description: Pull master, read open issues, pick one, branch, implement, test, commit, PR, and comment.
|
||||
---
|
||||
|
||||
# Solve a Gitea Issue
|
||||
|
||||
## Current repo state
|
||||
|
||||
```!
|
||||
git status --short
|
||||
echo "Current branch: $(git branch --show-current)"
|
||||
echo "Remote: $(git remote get-url origin 2>/dev/null || echo 'none')"
|
||||
```
|
||||
|
||||
## Open issues (with full body)
|
||||
|
||||
```!
|
||||
echo "Fetching open issues..."
|
||||
issue_ids=$(tea issues list --output simple 2>/dev/null | awk 'NF && $1 ~ /^[0-9]+$/ {print $1}')
|
||||
if [ -z "$issue_ids" ]; then
|
||||
echo "No open issues found (or tea is not logged in)."
|
||||
else
|
||||
for id in $issue_ids; do
|
||||
echo ""
|
||||
echo "══════════════════════════════════════"
|
||||
tea issues view "$id" --fields index,title,body 2>/dev/null \
|
||||
|| tea issue "$id" 2>/dev/null \
|
||||
|| echo " (could not read issue #$id)"
|
||||
echo "══════════════════════════════════════"
|
||||
done
|
||||
fi
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Your task
|
||||
|
||||
Follow these steps **in order**. Do not skip steps.
|
||||
|
||||
### 1 — Choose an issue
|
||||
|
||||
Present the issues above to the user as a numbered list (index, one-line title). Ask which one to work on. Wait for the answer before continuing.
|
||||
|
||||
### 2 — Sync master
|
||||
|
||||
```bash
|
||||
git checkout master
|
||||
git pull
|
||||
```
|
||||
|
||||
Confirm you are on master and up to date.
|
||||
|
||||
### 3 — Create a branch
|
||||
|
||||
Name the branch `benvin/issue-<N>-<short-slug>` where `<short-slug>` is 2–4 kebab-case words from the issue title.
|
||||
|
||||
```bash
|
||||
git checkout -b benvin/issue-<N>-<slug>
|
||||
```
|
||||
|
||||
### 4 — Read the issue in full
|
||||
|
||||
Re-read the full issue body shown above. If any part is ambiguous, state your interpretation before coding.
|
||||
|
||||
**If you discover other problems while working:** do NOT solve them inline. Create a new Gitea issue with `tea issues create --title "..." --description "..."` and stay focused on the assigned issue.
|
||||
|
||||
### 5 — Implement the solution
|
||||
|
||||
Make the code changes needed to resolve the issue. Follow the conventions already in the repo:
|
||||
- `main.py` route handlers each contain a single function call; logic lives in submodules.
|
||||
- No comments unless the WHY is non-obvious.
|
||||
- No new files unless the issue or architecture requires it.
|
||||
- Security: no command injection, XSS, SQL injection, or secrets in code.
|
||||
- **For performance improvements:** implement at the most generic call site possible so the fix applies to all current and future implementations, not just the one being tested.
|
||||
|
||||
### 6 — Update tests
|
||||
|
||||
Add or update tests that cover the new behaviour. Tests live in `tests/`. Check existing test structure before writing new ones — mirror the style and fixture patterns already in use.
|
||||
|
||||
### 7 — Update README
|
||||
|
||||
If the feature introduces new config keys, endpoints, or user-facing behaviour, document it in `README.md`. Keep additions concise — follow the existing section style.
|
||||
|
||||
### 8 — Run the full test suite
|
||||
|
||||
```bash
|
||||
make test
|
||||
```
|
||||
|
||||
All tests must pass. If any fail, fix them before proceeding. Do not skip or suppress failing tests.
|
||||
|
||||
### 9 — Live Docker test (new package type only)
|
||||
|
||||
**Skip this step if the issue does not add a new remote package type.**
|
||||
|
||||
If the issue adds a new package type (e.g. `deb`, `conda`, `cargo`, `rubygems`, or any type not already in `remotes.yaml`), do the following before committing.
|
||||
|
||||
#### 9a — Add a real test remote to remotes.yaml
|
||||
|
||||
Append a valid, publicly accessible remote of the new type to `remotes.yaml`. Use a real upstream URL and patterns that cover both an immutable file (versioned artifact) and a mutable file (index/metadata). Add a comment explaining which URLs to use for manual testing.
|
||||
|
||||
#### 9b — Start the stack
|
||||
|
||||
```bash
|
||||
make docker-up
|
||||
```
|
||||
|
||||
Wait until `curl -s http://localhost:8000/health` returns `{"status":"healthy"}`.
|
||||
|
||||
#### 9c — Test a mutable file (first fetch — cache miss)
|
||||
|
||||
Download the index or metadata file for the new remote. Confirm:
|
||||
- HTTP 200
|
||||
- `X-Artifact-Source: remote` header (or equivalent log line confirming a cache miss)
|
||||
- Content looks correct (not empty, not an error page)
|
||||
|
||||
```bash
|
||||
curl -sv "http://localhost:8000/api/v1/remote/<new-remote>/<mutable-path>" 2>&1 | grep -E "< HTTP|X-Artifact"
|
||||
```
|
||||
|
||||
#### 9d — Test a mutable file (second fetch — cache hit)
|
||||
|
||||
Repeat the exact same request. Confirm:
|
||||
- HTTP 200
|
||||
- `X-Artifact-Source: cache`
|
||||
|
||||
```bash
|
||||
curl -sv "http://localhost:8000/api/v1/remote/<new-remote>/<mutable-path>" 2>&1 | grep -E "< HTTP|X-Artifact"
|
||||
```
|
||||
|
||||
#### 9e — Test an immutable file (first fetch — cache miss)
|
||||
|
||||
Download a versioned/immutable artifact. Confirm HTTP 200 and a cache-miss log line.
|
||||
|
||||
```bash
|
||||
curl -sv "http://localhost:8000/api/v1/remote/<new-remote>/<immutable-path>" 2>&1 | grep -E "< HTTP|X-Artifact"
|
||||
```
|
||||
|
||||
#### 9f — Test an immutable file (second fetch — cache hit)
|
||||
|
||||
Repeat. Confirm `X-Artifact-Source: cache`.
|
||||
|
||||
#### 9g — Check container logs
|
||||
|
||||
```bash
|
||||
make docker-logs
|
||||
```
|
||||
|
||||
Scan for:
|
||||
- `Cache MISS` on first fetches, `Cache HIT` on second fetches
|
||||
- `Cache ADD SUCCESS` with correct sizes
|
||||
- No unhandled exceptions or ERROR lines
|
||||
|
||||
#### 9h — Exercise package-type tooling against the proxy
|
||||
|
||||
Use the native tooling for this package type to verify end-to-end behaviour. Examples:
|
||||
|
||||
| Package type | Command |
|
||||
|---|---|
|
||||
| `pypi` | `uv run --index-url http://localhost:8000/api/v1/remote/<remote>/simple <tool>` |
|
||||
| `npm` | `npm install --registry http://localhost:8000/api/v1/remote/<remote>/ <pkg>` |
|
||||
| `helm` | `helm repo add test http://localhost:8000/api/v1/remote/<remote> && helm search repo test && helm template test/<chart>` |
|
||||
| `alpine` | `apk fetch --repository http://localhost:8000/api/v1/remote/<remote>/<branch>/<arch> <pkg>` |
|
||||
| `rpm` | `dnf install --repofrompath ... <pkg>` or `repoquery` |
|
||||
| `generic` | `curl` / `wget` as appropriate |
|
||||
|
||||
Confirm the tool resolves and downloads correctly through the proxy.
|
||||
|
||||
#### 9i — Tear down
|
||||
|
||||
```bash
|
||||
make docker-down
|
||||
```
|
||||
|
||||
Fix any failures found during 9b–9h before moving on.
|
||||
|
||||
### 9.5 — Performance issues: measure before/after and gate the PR
|
||||
|
||||
**Skip this step if the issue is not a performance improvement.**
|
||||
|
||||
For performance issues, a PR is only warranted if there is a measurable gain. Use the Docker stack to compare before and after.
|
||||
|
||||
#### 9.5a — Baseline measurement (before)
|
||||
|
||||
Start the stack with the **unmodified** code (temporarily revert your change):
|
||||
|
||||
```bash
|
||||
make docker-up
|
||||
```
|
||||
|
||||
Warm or clear the cache as appropriate, then measure the relevant metric — e.g. concurrent request latency during a slow operation, response time for a specific endpoint, or throughput. Record the numbers.
|
||||
|
||||
#### 9.5b — Apply your change and rebuild
|
||||
|
||||
```bash
|
||||
make docker-up # rebuilds the image
|
||||
```
|
||||
|
||||
Repeat exactly the same measurement. Record the numbers.
|
||||
|
||||
#### 9.5c — Decide
|
||||
|
||||
If the improvement is not clearly measurable, **do not open a PR**. Instead:
|
||||
1. Update the issue with your findings.
|
||||
2. Note any conditions under which the improvement would be observable.
|
||||
3. Skip steps 11–14.
|
||||
|
||||
If the improvement is clear, proceed with the commit and PR. Include the before/after numbers in the PR description and the issue comment.
|
||||
|
||||
#### 9.5d — Tear down
|
||||
|
||||
```bash
|
||||
make docker-down
|
||||
```
|
||||
|
||||
### 10 — Build the wheel (smoke check)
|
||||
|
||||
```bash
|
||||
uv build --wheel
|
||||
```
|
||||
|
||||
Confirm the build succeeds.
|
||||
|
||||
### 11 — Stage and commit
|
||||
|
||||
Stage only the files you changed. Do not use `git add -A` or `git add .` — list files explicitly. Run:
|
||||
|
||||
```bash
|
||||
git add <file1> <file2> ...
|
||||
git commit
|
||||
```
|
||||
|
||||
The commit message must:
|
||||
- Start with a conventional-commit prefix (`feat:`, `fix:`, `refactor:`, `chore:`, etc.)
|
||||
- Summarise the change in ≤ 72 characters on the first line
|
||||
- Optionally include a short body explaining *why* (not *what*)
|
||||
|
||||
If the pre-commit hook auto-fixes files, re-stage the fixed files and commit again.
|
||||
|
||||
### 12 — Push the branch
|
||||
|
||||
```bash
|
||||
git push origin <branch-name>
|
||||
```
|
||||
|
||||
### 13 — Open a pull request
|
||||
|
||||
```bash
|
||||
tea pulls create \
|
||||
--base master \
|
||||
--head <branch-name> \
|
||||
--title "<same as commit subject>" \
|
||||
--description "Closes #<N>\n\n## Summary\n<bullet points>\n\n## Test plan\n<what was verified>"
|
||||
```
|
||||
|
||||
### 14 — Comment on the issue
|
||||
|
||||
```bash
|
||||
tea comment <N> "<resolution comment>"
|
||||
```
|
||||
|
||||
The comment must cover:
|
||||
- **How it was resolved** — what changed and why
|
||||
- **Issues encountered** — any non-obvious problems hit during implementation
|
||||
- **Potential future improvements** — what could be done next
|
||||
|
||||
### 15 — Return to master
|
||||
|
||||
```bash
|
||||
git checkout master
|
||||
```
|
||||
|
||||
Report the PR URL and a one-sentence summary to the user.
|
||||
@@ -7,7 +7,6 @@ repos:
|
||||
- id: check-json
|
||||
- id: check-added-large-files
|
||||
args: ['--maxkb=500']
|
||||
exclude: '^schemas/'
|
||||
- id: check-merge-conflict
|
||||
- id: check-shebang-scripts-are-executable
|
||||
- id: check-symlinks
|
||||
@@ -20,7 +19,6 @@ repos:
|
||||
- id: end-of-file-fixer
|
||||
- id: forbid-new-submodules
|
||||
- id: pretty-format-json
|
||||
args: ['--autofix']
|
||||
- id: trailing-whitespace
|
||||
|
||||
# YAML linting
|
||||
|
||||
@@ -3,7 +3,7 @@ when:
|
||||
|
||||
steps:
|
||||
- name: kubeconform
|
||||
image: git.unkin.net/unkin/almalinux9-kubetest:20260606
|
||||
image: git.unkin.net/unkin/almalinux9-kubetest:20260319
|
||||
commands:
|
||||
- make kubeconform
|
||||
backend_options:
|
||||
|
||||
@@ -3,7 +3,7 @@ when:
|
||||
|
||||
steps:
|
||||
- name: pre-commit
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260606
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260308
|
||||
commands:
|
||||
- uvx pre-commit run --all-files
|
||||
backend_options:
|
||||
|
||||
@@ -1,29 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: vector-test
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/timberio/vector:0.57.0-debian
|
||||
commands:
|
||||
# Dummy creds + writable dirs so the full topologies build; the unit tests
|
||||
# only exercise the transforms (sources are not started).
|
||||
- export CLICKHOUSE_USER=ci CLICKHOUSE_PASSWORD=ci
|
||||
- export NATS_PRODUCER_PASSWORD=ci NATS_CONSUMER_PASSWORD=ci
|
||||
- mkdir -p /vector-data-dir /etc/vault-ca
|
||||
- cp /etc/ssl/certs/ca-certificates.crt /etc/vault-ca/ca.crt
|
||||
# Transform tier + VM ingest: unit-tested transforms.
|
||||
- vector test apps/base/logging/vector/aggregator.yaml apps/base/logging/vector/aggregator-tests.yaml
|
||||
- vector test apps/base/logging/vector/vm-ingest.yaml apps/base/logging/vector/vm-ingest-tests.yaml
|
||||
# Agent has no transforms to unit-test; validate it builds. (The archiver
|
||||
# leg is now the logarchiver service, not a Vector pipeline.)
|
||||
- vector validate --no-environment apps/base/logging/vector/agent.yaml
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1
|
||||
@@ -1,261 +0,0 @@
|
||||
# AGENTS.md
|
||||
|
||||
## Project Overview
|
||||
|
||||
This is an **ArgoCD GitOps repository** that manages Kubernetes applications for the `au-syd1` cluster using a Kustomize + Helm pattern. Applications are deployed via ArgoCD ApplicationSets that watch directory patterns in this repo.
|
||||
|
||||
The migration pattern for this repo is: **Terragrunt/Terraform → ArgoCD** (see `migration.md` for full guide).
|
||||
|
||||
---
|
||||
|
||||
## Essential Commands
|
||||
|
||||
```bash
|
||||
# Build and render manifests for a path (outputs to manifests/<path>/)
|
||||
make build apps/overlays/au-syd1/<app-name>
|
||||
make build clusters/au-syd1/bootstrap
|
||||
|
||||
# Validate all apps and clusters with kubeconform
|
||||
make kubeconform
|
||||
|
||||
# Clean generated manifests
|
||||
make clean
|
||||
|
||||
# Quick build + inspect without persisting output
|
||||
kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
|
||||
|
||||
# Check all resource kinds produced by an overlay
|
||||
kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
|
||||
|
||||
# Run pre-commit checks against all files
|
||||
uvx pre-commit run --all-files
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Directory Structure
|
||||
|
||||
```
|
||||
argocd-apps/
|
||||
├── argocd/
|
||||
│ ├── applicationsets/ # ArgoCD ApplicationSet definitions (platform.yaml, storage.yaml)
|
||||
│ └── projects/ # ArgoCD AppProject definitions (platform.yaml, storage.yaml)
|
||||
├── apps/
|
||||
│ ├── base/ # Base Kustomize resources per app (no cluster-specific config)
|
||||
│ │ └── <app-name>/
|
||||
│ │ ├── kustomization.yaml
|
||||
│ │ ├── namespace.yaml
|
||||
│ │ ├── vaultauth.yaml # (if Vault-managed secrets)
|
||||
│ │ └── vaultstaticsecret.yaml
|
||||
│ └── overlays/
|
||||
│ └── au-syd1/ # Cluster-specific overlays
|
||||
│ └── <app-name>/
|
||||
│ ├── kustomization.yaml # references base + helmCharts
|
||||
│ └── values.yaml # Helm values for this cluster
|
||||
├── clusters/
|
||||
│ └── au-syd1/
|
||||
│ ├── apps/ # Entry point: references apps/base (ArgoCD app-of-apps)
|
||||
│ └── bootstrap/ # ArgoCD install + initial Application manifest
|
||||
├── ci/
|
||||
│ ├── validate-apps.sh # kubeconform over apps/overlays/*/kustomization.yaml
|
||||
│ ├── validate-clusters.sh # kubeconform over clusters/*/kustomization.yaml
|
||||
│ └── validate-no-secrets.sh # pre-commit hook: blocks plain Kubernetes Secrets
|
||||
└── sources/ # Reference sources (Terraform configs, upstream charts, etc.)
|
||||
└── terraform-k8s/ # Original Terraform configs — reference when migrating
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Adding a New Application
|
||||
|
||||
Follow these 10 steps (detailed in `migration.md`):
|
||||
|
||||
### 1. Create base resources
|
||||
```
|
||||
apps/base/<app-name>/
|
||||
├── kustomization.yaml
|
||||
├── namespace.yaml
|
||||
├── vaultauth.yaml # if needed
|
||||
└── vaultstaticsecret.yaml # if needed
|
||||
```
|
||||
|
||||
### 2. Create cluster overlay
|
||||
```
|
||||
apps/overlays/au-syd1/<app-name>/
|
||||
├── kustomization.yaml
|
||||
└── values.yaml
|
||||
```
|
||||
|
||||
**Overlay kustomization.yaml pattern:**
|
||||
```yaml
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/<app-name>
|
||||
|
||||
helmCharts:
|
||||
- name: <chart-name>
|
||||
repo: <helm-repo-url>
|
||||
version: "<version>"
|
||||
releaseName: <release-name>
|
||||
namespace: <namespace>
|
||||
valuesFile: values.yaml
|
||||
```
|
||||
|
||||
### 3. Register in ApplicationSet
|
||||
Add a directory entry to `argocd/applicationsets/platform.yaml` (or `storage.yaml` for `csi-*` apps):
|
||||
```yaml
|
||||
- path: apps/overlays/*/<app-name>
|
||||
```
|
||||
|
||||
### 4. Update AppProject
|
||||
In `argocd/projects/platform.yaml` (or `storage.yaml`):
|
||||
- Add the Helm repo URL to `sourceRepos`
|
||||
- Add the namespace to `destinations`
|
||||
- Add any required cluster-scoped resource types to `clusterResourceWhitelist`
|
||||
|
||||
### 5. Validate
|
||||
```bash
|
||||
kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
|
||||
make kubeconform
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Secret Management
|
||||
|
||||
**Plain Kubernetes `Secret` objects are blocked** by the pre-commit hook. Use Vault Operator CRDs instead:
|
||||
|
||||
### VaultAuth template
|
||||
```yaml
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: <namespace>
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: k8s/au/syd1
|
||||
vaultConnectionRef: vso-system/default
|
||||
allowedNamespaces:
|
||||
- <namespace>
|
||||
kubernetes:
|
||||
role: <role>
|
||||
serviceAccount: <service-account>
|
||||
audiences:
|
||||
- vault
|
||||
tokenExpirationSeconds: 600
|
||||
```
|
||||
|
||||
### VaultStaticSecret template
|
||||
```yaml
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: <secret-name>
|
||||
namespace: <namespace>
|
||||
spec:
|
||||
vaultAuthRef: default
|
||||
mount: kv
|
||||
type: kv-v2
|
||||
path: kubernetes/namespace/<namespace>/default/<secret-name>
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: <k8s-secret-name>
|
||||
create: true
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## YAML Conventions
|
||||
|
||||
- **2-space indentation** (enforced by yamllint)
|
||||
- All files must end with a newline (`end-of-file-fixer`)
|
||||
- No trailing whitespace
|
||||
- YAML linting uses relaxed rules with `line-length: disable` (long base64/URLs are fine)
|
||||
- yamllint ignores `chart` directories (vendored Helm charts)
|
||||
- `---` document separator at top of every YAML file
|
||||
- Multiple documents in one file are allowed (e.g., `vaultstaticsecret.yaml` often contains multiple secrets)
|
||||
|
||||
---
|
||||
|
||||
## Kubernetes Labels Pattern
|
||||
|
||||
Use standard `app.kubernetes.io/*` labels consistently:
|
||||
```yaml
|
||||
labels:
|
||||
app.kubernetes.io/component: <component>
|
||||
app.kubernetes.io/instance: <release-name>
|
||||
app.kubernetes.io/name: <app-name>
|
||||
app.kubernetes.io/version: <version>
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Resource Naming Conventions
|
||||
|
||||
Files in `apps/base/<app-name>/` follow the pattern:
|
||||
```
|
||||
<kind>_<name>.yaml
|
||||
```
|
||||
Examples:
|
||||
- `deployment_puppetserver-master.yaml`
|
||||
- `cronjob_g10k-code.yaml`
|
||||
- `configmap_puppetboard-config.yaml`
|
||||
- `horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml`
|
||||
- `service_puppet-headless.yaml`
|
||||
|
||||
---
|
||||
|
||||
## Helm Chart Vendoring
|
||||
|
||||
Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
|
||||
|
||||
Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
|
||||
|
||||
---
|
||||
|
||||
## Project Boundaries
|
||||
|
||||
| Project | ApplicationSet | App pattern |
|
||||
|------------|---------------------------|--------------------------|
|
||||
| `platform` | `argocd/applicationsets/platform.yaml` | Named apps (cert-manager, puppet, woodpecker, etc.) |
|
||||
| `storage` | `argocd/applicationsets/storage.yaml` | `csi-*` apps |
|
||||
|
||||
The `clusters/au-syd1/apps/` entry-point is deployed as a standalone ArgoCD `Application` (not an ApplicationSet) called `au-syd1-apps`.
|
||||
|
||||
---
|
||||
|
||||
## CI / Pre-commit Hooks
|
||||
|
||||
Runs on every PR via Woodpecker CI (`.woodpecker/`):
|
||||
|
||||
| Check | Tool | Trigger |
|
||||
|---|---|---|
|
||||
| YAML lint + general file checks | `pre-commit` (yamllint + pre-commit-hooks) | PR |
|
||||
| No plain Secrets | `ci/validate-no-secrets.sh` | PR (staged files) |
|
||||
| Kubernetes manifest validation | `kubeconform` via `make kubeconform` | PR |
|
||||
|
||||
kubeconform skips: `CustomResourceDefinition`, `GpuDevicePlugin` (for apps validation).
|
||||
|
||||
---
|
||||
|
||||
## Git Workflow
|
||||
|
||||
- Branch naming: `benvin/<app-name>` (user prefix)
|
||||
- **Never `git add .`** — add only relevant files explicitly
|
||||
- If pre-commit modifies files, `git add -u` then `git commit --amend --no-edit`
|
||||
- Use `git push --force-with-lease` after amending
|
||||
|
||||
---
|
||||
|
||||
## Security Policies
|
||||
|
||||
- `reloader.stakater.com/auto: "true"` annotation triggers rolling restarts on ConfigMap/Secret changes
|
||||
- Security contexts follow least-privilege: `drop: [all]` then add only required capabilities
|
||||
- `fsGroup: 999` on pod security context for Puppet workloads
|
||||
- `runAsUser: 0` is used only for init containers that need to set file permissions, then regular containers run as non-root
|
||||
@@ -1,4 +1,4 @@
|
||||
.PHONY: build clean schemas
|
||||
.PHONY: build clean
|
||||
|
||||
# Build a kustomization path to manifests directory
|
||||
# Usage: make build clusters/au-syd1/bootstrap
|
||||
@@ -6,10 +6,6 @@ build:
|
||||
@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
|
||||
@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
|
||||
|
||||
# Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
|
||||
schemas:
|
||||
@ci/generate-schemas.sh schemas
|
||||
|
||||
# kubeconform
|
||||
kubeconform:
|
||||
@ci/validate-apps.sh && \
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: age-api
|
||||
namespace: age-api
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: age-api
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
labels:
|
||||
app: age-api
|
||||
spec:
|
||||
containers:
|
||||
- name: age-api
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api:v0.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG_PATH
|
||||
value: /etc/age-api/config.yaml
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/age-api/config.yaml
|
||||
name: config
|
||||
subPath: config.yaml
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: age-api-config
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: age-api.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: age-api.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: age-api
|
||||
namespace: age-api
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: age-api.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: age-api.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: age-api-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: age-api-http-redirect
|
||||
namespace: age-api
|
||||
spec:
|
||||
hostnames:
|
||||
- age-api.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: age-api
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: age-api
|
||||
namespace: age-api
|
||||
spec:
|
||||
hostnames:
|
||||
- age-api.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: age-api
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: age-api
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- namespace.yaml
|
||||
- service.yaml
|
||||
- vpa.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: age-api-config
|
||||
files:
|
||||
- config.yaml=resources/config.yaml
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: age-api
|
||||
@@ -1,7 +0,0 @@
|
||||
people:
|
||||
- name: jaidi
|
||||
birthtime: 1773135720
|
||||
- name: ben
|
||||
birthtime: 559663200
|
||||
- name: sudaporn
|
||||
birthtime: 686757600
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: age-api
|
||||
namespace: age-api
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: age-api
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
@@ -1,13 +0,0 @@
|
||||
---
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: age-api-vpa
|
||||
namespace: age-api
|
||||
spec:
|
||||
targetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: age-api
|
||||
updatePolicy:
|
||||
updateMode: "Off"
|
||||
@@ -1,136 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: arrproxy-api
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
# Wave 2: serve only after the wave-1 migrate Job completes.
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
secret.reloader.stakater.com/reload: "arrproxy-pepper,arrproxy-db-app,sonarr-apikey,radarr-apikey,prowlarr-apikey"
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: arrproxy-api
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: arrproxy-api
|
||||
spec:
|
||||
serviceAccountName: default
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: api
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: ARRPROXY_ADDR
|
||||
value: ":8080"
|
||||
# oauth2-proxy --pass-user-headers forwards identity to the upstream as
|
||||
# X-Forwarded-{User,Email,Groups} (a single comma-joined Groups value).
|
||||
# Email/User already match the api defaults; override the groups header
|
||||
# (default X-Auth-Request-Groups is auth_request-response-only and never
|
||||
# reaches this upstream) so group-based authorization works.
|
||||
- name: ARRPROXY_GROUPS_HEADER
|
||||
value: X-Forwarded-Groups
|
||||
# Real per-app *arr keys, projected one file per app under this dir
|
||||
# (sourced from the existing <app>-apikey Secrets). The api injects
|
||||
# them server-side and redacts them from every proxied response.
|
||||
- name: ARRPROXY_KEYS_DIR
|
||||
value: /etc/arrproxy/keys
|
||||
- name: ARRPROXY_PEPPER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrproxy-pepper
|
||||
key: pepper
|
||||
# DSN assembled from the CNPG-generated arrproxy-db-app Secret;
|
||||
# $(VAR) expansion resolves the two env entries defined above it.
|
||||
- name: ARRPROXY_DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrproxy-db-app
|
||||
key: username
|
||||
- name: ARRPROXY_DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrproxy-db-app
|
||||
key: password
|
||||
- name: DATABASE_URL
|
||||
value: "postgres://$(ARRPROXY_DB_USER):$(ARRPROXY_DB_PASSWORD)@arrproxy-db-rw.arrstack.svc.cluster.local:5432/arrproxy?sslmode=require"
|
||||
volumeMounts:
|
||||
- name: arr-keys
|
||||
mountPath: /etc/arrproxy/keys
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
# Real *arr API keys, one file per app named exactly <app> so the api
|
||||
# reads /etc/arrproxy/keys/{sonarr,radarr,prowlarr}. Reuses the same
|
||||
# <app>-apikey Secrets the *arr Deployments already consume.
|
||||
- name: arr-keys
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: sonarr-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: sonarr
|
||||
- secret:
|
||||
name: radarr-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: radarr
|
||||
- secret:
|
||||
name: prowlarr-apikey
|
||||
items:
|
||||
- key: apitoken
|
||||
path: prowlarr
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
sizeLimit: 64Mi
|
||||
restartPolicy: Always
|
||||
@@ -1,51 +0,0 @@
|
||||
---
|
||||
# Ceph RGW (S3) backup target for the arrproxy token-store CNPG cluster,
|
||||
# provisioned by the in-estate cephrgw-operator. One dedicated bucket + owner
|
||||
# user per cluster.
|
||||
apiVersion: ceph.unkin.net/v1alpha1
|
||||
kind: ObjectStoreUser
|
||||
metadata:
|
||||
name: cnpg-arrproxy-backup
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
displayName: "CNPG backup owner (arrproxy)"
|
||||
uid: cnpg-arrproxy-backup
|
||||
maxBuckets: 5
|
||||
secretName: cnpg-arrproxy-backup-s3
|
||||
retainOnDelete: true
|
||||
---
|
||||
apiVersion: ceph.unkin.net/v1alpha1
|
||||
kind: Bucket
|
||||
metadata:
|
||||
name: cnpg-arrproxy
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
placementTarget: ec
|
||||
bucketName: cnpg-arrproxy
|
||||
ownerRef: cnpg-arrproxy-backup
|
||||
versioning: false
|
||||
tags:
|
||||
app: arrproxy
|
||||
purpose: cnpg-backup
|
||||
retainOnDelete: true
|
||||
---
|
||||
# Nightly base backup; continuous WAL archiving is always-on via the Cluster's
|
||||
# spec.backup.barmanObjectStore. Staggered off other clusters' schedules.
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: ScheduledBackup
|
||||
metadata:
|
||||
name: cnpg-arrproxy-nightly
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
schedule: "0 20 2 * * *"
|
||||
immediate: false
|
||||
backupOwnerReference: self
|
||||
method: barmanObjectStore
|
||||
cluster:
|
||||
name: arrproxy-db
|
||||
@@ -1,117 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: arrproxy-db
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
# Wave 0: DB (and the generated arrproxy-db-app Secret) must be Healthy before
|
||||
# the wave-1 migrate Job runs. ArgoCD gates on the Cluster's health status.
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinityType: preferred
|
||||
backup:
|
||||
retentionPolicy: 30d
|
||||
barmanObjectStore:
|
||||
destinationPath: s3://cnpg-arrproxy
|
||||
endpointURL: https://s3.ceph.unkin.net
|
||||
endpointCA:
|
||||
name: vault-ca-cert
|
||||
key: ca.crt
|
||||
s3Credentials:
|
||||
accessKeyId:
|
||||
name: cnpg-arrproxy-backup-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
secretAccessKey:
|
||||
name: cnpg-arrproxy-backup-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
serverName: arrproxy
|
||||
data:
|
||||
compression: bzip2
|
||||
jobs: 2
|
||||
wal:
|
||||
compression: zstd
|
||||
maxParallel: 2
|
||||
bootstrap:
|
||||
initdb:
|
||||
# No secret ref: CNPG mints the owner credentials and publishes them in the
|
||||
# generated "arrproxy-db-app" Secret, which the api reads to build the DSN.
|
||||
database: arrproxy
|
||||
encoding: UTF8
|
||||
localeCType: C
|
||||
localeCollate: C
|
||||
owner: arrproxy
|
||||
enablePDB: true
|
||||
enableSuperuserAccess: false
|
||||
failoverDelay: 0
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
|
||||
instances: 2
|
||||
logLevel: info
|
||||
maxSyncReplicas: 0
|
||||
minSyncReplicas: 0
|
||||
monitoring:
|
||||
customQueriesConfigMap:
|
||||
- key: queries
|
||||
name: cnpg-default-monitoring
|
||||
disableDefaultQueries: false
|
||||
enablePodMonitor: false
|
||||
postgresql:
|
||||
parameters:
|
||||
archive_mode: "on"
|
||||
archive_timeout: 5min
|
||||
dynamic_shared_memory_type: posix
|
||||
effective_cache_size: 256MB
|
||||
full_page_writes: "on"
|
||||
log_destination: csvlog
|
||||
log_directory: /controller/log
|
||||
log_filename: postgres
|
||||
log_rotation_age: "0"
|
||||
log_rotation_size: "0"
|
||||
log_truncate_on_rotation: "false"
|
||||
logging_collector: "on"
|
||||
max_connections: "200"
|
||||
max_parallel_workers: "16"
|
||||
max_replication_slots: "16"
|
||||
max_worker_processes: "16"
|
||||
shared_buffers: 128MB
|
||||
shared_memory_type: mmap
|
||||
ssl_max_protocol_version: TLSv1.3
|
||||
ssl_min_protocol_version: TLSv1.3
|
||||
wal_keep_size: 256MB
|
||||
wal_level: logical
|
||||
wal_log_hints: "on"
|
||||
wal_receiver_timeout: 5s
|
||||
wal_sender_timeout: 5s
|
||||
syncReplicaElectionConstraint:
|
||||
enabled: false
|
||||
primaryUpdateMethod: restart
|
||||
primaryUpdateStrategy: unsupervised
|
||||
probes:
|
||||
liveness:
|
||||
isolationCheck:
|
||||
connectionTimeout: 1000
|
||||
enabled: true
|
||||
requestTimeout: 1000
|
||||
replicationSlots:
|
||||
highAvailability:
|
||||
enabled: true
|
||||
slotPrefix: _cnpg_
|
||||
synchronizeReplicas:
|
||||
enabled: true
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
smartShutdownTimeout: 180
|
||||
startDelay: 3600
|
||||
stopDelay: 1800
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 10Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
switchoverDelay: 3600
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
# External (DMZ) front for the arrstack, served on arrstack.unkin.net via the
|
||||
# external Traefik (LB VIP 198.18.199.0). cert-manager mints arrproxy-gateway-tls
|
||||
# (CN arrstack.unkin.net) off the internal Vault-PKI CA. The apex arrstack.unkin.net
|
||||
# A record lives in the bind-operator unkin.net zone (bind-internal/authoritative),
|
||||
# NOT external-dns, so no external-dns annotation here.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: external
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: arrstack.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
name: arrproxy
|
||||
namespace: arrstack
|
||||
spec:
|
||||
gatewayClassName: traefik-external
|
||||
listeners:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
hostname: arrstack.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: arrstack.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: arrproxy-gateway-tls
|
||||
@@ -1,58 +0,0 @@
|
||||
---
|
||||
# Redirect plain HTTP to HTTPS.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: arrproxy-http-redirect
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
spec:
|
||||
hostnames:
|
||||
- arrstack.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: arrproxy
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
# All HTTPS traffic enters via oauth2-proxy (the arrproxy entry Service), which
|
||||
# authenticates and path-routes to arrproxy-ui / arrproxy-api. The UI-vs-api and
|
||||
# the /<app>/api oauth-bypass split is done inside oauth2-proxy (upstreams +
|
||||
# skip-auth-regex), so a single backend here is sufficient.
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: arrproxy-route
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
spec:
|
||||
hostnames:
|
||||
- arrstack.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: arrproxy
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: arrproxy
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_backup.yaml
|
||||
- migrations-configmap.yaml
|
||||
- migrate-job.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- oauth2-proxy-configmap.yaml
|
||||
- oauth2-proxy-deployment.yaml
|
||||
- api-deployment.yaml
|
||||
- ui-deployment.yaml
|
||||
- services.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
@@ -1,92 +0,0 @@
|
||||
---
|
||||
# Applies the arrproxy schema once per sync, before the api rolls, so the serve
|
||||
# replicas never race migrations (arrproxy-api does not self-migrate). Runs as the
|
||||
# CNPG-minted app user so the tokens table is owned by that role.
|
||||
#
|
||||
# Sync-phase hook at wave 1 (NOT PreSync): the CNPG Cluster + generated
|
||||
# arrproxy-db-app Secret apply at wave 0 and ArgoCD waits for the Cluster to be
|
||||
# Healthy before starting wave 1, so Postgres exists before migrate connects.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: arrproxy-migrate
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: Sync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||
argocd.argoproj.io/sync-wave: "1"
|
||||
spec:
|
||||
backoffLimit: 6
|
||||
ttlSecondsAfterFinished: 600
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: arrproxy-migrate
|
||||
spec:
|
||||
serviceAccountName: default
|
||||
automountServiceAccountToken: false
|
||||
restartPolicy: Never
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: migrate
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:18-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: HOME
|
||||
value: /tmp
|
||||
- name: PGUSER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrproxy-db-app
|
||||
key: username
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrproxy-db-app
|
||||
key: password
|
||||
- name: PGHOST
|
||||
value: arrproxy-db-rw.arrstack.svc.cluster.local
|
||||
- name: PGPORT
|
||||
value: "5432"
|
||||
- name: PGDATABASE
|
||||
value: arrproxy
|
||||
- name: PGSSLMODE
|
||||
value: require
|
||||
command:
|
||||
- psql
|
||||
- -v
|
||||
- ON_ERROR_STOP=1
|
||||
- -f
|
||||
- /migrations/0001_init.sql
|
||||
volumeMounts:
|
||||
- name: migrations
|
||||
mountPath: /migrations
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: migrations
|
||||
configMap:
|
||||
name: arrproxy-migrations
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
sizeLimit: 64Mi
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
# arrproxy schema, mirrored from the arrproxy repo migrations/0001_init.sql
|
||||
# (v0.1.0). arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies
|
||||
# this once per sync as the app user. Keep in sync with the repo on schema bumps.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: arrproxy-migrations
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
data:
|
||||
0001_init.sql: |
|
||||
-- arrproxy token store. Only token hashes are persisted; plaintext is shown
|
||||
-- once at mint time and never recoverable.
|
||||
CREATE TABLE IF NOT EXISTS tokens (
|
||||
id TEXT PRIMARY KEY,
|
||||
subject TEXT NOT NULL,
|
||||
label TEXT NOT NULL DEFAULT '',
|
||||
token_hash TEXT NOT NULL UNIQUE,
|
||||
apps TEXT[] NOT NULL DEFAULT '{}',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
expires_at TIMESTAMPTZ,
|
||||
disabled BOOLEAN NOT NULL DEFAULT false,
|
||||
last_used_at TIMESTAMPTZ
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
|
||||
CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);
|
||||
@@ -1,46 +0,0 @@
|
||||
---
|
||||
# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come from
|
||||
# the oauth-credentials Secret). oauth2-proxy is the single auth front for the
|
||||
# arrstack: it authenticates the UI and the token API against Authentik, and path-
|
||||
# routes to the arrproxy-ui / arrproxy-api upstreams. /<app>/api is exempted from
|
||||
# auth (SKIP_AUTH_REGEX) so *arr clients presenting a per-user token reach the api
|
||||
# directly; the api then validates the token. Everything else requires the oauth
|
||||
# session and receives identity via X-Forwarded-* / X-Auth-Request-* headers.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: arrproxy-oauth2-env
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
data:
|
||||
OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
|
||||
OAUTH2_PROXY_PROVIDER: "oidc"
|
||||
# Authentik arrstack app discovery issuer (served by the internal unkin.net CA;
|
||||
# trusted via PROVIDER_CA_FILES below). CONFIRM the slug matches the Authentik
|
||||
# application (terraform-authentik PR #18).
|
||||
OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/arrstack/"
|
||||
OAUTH2_PROXY_REDIRECT_URL: "https://arrstack.unkin.net/oauth2/callback"
|
||||
# Longest-prefix wins: /api and /<app> go to arrproxy-api, everything else
|
||||
# (the SPA + static assets) to arrproxy-ui.
|
||||
OAUTH2_PROXY_UPSTREAMS: "http://arrproxy-ui.arrstack.svc.cluster.local:8080/,http://arrproxy-api.arrstack.svc.cluster.local:8080/api/,http://arrproxy-api.arrstack.svc.cluster.local:8080/sonarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/radarr/,http://arrproxy-api.arrstack.svc.cluster.local:8080/prowlarr/"
|
||||
OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
|
||||
# Populate session.Groups from the Authentik ak_groups claim; pass-user-headers
|
||||
# then emits it as a single comma-joined X-Forwarded-Groups header.
|
||||
OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
|
||||
# Forward identity + groups to arrproxy-api as X-Forwarded-{User,Email,Groups}
|
||||
# (the api reads these; ARRPROXY_GROUPS_HEADER=X-Forwarded-Groups). NOTE:
|
||||
# set-xauthrequest is intentionally NOT set -- it only populates auth_request
|
||||
# *response* headers, which never reach an --upstreams-proxied backend.
|
||||
OAUTH2_PROXY_PASS_USER_HEADERS: "true"
|
||||
# Bypass auth ONLY for the *arr proxy API (/<app>/api...): this matches
|
||||
# /sonarr/api but NOT /api/tokens or /api/me (which stay authenticated).
|
||||
OAUTH2_PROXY_SKIP_AUTH_REGEX: "^/[^/]+/api"
|
||||
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
||||
OAUTH2_PROXY_COOKIE_SECURE: "true"
|
||||
OAUTH2_PROXY_COOKIE_DOMAINS: "arrstack.unkin.net"
|
||||
OAUTH2_PROXY_WHITELIST_DOMAINS: "arrstack.unkin.net"
|
||||
OAUTH2_PROXY_REVERSE_PROXY: "true"
|
||||
OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
|
||||
OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
|
||||
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|
||||
@@ -1,133 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: arrproxy-oauth2
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert"
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: arrproxy-oauth2
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: arrproxy-oauth2
|
||||
spec:
|
||||
serviceAccountName: default
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
initContainers:
|
||||
# identity.unkin.net serves a Vault-PKI cert; combine the system roots
|
||||
# with the internal CA so oauth2-proxy's OIDC HTTP client trusts it.
|
||||
- name: combine-certs
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/alpine:3
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
|
||||
volumeMounts:
|
||||
- name: vault-ca-cert
|
||||
mountPath: /custom-ca
|
||||
readOnly: true
|
||||
- name: combined-certs
|
||||
mountPath: /combined-certs
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
containers:
|
||||
- name: oauth2-proxy
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/oauth2-proxy:v7.15.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 4180
|
||||
name: http
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: arrproxy-oauth2-env
|
||||
optional: false
|
||||
env:
|
||||
- name: OAUTH2_PROXY_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: client_id
|
||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: client_secret
|
||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oauth-credentials
|
||||
key: cookie_secret
|
||||
volumeMounts:
|
||||
- name: combined-certs
|
||||
mountPath: /etc/ssl/combined
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: combined-certs
|
||||
emptyDir: {}
|
||||
restartPolicy: Always
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
# Front-door entry Service: the HTTPRoute for arrstack.unkin.net targets this.
|
||||
# All traffic (UI, token API, and the *arr proxy) enters via oauth2-proxy.
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: arrproxy
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: arrproxy-oauth2
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: arrproxy-api
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: arrproxy-api
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: arrproxy-ui
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: arrproxy-ui
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
@@ -1,72 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: arrproxy-ui
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "2"
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: arrproxy-ui
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: arrproxy-ui
|
||||
spec:
|
||||
serviceAccountName: default
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: ui
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-ui:v0.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: ARRPROXY_UI_ADDR
|
||||
value: ":8080"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: http
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
restartPolicy: Always
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
# Per-deployment token-hash pepper. Seeded (openssl rand) at
|
||||
# kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key: pepper); the
|
||||
# default k8s role's templated policy already grants read on
|
||||
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the arrproxy-pepper Secret consumed by arrproxy-api as
|
||||
# ARRPROXY_PEPPER.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: arrproxy-pepper
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: arrproxy-pepper
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/arrproxy-pepper
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
# Authentik OIDC client for the arrstack front door (client_id, client_secret,
|
||||
# cookie_secret), created by terraform-authentik at
|
||||
# kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into
|
||||
# the oauth-credentials Secret consumed by the oauth2-proxy Deployment.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: oauth-credentials
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: oauth-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/oauth-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- vaultauth.yaml
|
||||
- pv-media-tv.yaml
|
||||
- pv-media-movies.yaml
|
||||
- pvc-media-tv.yaml
|
||||
- pvc-media-movies.yaml
|
||||
- sonarr
|
||||
- radarr
|
||||
- prowlarr
|
||||
- nzbget
|
||||
- arrproxy
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: arrstack
|
||||
@@ -1,137 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nzbget
|
||||
namespace: arrstack
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
# RWO config PVC + single queue state: never run two pods at once.
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nzbget
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nzbget
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Seed download layout onto the shared media PVCs (not /config or an
|
||||
# emptyDir) so completed downloads land beside the arr libraries and
|
||||
# imports are same-filesystem hardlink moves. Reuses the image's own
|
||||
# template (inherits correct WebDir/ConfigTemplate) and appends the
|
||||
# path/category overrides once; nzbget honours the last value for a
|
||||
# repeated option, and the grep guard keeps re-runs idempotent so admin
|
||||
# UI edits to the persisted /config/nzbget.conf survive restarts.
|
||||
- name: seed-config
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
if [ ! -f /config/nzbget.conf ]; then
|
||||
cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf
|
||||
fi
|
||||
if ! grep -q '# arrstack-managed' /config/nzbget.conf; then
|
||||
cat >> /config/nzbget.conf << 'CONF'
|
||||
|
||||
# arrstack-managed download layout (appended once; last value wins).
|
||||
# Downloads land on the shared media PVCs by category so sonarr/radarr
|
||||
# import with atomic hardlink moves (download dir + library share one
|
||||
# filesystem per media type). InterDir is empty: nzbget writes each
|
||||
# download straight into its category DestDir, so BOTH tv and movies
|
||||
# stay on their own PVC with no cross-filesystem intermediate copy.
|
||||
MainDir=/media/tv
|
||||
InterDir=
|
||||
DestDir=/media/tv/downloads
|
||||
NzbDir=/config/nzb
|
||||
QueueDir=/config/queue
|
||||
TempDir=/config/tmp
|
||||
ControlIP=0.0.0.0
|
||||
ControlPort=6789
|
||||
Category1.Name=tv
|
||||
Category1.DestDir=/media/tv/downloads
|
||||
Category2.Name=movies
|
||||
Category2.DestDir=/media/movies/downloads
|
||||
CONF
|
||||
fi
|
||||
mkdir -p /media/tv/series /media/tv/downloads /media/movies/films /media/movies/downloads
|
||||
chown 1000:1000 /config/nzbget.conf \
|
||||
/media/tv /media/tv/series /media/tv/downloads \
|
||||
/media/movies /media/movies/films /media/movies/downloads
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media-tv
|
||||
mountPath: /media/tv
|
||||
- name: media-movies
|
||||
mountPath: /media/movies
|
||||
containers:
|
||||
- name: nzbget
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/nzbget:version-v26.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 6789
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: Australia/Sydney
|
||||
livenessProbe:
|
||||
# nzbget's root path requires auth (401); a TCP check is the
|
||||
# dependency-free liveness signal for the web/JSON-RPC server.
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
# Headroom for par2 repair + unpack of large downloads.
|
||||
cpu: "2"
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media-tv
|
||||
mountPath: /media/tv
|
||||
- name: media-movies
|
||||
mountPath: /media/movies
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: nzbget-config
|
||||
- name: media-tv
|
||||
persistentVolumeClaim:
|
||||
claimName: media-tv
|
||||
- name: media-movies
|
||||
persistentVolumeClaim:
|
||||
claimName: media-movies
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: nzbget.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: nzbget.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: nzbget
|
||||
namespace: arrstack
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: nzbget.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: nzbget.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: nzbget-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: nzbget-http-redirect
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- nzbget.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: nzbget
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: nzbget-route
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- nzbget.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: nzbget
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: nzbget
|
||||
port: 6789
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- pvc-config.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
# NZBGet config + queue/temp state. RWO on cephrbd (block). Retain: this is
|
||||
# state. The download data itself lives on the shared media PVCs, not here.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nzbget-config
|
||||
namespace: arrstack
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: cephrbd-fast-retain
|
||||
volumeMode: Filesystem
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nzbget
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 6789
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: nzbget
|
||||
type: ClusterIP
|
||||
@@ -1,115 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: prowlarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
# RWO config PVC + single stateful SQLite DB: never run two pods at once.
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: prowlarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: prowlarr
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Enforce the Vault-sourced API key in /config/config.xml before the app
|
||||
# starts. Vault is source of truth (override bootstrap): the key is minted
|
||||
# in Vault, synced by VSO into the prowlarr-apikey Secret, and written here.
|
||||
# Runs as root to fix ownership; touches only the <ApiKey> element.
|
||||
- name: apikey-init
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
env:
|
||||
- name: API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: prowlarr-apikey
|
||||
key: apitoken
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
case "$API_KEY" in
|
||||
"" | *[!0-9a-fA-F]*)
|
||||
echo "apikey-init: API_KEY missing or not hex; refusing" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
CFG=/config/config.xml
|
||||
if [ ! -f "$CFG" ]; then
|
||||
printf '<Config>\n <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
|
||||
elif grep -q '<ApiKey>' "$CFG"; then
|
||||
sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
|
||||
else
|
||||
sed -i "s|<Config>|<Config>\n <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
|
||||
fi
|
||||
chown 1000:1000 "$CFG"
|
||||
chmod 600 "$CFG"
|
||||
echo "apikey-init: <ApiKey> enforced from Vault"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
containers:
|
||||
- name: prowlarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/prowlarr:2.5.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 9696
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: Australia/Sydney
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: prowlarr-config
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: prowlarr.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: prowlarr.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: prowlarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: prowlarr.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: prowlarr.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: prowlarr-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: prowlarr-http-redirect
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- prowlarr.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: prowlarr
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: prowlarr-route
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- prowlarr.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: prowlarr
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: prowlarr
|
||||
port: 9696
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- pvc-config.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
# Prowlarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
|
||||
# does not tolerate CephFS locking. Retain: this is state.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: prowlarr-config
|
||||
namespace: arrstack
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: cephrbd-fast-retain
|
||||
volumeMode: Filesystem
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: prowlarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 9696
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: prowlarr
|
||||
type: ClusterIP
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
# prowlarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/prowlarr
|
||||
# (key: apitoken); the default k8s role's templated policy already grants read
|
||||
# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the prowlarr-apikey Secret that the apikey-init initContainer reads
|
||||
# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: prowlarr-apikey
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: prowlarr-apikey
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/prowlarr
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,31 +0,0 @@
|
||||
---
|
||||
# Static PV for the shared MOVIES CephFS subvolume. Same rootPath as jellyfin's
|
||||
# movies PV so radarr/nzbget write and jellyfin reads the identical library
|
||||
# tree; each namespace gets its own PV (unique name + volumeHandle) pinned by
|
||||
# claimRef.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: arrstack-media-movies
|
||||
spec:
|
||||
capacity:
|
||||
storage: 1Ti
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: ""
|
||||
volumeMode: Filesystem
|
||||
claimRef:
|
||||
namespace: arrstack
|
||||
name: media-movies
|
||||
csi:
|
||||
driver: cephfs.csi.ceph.com
|
||||
volumeHandle: arrstack-media-movies-static
|
||||
nodeStageSecretRef:
|
||||
name: csi-cephfs-secret
|
||||
namespace: csi-cephfs
|
||||
volumeAttributes:
|
||||
staticVolume: "true"
|
||||
clusterID: cephfs_csi_ssd_ec_4_1
|
||||
fsName: cephfs
|
||||
rootPath: /volumes/csi_ssd_ec_4_1/media-movies/e95d8ace-c736-465a-acc3-0c3e46dcede9
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
# Static PV for the shared TV CephFS subvolume. Same rootPath as jellyfin's TV
|
||||
# PV so sonarr/nzbget write and jellyfin reads the identical library tree; each
|
||||
# namespace gets its own PV (unique name + volumeHandle) pinned by claimRef.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: arrstack-media-tv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 1Ti
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
storageClassName: ""
|
||||
volumeMode: Filesystem
|
||||
claimRef:
|
||||
namespace: arrstack
|
||||
name: media-tv
|
||||
csi:
|
||||
driver: cephfs.csi.ceph.com
|
||||
volumeHandle: arrstack-media-tv-static
|
||||
nodeStageSecretRef:
|
||||
name: csi-cephfs-secret
|
||||
namespace: csi-cephfs
|
||||
volumeAttributes:
|
||||
staticVolume: "true"
|
||||
clusterID: cephfs_csi_ssd_ec_4_1
|
||||
fsName: cephfs
|
||||
rootPath: /volumes/csi_ssd_ec_4_1/media-tv/4692957d-f5df-4f72-b9c9-56e4ee6d1333
|
||||
@@ -1,22 +0,0 @@
|
||||
---
|
||||
# Movies library + downloads, shared RWX across radarr and nzbget. Statically
|
||||
# bound to the arrstack-media-movies PV (same CephFS subvolume jellyfin mounts
|
||||
# read-only). storageClassName "" + volumeName disables dynamic provisioning and
|
||||
# binds the pre-created static PV. Downloads and library live on one filesystem
|
||||
# so import is an atomic hardlink move.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: media-movies
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
k8up.io/backup: "false"
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Ti
|
||||
storageClassName: ""
|
||||
volumeName: arrstack-media-movies
|
||||
volumeMode: Filesystem
|
||||
@@ -1,22 +0,0 @@
|
||||
---
|
||||
# TV library + downloads, shared RWX across sonarr and nzbget. Statically bound
|
||||
# to the arrstack-media-tv PV (same CephFS subvolume jellyfin mounts read-only).
|
||||
# storageClassName "" + volumeName disables dynamic provisioning and binds the
|
||||
# pre-created static PV. Downloads and library live on one filesystem so import
|
||||
# is an atomic hardlink move.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: media-tv
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
k8up.io/backup: "false"
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Ti
|
||||
storageClassName: ""
|
||||
volumeName: arrstack-media-tv
|
||||
volumeMode: Filesystem
|
||||
@@ -1,120 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: radarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
# RWO config PVC + single stateful SQLite DB: never run two pods at once.
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: radarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: radarr
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Enforce the Vault-sourced API key in /config/config.xml before the app
|
||||
# starts. Vault is source of truth (override bootstrap): the key is minted
|
||||
# in Vault, synced by VSO into the radarr-apikey Secret, and written here.
|
||||
# Runs as root to fix ownership; touches only the <ApiKey> element.
|
||||
- name: apikey-init
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
env:
|
||||
- name: API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-apikey
|
||||
key: apitoken
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
case "$API_KEY" in
|
||||
"" | *[!0-9a-fA-F]*)
|
||||
echo "apikey-init: API_KEY missing or not hex; refusing" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
CFG=/config/config.xml
|
||||
if [ ! -f "$CFG" ]; then
|
||||
printf '<Config>\n <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
|
||||
elif grep -q '<ApiKey>' "$CFG"; then
|
||||
sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
|
||||
else
|
||||
sed -i "s|<Config>|<Config>\n <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
|
||||
fi
|
||||
chown 1000:1000 "$CFG"
|
||||
chmod 600 "$CFG"
|
||||
echo "apikey-init: <ApiKey> enforced from Vault"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
containers:
|
||||
- name: radarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/radarr:6.3.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 7878
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: Australia/Sydney
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media-movies
|
||||
mountPath: /media/movies
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: radarr-config
|
||||
- name: media-movies
|
||||
persistentVolumeClaim:
|
||||
claimName: media-movies
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: radarr.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: radarr.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: radarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: radarr.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: radarr.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: radarr-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: radarr-http-redirect
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- radarr.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: radarr
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: radarr-route
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- radarr.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: radarr
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: radarr
|
||||
port: 7878
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- pvc-config.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
# Radarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
|
||||
# does not tolerate CephFS locking. Retain: this is state.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: radarr-config
|
||||
namespace: arrstack
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: cephrbd-fast-retain
|
||||
volumeMode: Filesystem
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: radarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 7878
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: radarr
|
||||
type: ClusterIP
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
# radarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/radarr
|
||||
# (key: apitoken); the default k8s role's templated policy already grants read
|
||||
# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the radarr-apikey Secret that the apikey-init initContainer reads
|
||||
# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: radarr-apikey
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: radarr-apikey
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/radarr
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,123 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sonarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
# RWO config PVC + single stateful SQLite DB: never run two pods at once.
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sonarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sonarr
|
||||
spec:
|
||||
securityContext:
|
||||
# LinuxServer images init as root via s6 then step down to PUID/PGID.
|
||||
# fsGroup makes the shared CephFS group-writable for that user;
|
||||
# OnRootMismatch avoids a recursive chown of the whole media tree.
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Enforce the Vault-sourced API key in /config/config.xml before the app
|
||||
# starts. Vault is source of truth (override bootstrap): the key is minted
|
||||
# in Vault, synced by VSO into the sonarr-apikey Secret, and written here.
|
||||
# Runs as root to fix ownership; touches only the <ApiKey> element.
|
||||
- name: apikey-init
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/busybox:1.37.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
env:
|
||||
- name: API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: sonarr-apikey
|
||||
key: apitoken
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
set -eu
|
||||
case "$API_KEY" in
|
||||
"" | *[!0-9a-fA-F]*)
|
||||
echo "apikey-init: API_KEY missing or not hex; refusing" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
CFG=/config/config.xml
|
||||
if [ ! -f "$CFG" ]; then
|
||||
printf '<Config>\n <ApiKey>%s</ApiKey>\n</Config>\n' "$API_KEY" > "$CFG"
|
||||
elif grep -q '<ApiKey>' "$CFG"; then
|
||||
sed -i "s|<ApiKey>[^<]*</ApiKey>|<ApiKey>${API_KEY}</ApiKey>|" "$CFG"
|
||||
else
|
||||
sed -i "s|<Config>|<Config>\n <ApiKey>${API_KEY}</ApiKey>|" "$CFG"
|
||||
fi
|
||||
chown 1000:1000 "$CFG"
|
||||
chmod 600 "$CFG"
|
||||
echo "apikey-init: <ApiKey> enforced from Vault"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 64Mi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
containers:
|
||||
- name: sonarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/linuxserver/sonarr:4.0.19
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8989
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: Australia/Sydney
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media-tv
|
||||
mountPath: /media/tv
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: sonarr-config
|
||||
- name: media-tv
|
||||
persistentVolumeClaim:
|
||||
claimName: media-tv
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: sonarr.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: sonarr.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: sonarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: sonarr.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: sonarr.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: sonarr-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: sonarr-http-redirect
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- sonarr.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: sonarr
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: sonarr-route
|
||||
namespace: arrstack
|
||||
spec:
|
||||
hostnames:
|
||||
- sonarr.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: sonarr
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: sonarr
|
||||
port: 8989
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- pvc-config.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
# Sonarr config + SQLite DB. RWO on cephrbd (block) — the arr apps' SQLite
|
||||
# does not tolerate CephFS locking. Retain: this is state.
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: sonarr-config
|
||||
namespace: arrstack
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: cephrbd-fast-retain
|
||||
volumeMode: Filesystem
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sonarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8989
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: sonarr
|
||||
type: ClusterIP
|
||||
@@ -1,25 +0,0 @@
|
||||
---
|
||||
# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
|
||||
# (key: apitoken); the default k8s role's templated policy already grants read
|
||||
# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
|
||||
# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: sonarr-apikey
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: sonarr-apikey
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/sonarr
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,20 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
allowedNamespaces:
|
||||
- arrstack
|
||||
kubernetes:
|
||||
audiences:
|
||||
- vault
|
||||
role: default
|
||||
serviceAccount: default
|
||||
tokenExpirationSeconds: 600
|
||||
method: kubernetes
|
||||
mount: k8s/au/syd1
|
||||
vaultConnectionRef: vso-system/default
|
||||
@@ -1,92 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: api
|
||||
namespace: artifactapi
|
||||
annotations:
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
secret.reloader.stakater.com/reload: "vault-ca-cert"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: api
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: api
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
initContainers:
|
||||
- name: combine-certs
|
||||
image: alpine:3
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
|
||||
volumeMounts:
|
||||
- name: vault-ca-cert
|
||||
mountPath: /custom-ca
|
||||
readOnly: true
|
||||
- name: combined-certs
|
||||
mountPath: /combined-certs
|
||||
containers:
|
||||
- name: api
|
||||
image: git.unkin.net/unkin/artifactapi:v3.11.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: api-env
|
||||
optional: false
|
||||
- secretRef:
|
||||
name: environment
|
||||
optional: false
|
||||
volumeMounts:
|
||||
- name: combined-certs
|
||||
mountPath: /etc/ssl/combined
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
volumes:
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: combined-certs
|
||||
emptyDir: {}
|
||||
restartPolicy: Always
|
||||
@@ -0,0 +1,92 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: artifactapi-deployment
|
||||
namespace: artifactapi
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: artifactapi
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: artifactapi
|
||||
image: git.unkin.net/unkin/artifactapi:v2.7.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: artifactapi-env
|
||||
optional: false
|
||||
- secretRef:
|
||||
name: environment
|
||||
optional: false
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /health
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/artifactapi/conf.d/config.yaml
|
||||
name: remotes-config
|
||||
subPath: config.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/local-generic.yaml
|
||||
name: remotes-config
|
||||
subPath: local-generic.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-alpine.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-docker.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-generic.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-helm.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-rpm.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
|
||||
name: remotes-config
|
||||
subPath: virtual-helm.yaml
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- configMap:
|
||||
name: remotes-config
|
||||
optional: false
|
||||
name: remotes-config
|
||||
@@ -2,13 +2,13 @@
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: api-hpa
|
||||
name: artifactapi-hpa
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: api
|
||||
name: artifactapi-deployment
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
# Ceph RGW (S3) backup target for the artifactapi CNPG cluster, provisioned by the
|
||||
# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
|
||||
# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
|
||||
# its own namespace, so backups are per-database rather than one shared bucket.
|
||||
apiVersion: ceph.unkin.net/v1alpha1
|
||||
kind: ObjectStoreUser
|
||||
metadata:
|
||||
name: cnpg-artifactapi-backup
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
displayName: "CNPG backup owner (artifactapi)"
|
||||
# RGW users are global; keep the uid namespace-qualified so it never collides.
|
||||
uid: cnpg-artifactapi-backup
|
||||
maxBuckets: 5
|
||||
# Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
|
||||
# S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
|
||||
secretName: cnpg-artifactapi-backup-s3
|
||||
# Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
|
||||
# in-flight restore can still reach the archive.
|
||||
retainOnDelete: true
|
||||
---
|
||||
apiVersion: ceph.unkin.net/v1alpha1
|
||||
kind: Bucket
|
||||
metadata:
|
||||
name: cnpg-artifactapi
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
placementTarget: ec
|
||||
bucketName: cnpg-artifactapi
|
||||
# The owner user has full control of its own bucket (read + write), which is
|
||||
# all the backup/restore identity needs — no extra BucketAccess grant.
|
||||
ownerRef: cnpg-artifactapi-backup
|
||||
versioning: false
|
||||
tags:
|
||||
app: artifactapi
|
||||
purpose: cnpg-backup
|
||||
# Never drop the backups if the CR is removed; retire buckets by hand.
|
||||
retainOnDelete: true
|
||||
---
|
||||
# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
|
||||
# spec.backup.barmanObjectStore; this schedules the periodic full backup that
|
||||
# WAL is layered on top of. Schedules are staggered across clusters so the 8
|
||||
# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: ScheduledBackup
|
||||
metadata:
|
||||
name: cnpg-artifactapi-nightly
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
schedule: "0 40 1 * * *"
|
||||
immediate: false
|
||||
backupOwnerReference: self
|
||||
method: barmanObjectStore
|
||||
cluster:
|
||||
name: postgres
|
||||
@@ -1,120 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: postgres
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinityType: preferred
|
||||
backup:
|
||||
# 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
|
||||
# against the object store on each successful base backup.
|
||||
retentionPolicy: 30d
|
||||
barmanObjectStore:
|
||||
# Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
|
||||
destinationPath: s3://cnpg-artifactapi
|
||||
endpointURL: https://s3.ceph.unkin.net
|
||||
# radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
|
||||
# every namespace as the vault-ca-cert Secret).
|
||||
endpointCA:
|
||||
name: vault-ca-cert
|
||||
key: ca.crt
|
||||
# Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
|
||||
s3Credentials:
|
||||
accessKeyId:
|
||||
name: cnpg-artifactapi-backup-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
secretAccessKey:
|
||||
name: cnpg-artifactapi-backup-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
# Path prefix within the bucket; keep stable across restores (see docs).
|
||||
serverName: artifactapi
|
||||
data:
|
||||
compression: bzip2
|
||||
jobs: 2
|
||||
wal:
|
||||
compression: zstd
|
||||
maxParallel: 2
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: artifacts
|
||||
encoding: UTF8
|
||||
localeCType: C
|
||||
localeCollate: C
|
||||
owner: artifacts
|
||||
secret:
|
||||
name: postgres-credentials
|
||||
enablePDB: true
|
||||
enableSuperuserAccess: false
|
||||
failoverDelay: 0
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
|
||||
instances: 3
|
||||
logLevel: info
|
||||
maxSyncReplicas: 0
|
||||
minSyncReplicas: 0
|
||||
monitoring:
|
||||
customQueriesConfigMap:
|
||||
- key: queries
|
||||
name: cnpg-default-monitoring
|
||||
disableDefaultQueries: false
|
||||
enablePodMonitor: false
|
||||
postgresql:
|
||||
parameters:
|
||||
archive_mode: "on"
|
||||
archive_timeout: 5min
|
||||
dynamic_shared_memory_type: posix
|
||||
effective_cache_size: 256MB
|
||||
full_page_writes: "on"
|
||||
log_destination: csvlog
|
||||
log_directory: /controller/log
|
||||
log_filename: postgres
|
||||
log_rotation_age: "0"
|
||||
log_rotation_size: "0"
|
||||
log_truncate_on_rotation: "false"
|
||||
logging_collector: "on"
|
||||
max_connections: "200"
|
||||
max_parallel_workers: "16"
|
||||
max_replication_slots: "16"
|
||||
max_worker_processes: "16"
|
||||
shared_buffers: 128MB
|
||||
shared_memory_type: mmap
|
||||
ssl_max_protocol_version: TLSv1.3
|
||||
ssl_min_protocol_version: TLSv1.3
|
||||
wal_keep_size: 256MB
|
||||
wal_level: logical
|
||||
wal_log_hints: "on"
|
||||
wal_receiver_timeout: 5s
|
||||
wal_sender_timeout: 5s
|
||||
syncReplicaElectionConstraint:
|
||||
enabled: false
|
||||
primaryUpdateMethod: restart
|
||||
primaryUpdateStrategy: unsupervised
|
||||
probes:
|
||||
liveness:
|
||||
isolationCheck:
|
||||
connectionTimeout: 1000
|
||||
enabled: true
|
||||
requestTimeout: 1000
|
||||
replicationSlots:
|
||||
highAvailability:
|
||||
enabled: true
|
||||
slotPrefix: _cnpg_
|
||||
synchronizeReplicas:
|
||||
enabled: true
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
smartShutdownTimeout: 180
|
||||
startDelay: 3600
|
||||
stopDelay: 1800
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 20Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
switchoverDelay: 3600
|
||||
@@ -1,33 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Pooler
|
||||
metadata:
|
||||
name: postgres-pooler
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
cluster:
|
||||
name: postgres
|
||||
instances: 2
|
||||
pgbouncer:
|
||||
parameters:
|
||||
default_pool_size: "100"
|
||||
max_client_conn: "400"
|
||||
paused: false
|
||||
poolMode: session
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pooler
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- pooler
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: rw
|
||||
@@ -2,15 +2,26 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: api-env
|
||||
name: artifactapi-env
|
||||
namespace: artifactapi
|
||||
data:
|
||||
DBHOST: postgres-pooler
|
||||
CONFIG_PATH: /etc/artifactapi/conf.d/
|
||||
DBHOST: postgres-service
|
||||
DBNAME: artifacts
|
||||
DBPORT: "5432"
|
||||
DBUSER: artifacts
|
||||
MINIO_BUCKET: artifactapi-prod-k8s-syd1-au
|
||||
MINIO_BUCKET: artifactapi
|
||||
MINIO_ENDPOINT: radosgw.service.consul
|
||||
MINIO_SECURE: "true"
|
||||
REDIS_URL: redis://redis:6379
|
||||
SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt
|
||||
REDIS_URL: redis://redis-service:6379
|
||||
REQUESTS_CA_BUNDLE: /etc/pki/tls/certs/ca-bundle.crt
|
||||
SSL_CERT_FILE: /etc/pki/tls/certs/ca-bundle.crt
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: postgres-env
|
||||
namespace: artifactapi
|
||||
data:
|
||||
POSTGRES_DB: artifacts
|
||||
POSTGRES_USER: artifacts
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: artifactapi
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: artifactapi-tls
|
||||
mode: Terminate
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: api-route
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
# Early-boot clients (anaconda/kickstart, yum in %post, PXE) need plain HTTP
|
||||
# for the rpm repos; serve the app directly on port 80 instead of redirecting.
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
sectionName: http
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /ui
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: artifactapi
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 10g
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
name: artifactapi-ingress
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: artifactapi.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: artifactapi-api
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
secretName: artifactapi-tls
|
||||
@@ -3,19 +3,28 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- api-deployment.yaml
|
||||
- api-hpa.yaml
|
||||
- artifactapi-deployment.yaml
|
||||
- artifactapi-hpa.yaml
|
||||
- configmap.yaml
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_backup.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
- namespace.yaml
|
||||
- postgres-deployment.yaml
|
||||
- pvc.yaml
|
||||
- redis-deployment.yaml
|
||||
- services.yaml
|
||||
- ui-deployment.yaml
|
||||
- ui-hpa.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- vpa.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: remotes-config
|
||||
files:
|
||||
- resources/conf.d/config.yaml
|
||||
- resources/conf.d/local-generic.yaml
|
||||
- resources/conf.d/remote-generic.yaml
|
||||
- resources/conf.d/remote-alpine.yaml
|
||||
- resources/conf.d/remote-rpm.yaml
|
||||
- resources/conf.d/remote-docker.yaml
|
||||
- resources/conf.d/remote-helm.yaml
|
||||
- resources/conf.d/virtual-helm.yaml
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: postgres-deployment
|
||||
namespace: artifactapi
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: postgres
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres:15-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: postgres-env
|
||||
optional: false
|
||||
- secretRef:
|
||||
name: postgres-password
|
||||
optional: false
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- artifacts
|
||||
- -d
|
||||
- artifacts
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- artifacts
|
||||
- -d
|
||||
- artifacts
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
mountPropagation: None
|
||||
name: pgdata
|
||||
subPath: pgdata
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: pgdata
|
||||
persistentVolumeClaim:
|
||||
claimName: artifactapi-postgres-pgdata
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: artifactapi-postgres-pgdata
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
storageClassName: cephrbd-fast-delete
|
||||
volumeMode: Filesystem
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: artifactapi-redis-data
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: cephrbd-fast-delete
|
||||
volumeMode: Filesystem
|
||||
@@ -2,21 +2,23 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
annotations:
|
||||
deployment.kubernetes.io/revision: "1"
|
||||
name: redis-deployment
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:7-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- redis-server
|
||||
- --save
|
||||
@@ -26,13 +28,6 @@ spec:
|
||||
- containerPort: 6379
|
||||
name: redis
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
@@ -53,4 +48,19 @@ spec:
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
mountPropagation: None
|
||||
name: data
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: artifactapi-redis-data
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# Global artifactapi configuration.
|
||||
# S3, Redis, and database connection settings are injected via environment variables.
|
||||
# Add any top-level overrides here if needed.
|
||||
@@ -0,0 +1,7 @@
|
||||
locals:
|
||||
local-generic:
|
||||
package: "generic"
|
||||
description: "Local generic file repository"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 0
|
||||
@@ -0,0 +1,10 @@
|
||||
remotes:
|
||||
alpine:
|
||||
base_url: "https://dl-cdn.alpinelinux.org"
|
||||
package: "alpine"
|
||||
description: "Alpine Linux APK package repository"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.apk$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
@@ -0,0 +1,96 @@
|
||||
remotes:
|
||||
ghcr:
|
||||
base_url: "https://ghcr.io"
|
||||
package: "docker"
|
||||
description: "GitHub Container Registry"
|
||||
immutable_patterns:
|
||||
- "^cloudnative-pg/cloudnative-pg"
|
||||
- "^emberstack/helm-charts"
|
||||
- "^openvoxproject/"
|
||||
- "^stakater/reloader"
|
||||
- "^voxpupuli/puppetboard"
|
||||
- "^woodpecker-ci/helm"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
dockerhub:
|
||||
base_url: "https://registry-1.docker.io"
|
||||
package: "docker"
|
||||
description: "Docker Hub registry"
|
||||
immutable_patterns:
|
||||
- "^library/almalinux"
|
||||
- "^library/busybox"
|
||||
- "^library/debian"
|
||||
- "^library/fedora"
|
||||
- "^library/nginx"
|
||||
- "^library/postgres"
|
||||
- "^library/redis"
|
||||
- "^beats/filebeat"
|
||||
- "^bitnami/"
|
||||
- "^curlimages/curl"
|
||||
- "^emberstack/kubernetes-reflector"
|
||||
- "^hashicorp/vault-secrets-operator"
|
||||
- "^jfrog/"
|
||||
- "^rancher/"
|
||||
- "^traefik/"
|
||||
- "^ubi9/ubi-minimal"
|
||||
- "^victoriametrics/"
|
||||
- "^woodpeckerci/"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
quay:
|
||||
base_url: "https://quay.io"
|
||||
package: "docker"
|
||||
description: "Quay.io container registry"
|
||||
immutable_patterns:
|
||||
- "^brancz/kube-rbac-proxy"
|
||||
- "^cephcsi/cephcsi"
|
||||
- "^jetstack/cert-manager-"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
k8s-registry:
|
||||
base_url: "https://registry.k8s.io"
|
||||
package: "docker"
|
||||
description: "Kubernetes container registry"
|
||||
immutable_patterns:
|
||||
- "^external-dns/external-dns"
|
||||
- "^sig-storage/"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
gitlab:
|
||||
base_url: "https://registry.gitlab.com"
|
||||
package: "docker"
|
||||
description: "GitLab container registry"
|
||||
immutable_patterns:
|
||||
- "^purelb/purelb"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
elastic:
|
||||
base_url: "https://docker.elastic.co"
|
||||
package: "docker"
|
||||
description: "Elastic container registry"
|
||||
immutable_patterns:
|
||||
- "^eck/eck-operator"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
gcr:
|
||||
base_url: "https://gcr.io"
|
||||
package: "docker"
|
||||
description: "Google Container Registry"
|
||||
immutable_patterns:
|
||||
- "^k8s-staging-nfd/charts"
|
||||
- "^k8s-staging-nfd/node-feature-discovery"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
@@ -0,0 +1,130 @@
|
||||
remotes:
|
||||
github:
|
||||
base_url: "https://github.com"
|
||||
package: "generic"
|
||||
description: "GitHub releases and files"
|
||||
mutable_patterns:
|
||||
- ".*/archive/refs/heads/.*.tar.gz$"
|
||||
immutable_patterns:
|
||||
- ".*/archive/refs/tags/.*.tar.gz$"
|
||||
- "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
|
||||
- "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
|
||||
- "apple/foundationdb/.*/libfdb_c.x86_64.so$"
|
||||
- "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
|
||||
- "coder/code-server/.*/code-server-.*-amd64.rpm$"
|
||||
- "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
|
||||
- "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
|
||||
- "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
|
||||
- "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
|
||||
- "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
|
||||
- "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
|
||||
- "hadolint/hadolint/.*/hadolint-linux-x86_64$"
|
||||
- "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
|
||||
- "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
|
||||
- "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
|
||||
- "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
|
||||
- "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
|
||||
- "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
|
||||
- "lxc/incus/.*.tar.gz$"
|
||||
- "mikefarah/yq/.*/yq_linux_amd64$"
|
||||
- "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
|
||||
- "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
|
||||
- "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
|
||||
- "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
|
||||
- "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
|
||||
- "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
|
||||
- "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
|
||||
- "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
|
||||
- "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
github_user:
|
||||
base_url: "https://raw.githubusercontent.com"
|
||||
package: "generic"
|
||||
description: "GitHub User Content"
|
||||
immutable_patterns:
|
||||
- "argoproj/argo-cd/.*.yaml$"
|
||||
- "yannh/kubernetes-json-schema/master/.*.json$"
|
||||
- "datreeio/CRDs-catalog/main/.*.json$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
gitea-dl:
|
||||
base_url: "https://dl.gitea.com"
|
||||
package: "generic"
|
||||
description: "Gitea download site"
|
||||
immutable_patterns:
|
||||
- "act_runner/.*/act_runner-.*-linux-amd64$"
|
||||
- "tea/.*/tea-.*-linux-amd64$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
hashicorp-releases:
|
||||
base_url: "https://releases.hashicorp.com"
|
||||
package: "generic"
|
||||
description: "HashiCorp product releases"
|
||||
immutable_patterns:
|
||||
- "terraform/.*terraform_.*_linux_amd64\\.zip$"
|
||||
- "terraform/.*terraform_.*_windows_amd64\\.zip$"
|
||||
- "terraform/.*terraform_.*_darwin_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_linux_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_windows_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_darwin_amd64\\.zip$"
|
||||
- "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
|
||||
- "consul/.*/consul_.*_linux_amd64\\.zip$"
|
||||
- "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
|
||||
- "nomad/.*/nomad_.*_linux_amd64\\.zip$"
|
||||
- "packer/.*/packer_.*_linux_amd64\\.zip$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
rarlab:
|
||||
base_url: "https://www.rarlab.com"
|
||||
package: "generic"
|
||||
description: "RARLab"
|
||||
immutable_patterns:
|
||||
- "rar/rarlinux-x64-.*.tar.gz"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
claude-ai:
|
||||
base_url: "https://downloads.claude.ai"
|
||||
package: "generic"
|
||||
description: "Anthropic Claude Code binary releases"
|
||||
mutable_patterns:
|
||||
- "claude-code-releases/.*/manifest.json$"
|
||||
immutable_patterns:
|
||||
- "claude-code-releases/.*/linux-x64/claude$"
|
||||
- "claude-code-releases/.*/linux-arm64/claude$"
|
||||
- "claude-code-releases/.*/linux-x64-musl/claude$"
|
||||
- "claude-code-releases/.*/linux-arm64-musl/claude$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
@@ -0,0 +1,143 @@
|
||||
remotes:
|
||||
ceph-csi:
|
||||
base_url: "https://ceph.github.io/csi-charts"
|
||||
package: "helm"
|
||||
description: "Ceph CSI driver Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
cnpg:
|
||||
base_url: "https://cloudnative-pg.github.io/charts"
|
||||
package: "helm"
|
||||
description: "CloudNativePG operator Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
elastic-helm:
|
||||
base_url: "https://helm.elastic.co"
|
||||
package: "helm"
|
||||
description: "Elastic stack Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
external-dns:
|
||||
base_url: "https://kubernetes-sigs.github.io/external-dns/"
|
||||
package: "helm"
|
||||
description: "ExternalDNS Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
hashicorp-helm:
|
||||
base_url: "https://helm.releases.hashicorp.com"
|
||||
package: "helm"
|
||||
description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
intel-helm:
|
||||
base_url: "https://intel.github.io/helm-charts/"
|
||||
package: "helm"
|
||||
description: "Intel Helm charts (device plugins)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
jetstack:
|
||||
base_url: "https://charts.jetstack.io"
|
||||
package: "helm"
|
||||
description: "Jetstack Helm charts (cert-manager)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
purelb:
|
||||
base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
|
||||
package: "helm"
|
||||
description: "PureLB load balancer Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
rancher-stable:
|
||||
base_url: "https://releases.rancher.com/server-charts/stable"
|
||||
package: "helm"
|
||||
description: "Rancher stable Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
stakater:
|
||||
base_url: "https://stakater.github.io/stakater-charts"
|
||||
package: "helm"
|
||||
description: "Stakater Helm charts (Reloader)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
traefik:
|
||||
base_url: "https://traefik.github.io/charts"
|
||||
package: "helm"
|
||||
description: "Traefik Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
victoriametrics:
|
||||
base_url: "https://victoriametrics.github.io/helm-charts/"
|
||||
package: "helm"
|
||||
description: "VictoriaMetrics observability Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
argo-helm:
|
||||
base_url: "https://argoproj.github.io/argo-helm"
|
||||
package: "helm"
|
||||
description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
@@ -0,0 +1,154 @@
|
||||
remotes:
|
||||
almalinux:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/almalinux"
|
||||
package: "rpm"
|
||||
description: "AlmaLinux RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.sqlite.*$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/repodata/.*\\.yaml.*$"
|
||||
- ".*/install.img"
|
||||
- ".*/squashfs.img"
|
||||
- ".*/updates.img"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
ceph-reef:
|
||||
base_url: "https://download.ceph.com/rpm-reef/"
|
||||
package: "rpm"
|
||||
description: "Ceph Reef 18"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
ceph-squid:
|
||||
base_url: "https://download.ceph.com/rpm-squid/"
|
||||
package: "rpm"
|
||||
description: "Ceph Squid 19"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
ceph-tentacle:
|
||||
base_url: "https://download.ceph.com/rpm-tentacle/"
|
||||
package: "rpm"
|
||||
description: "Ceph Tentacle 20"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
epel:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/epel"
|
||||
package: "rpm"
|
||||
description: "EPEL (Extra Packages for Enterprise Linux)"
|
||||
immutable_patterns:
|
||||
- ".*/Everything/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.sqlite.*$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/repodata/.*\\.yaml.*$"
|
||||
- "RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
fedora:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
|
||||
package: "rpm"
|
||||
description: "Fedora Linux RPM package repository"
|
||||
immutable_patterns:
|
||||
- "releases/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- "updates/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- "development/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
frr:
|
||||
base_url: "https://rpm.frrouting.org/repo"
|
||||
package: "rpm"
|
||||
description: "FRR RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
mariadb:
|
||||
base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
|
||||
package: "rpm"
|
||||
description: "MariaDB RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
openvox:
|
||||
base_url: "https://yum.voxpupuli.org"
|
||||
package: "rpm"
|
||||
description: "OpenVox RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- "GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
postgresql:
|
||||
base_url: "https://download.postgresql.org/pub/repos/yum"
|
||||
package: "rpm"
|
||||
description: "PostgreSQL RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
- ".*/PGDG-RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
rke2:
|
||||
base_url: "https://rpm.rancher.io"
|
||||
package: "rpm"
|
||||
description: "RKE2 RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- "public.key$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
zfs:
|
||||
base_url: "http://download.zfsonlinux.org"
|
||||
package: "rpm"
|
||||
description: "ZFS RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
@@ -0,0 +1,18 @@
|
||||
virtuals:
|
||||
helm:
|
||||
package: "helm"
|
||||
description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
|
||||
members:
|
||||
- ceph-csi
|
||||
- cnpg
|
||||
- elastic-helm
|
||||
- external-dns
|
||||
- hashicorp-helm
|
||||
- intel-helm
|
||||
- jetstack
|
||||
- purelb
|
||||
- rancher-stable
|
||||
- stakater
|
||||
- traefik
|
||||
- victoriametrics
|
||||
- argo-helm
|
||||
@@ -2,7 +2,7 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: artifactapi
|
||||
name: artifactapi-api
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
@@ -12,31 +12,31 @@ spec:
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: api
|
||||
app: artifactapi
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ui
|
||||
name: postgres-service
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
- name: postgres
|
||||
port: 5432
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
targetPort: postgres
|
||||
selector:
|
||||
app: ui
|
||||
app: postgres
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
name: redis-service
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
|
||||
@@ -1,58 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ui
|
||||
namespace: artifactapi
|
||||
annotations:
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ui
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ui
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: ui
|
||||
image: git.unkin.net/unkin/artifactapi-ui:v3.11.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /ui
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /ui
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
restartPolicy: Always
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: ui-hpa
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: ui
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 60
|
||||
behavior:
|
||||
scaleUp:
|
||||
stabilizationWindowSeconds: 0
|
||||
selectPolicy: Max
|
||||
policies:
|
||||
- type: Percent
|
||||
value: 100
|
||||
periodSeconds: 30
|
||||
- type: Pods
|
||||
value: 4
|
||||
periodSeconds: 30
|
||||
scaleDown:
|
||||
stabilizationWindowSeconds: 300
|
||||
selectPolicy: Min
|
||||
policies:
|
||||
- type: Percent
|
||||
value: 10
|
||||
periodSeconds: 60
|
||||
- type: Pods
|
||||
value: 2
|
||||
periodSeconds: 60
|
||||
@@ -10,7 +10,7 @@ spec:
|
||||
kubernetes:
|
||||
audiences:
|
||||
- vault
|
||||
role: default
|
||||
role: artifactapi
|
||||
serviceAccount: default
|
||||
tokenExpirationSeconds: 600
|
||||
method: kubernetes
|
||||
|
||||
@@ -1,23 +1,6 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: postgres-credentials
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: postgres-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/artifactapi/default/postgres-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: environment
|
||||
namespace: artifactapi
|
||||
@@ -25,10 +8,27 @@ spec:
|
||||
destination:
|
||||
create: true
|
||||
name: environment
|
||||
overwrite: true
|
||||
overwrite: false
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/artifactapi/default/environment
|
||||
path: service/artifactapi/environment
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: postgres-password
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: postgres-password
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: service/artifactapi/postgres-password
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
---
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: api-vpa
|
||||
namespace: artifactapi
|
||||
# NOTE: this workload also has an HPA. updateMode Off is recommendation-only
|
||||
# and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
|
||||
# Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
|
||||
spec:
|
||||
targetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: api
|
||||
updatePolicy:
|
||||
updateMode: "Off"
|
||||
---
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: redis-vpa
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
targetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: redis
|
||||
updatePolicy:
|
||||
updateMode: "Off"
|
||||
---
|
||||
apiVersion: autoscaling.k8s.io/v1
|
||||
kind: VerticalPodAutoscaler
|
||||
metadata:
|
||||
name: ui-vpa
|
||||
namespace: artifactapi
|
||||
# NOTE: this workload also has an HPA. updateMode Off is recommendation-only
|
||||
# and does not act, so there is no HPA/VPA conflict today. Do not flip to Auto/
|
||||
# Initial without first moving the HPA off CPU/memory (VPA owns those under Auto).
|
||||
spec:
|
||||
targetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: ui
|
||||
updatePolicy:
|
||||
updateMode: "Off"
|
||||
@@ -1,56 +0,0 @@
|
||||
---
|
||||
# Ceph RGW (S3) backup target for the authentik CNPG cluster, provisioned by the
|
||||
# in-estate cephrgw-operator. One dedicated bucket + owner user per cluster:
|
||||
# cephrgw CRs are namespace-scoped and CNPG reads its S3 credential Secret from
|
||||
# its own namespace, so backups are per-database rather than one shared bucket.
|
||||
apiVersion: ceph.unkin.net/v1alpha1
|
||||
kind: ObjectStoreUser
|
||||
metadata:
|
||||
name: cnpg-authentik-backup
|
||||
namespace: authentik
|
||||
spec:
|
||||
displayName: "CNPG backup owner (authentik)"
|
||||
# RGW users are global; keep the uid namespace-qualified so it never collides.
|
||||
uid: cnpg-authentik-backup
|
||||
maxBuckets: 5
|
||||
# Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ RGW_UID,
|
||||
# S3_ENDPOINT) into this Secret; the Cluster's barmanObjectStore consumes it.
|
||||
secretName: cnpg-authentik-backup-s3
|
||||
# Keep the RGW user (and thus the keys) if this CR is ever deleted, so an
|
||||
# in-flight restore can still reach the archive.
|
||||
retainOnDelete: true
|
||||
---
|
||||
apiVersion: ceph.unkin.net/v1alpha1
|
||||
kind: Bucket
|
||||
metadata:
|
||||
name: cnpg-authentik
|
||||
namespace: authentik
|
||||
spec:
|
||||
placementTarget: ec
|
||||
bucketName: cnpg-authentik
|
||||
# The owner user has full control of its own bucket (read + write), which is
|
||||
# all the backup/restore identity needs — no extra BucketAccess grant.
|
||||
ownerRef: cnpg-authentik-backup
|
||||
versioning: false
|
||||
tags:
|
||||
app: authentik
|
||||
purpose: cnpg-backup
|
||||
# Never drop the backups if the CR is removed; retire buckets by hand.
|
||||
retainOnDelete: true
|
||||
---
|
||||
# Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
|
||||
# spec.backup.barmanObjectStore; this schedules the periodic full backup that
|
||||
# WAL is layered on top of. Schedules are staggered across clusters so the 8
|
||||
# base backups do not hit RGW at once (CNPG cron is 6-field, seconds first).
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: ScheduledBackup
|
||||
metadata:
|
||||
name: cnpg-authentik-nightly
|
||||
namespace: authentik
|
||||
spec:
|
||||
schedule: "0 0 1 * * *"
|
||||
immediate: false
|
||||
backupOwnerReference: self
|
||||
method: barmanObjectStore
|
||||
cluster:
|
||||
name: postgres
|
||||
@@ -1,122 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: postgres
|
||||
namespace: authentik
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinityType: preferred
|
||||
backup:
|
||||
# 30-day retention (DEFAULT — adjust per cluster if needed). Enforced by CNPG
|
||||
# against the object store on each successful base backup.
|
||||
retentionPolicy: 30d
|
||||
barmanObjectStore:
|
||||
# Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
|
||||
destinationPath: s3://cnpg-authentik
|
||||
endpointURL: https://s3.ceph.unkin.net
|
||||
# radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
|
||||
# every namespace as the vault-ca-cert Secret).
|
||||
endpointCA:
|
||||
name: vault-ca-cert
|
||||
key: ca.crt
|
||||
# Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
|
||||
s3Credentials:
|
||||
accessKeyId:
|
||||
name: cnpg-authentik-backup-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
secretAccessKey:
|
||||
name: cnpg-authentik-backup-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
# Path prefix within the bucket; keep stable across restores (see docs).
|
||||
serverName: authentik
|
||||
data:
|
||||
compression: bzip2
|
||||
jobs: 2
|
||||
wal:
|
||||
compression: zstd
|
||||
maxParallel: 2
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: authentik
|
||||
encoding: UTF8
|
||||
localeCType: C
|
||||
localeCollate: C
|
||||
owner: authentik
|
||||
secret:
|
||||
name: postgres-credentials
|
||||
enablePDB: true
|
||||
enableSuperuserAccess: false
|
||||
failoverDelay: 0
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
|
||||
instances: 3
|
||||
logLevel: info
|
||||
maxSyncReplicas: 0
|
||||
minSyncReplicas: 0
|
||||
monitoring:
|
||||
customQueriesConfigMap:
|
||||
- key: queries
|
||||
name: cnpg-default-monitoring
|
||||
disableDefaultQueries: false
|
||||
enablePodMonitor: false
|
||||
postgresql:
|
||||
parameters:
|
||||
archive_mode: "on"
|
||||
archive_timeout: 5min
|
||||
dynamic_shared_memory_type: posix
|
||||
effective_cache_size: 256MB
|
||||
full_page_writes: "on"
|
||||
log_destination: csvlog
|
||||
log_directory: /controller/log
|
||||
log_filename: postgres
|
||||
log_rotation_age: "0"
|
||||
log_rotation_size: "0"
|
||||
log_truncate_on_rotation: "false"
|
||||
logging_collector: "on"
|
||||
max_connections: "200"
|
||||
max_parallel_workers: "16"
|
||||
max_replication_slots: "16"
|
||||
max_worker_processes: "16"
|
||||
shared_buffers: 128MB
|
||||
shared_memory_type: mmap
|
||||
ssl_max_protocol_version: TLSv1.3
|
||||
ssl_min_protocol_version: TLSv1.3
|
||||
wal_keep_size: 256MB
|
||||
wal_level: logical
|
||||
wal_log_hints: "on"
|
||||
wal_receiver_timeout: 5s
|
||||
wal_sender_timeout: 5s
|
||||
syncReplicaElectionConstraint:
|
||||
enabled: false
|
||||
primaryUpdateMethod: restart
|
||||
primaryUpdateStrategy: unsupervised
|
||||
probes:
|
||||
liveness:
|
||||
isolationCheck:
|
||||
connectionTimeout: 1000
|
||||
enabled: true
|
||||
requestTimeout: 1000
|
||||
replicationSlots:
|
||||
highAvailability:
|
||||
enabled: true
|
||||
slotPrefix: _cnpg_
|
||||
synchronizeReplicas:
|
||||
enabled: true
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
# 512Mi OOMKilled replicas under load (shared_buffers 128MB +
|
||||
# max_connections 200 leave no headroom) — see incident 2026-07-28.
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 512Mi
|
||||
smartShutdownTimeout: 180
|
||||
startDelay: 3600
|
||||
stopDelay: 1800
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 20Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
switchoverDelay: 3600
|
||||
@@ -1,66 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Pooler
|
||||
metadata:
|
||||
name: postgres-pooler-rw
|
||||
namespace: authentik
|
||||
spec:
|
||||
cluster:
|
||||
name: postgres
|
||||
instances: 2
|
||||
pgbouncer:
|
||||
parameters:
|
||||
default_pool_size: "100"
|
||||
max_client_conn: "400"
|
||||
paused: false
|
||||
poolMode: session
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pooler-rw
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- pooler-rw
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: rw
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Pooler
|
||||
metadata:
|
||||
name: postgres-pooler-ro
|
||||
namespace: authentik
|
||||
spec:
|
||||
cluster:
|
||||
name: postgres
|
||||
instances: 2
|
||||
pgbouncer:
|
||||
parameters:
|
||||
default_pool_size: "100"
|
||||
max_client_conn: "400"
|
||||
paused: false
|
||||
poolMode: session
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pooler-ro
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- pooler-ro
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: ro
|
||||
@@ -1,57 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: identity.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: identity.unkin.net,identity.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: authentik
|
||||
namespace: authentik
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: identity.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: identity.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: authentik-tls
|
||||
mode: Terminate
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: identity.k8s.syd1.au.unkin.net
|
||||
name: http-internal
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: identity.k8s.syd1.au.unkin.net
|
||||
name: https-internal
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: authentik-tls
|
||||
mode: Terminate
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: authentik-http-redirect
|
||||
namespace: authentik
|
||||
spec:
|
||||
hostnames:
|
||||
- identity.unkin.net
|
||||
- identity.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik
|
||||
sectionName: http
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik
|
||||
sectionName: http-internal
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: authentik
|
||||
namespace: authentik
|
||||
spec:
|
||||
hostnames:
|
||||
- identity.unkin.net
|
||||
- identity.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik
|
||||
sectionName: https
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik
|
||||
sectionName: https-internal
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: authentik-server
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_backup.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ldap-gateway.yaml
|
||||
- ldap-httproute.yaml
|
||||
- ldap-service.yaml
|
||||
- ldap-tlsroute.yaml
|
||||
- namespace.yaml
|
||||
- redis-deployment.yaml
|
||||
- redis-pvc.yaml
|
||||
- redis-service.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- vpa.yaml
|
||||
@@ -1,47 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: ldap.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
name: authentik-ldap
|
||||
namespace: authentik
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: ldap.k8s.syd1.au.unkin.net
|
||||
name: ldaps-internal
|
||||
port: 636
|
||||
protocol: TLS
|
||||
tls:
|
||||
mode: Passthrough
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: ldap.main.unkin.net
|
||||
name: ldaps-main
|
||||
port: 636
|
||||
protocol: TLS
|
||||
tls:
|
||||
mode: Passthrough
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: ldap.k8s.syd1.au.unkin.net
|
||||
name: http-dns
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: ldap.main.unkin.net
|
||||
name: http-dns-main
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
@@ -1,32 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: authentik-ldap-dns
|
||||
namespace: authentik
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: ldap.k8s.syd1.au.unkin.net,ldap.main.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
spec:
|
||||
hostnames:
|
||||
- ldap.k8s.syd1.au.unkin.net
|
||||
- ldap.main.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik-ldap
|
||||
sectionName: http-dns
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik-ldap
|
||||
sectionName: http-dns-main
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: authentik-ldap
|
||||
namespace: authentik
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: ldaps
|
||||
port: 6636
|
||||
protocol: TCP
|
||||
targetPort: 6636
|
||||
selector:
|
||||
app.kubernetes.io/name: authentik
|
||||
app.kubernetes.io/component: ldap
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: TLSRoute
|
||||
metadata:
|
||||
name: authentik-ldaps
|
||||
namespace: authentik
|
||||
spec:
|
||||
hostnames:
|
||||
- ldap.k8s.syd1.au.unkin.net
|
||||
- ldap.main.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik-ldap
|
||||
sectionName: ldaps-internal
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: authentik-ldap
|
||||
sectionName: ldaps-main
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: authentik-ldap
|
||||
port: 6636
|
||||
weight: 1
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user