Compare commits
3 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
f03eb6f651 | ||
|
unkinben
|
296c569cc8 | ||
|
unkinben
|
c1d831176d |
@@ -1,3 +1,2 @@
|
||||
manifests/
|
||||
apps/**/charts/
|
||||
ci/crd-schemas/
|
||||
|
||||
@@ -6,7 +6,7 @@ repos:
|
||||
- id: check-executables-have-shebangs
|
||||
- id: check-json
|
||||
- id: check-added-large-files
|
||||
args: ['--maxkb=2048']
|
||||
args: ['--maxkb=500']
|
||||
- id: check-merge-conflict
|
||||
- id: check-shebang-scripts-are-executable
|
||||
- id: check-symlinks
|
||||
|
||||
@@ -2,21 +2,6 @@ when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: generate-schemas
|
||||
image: git.unkin.net/unkin/almalinux9-kubetest:20260319
|
||||
commands:
|
||||
- make generate-schemas
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
|
||||
- name: kubeconform
|
||||
image: git.unkin.net/unkin/almalinux9-kubetest:20260319
|
||||
commands:
|
||||
|
||||
@@ -11,11 +11,6 @@ kubeconform:
|
||||
@ci/validate-apps.sh && \
|
||||
ci/validate-clusters.sh
|
||||
|
||||
# Generate JSON schemas from CRD definitions for kubeconform
|
||||
# Run when CRD versions change, then commit ci/crd-schemas/
|
||||
generate-schemas:
|
||||
@ci/generate-crd-schemas.sh
|
||||
|
||||
# Clean all generated manifests
|
||||
clean:
|
||||
@rm -rf manifests/
|
||||
|
||||
+2
-2
@@ -4,5 +4,5 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
+1
-1
@@ -2,4 +2,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: traefik-system
|
||||
name: argocd-image-updater
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: argocd-image-updater
|
||||
spec:
|
||||
allowedNamespaces:
|
||||
- argocd-image-updater
|
||||
kubernetes:
|
||||
audiences:
|
||||
- vault
|
||||
role: argocd-image-updater
|
||||
serviceAccount: argocd-image-updater
|
||||
tokenExpirationSeconds: 600
|
||||
method: kubernetes
|
||||
mount: k8s/au/syd1
|
||||
vaultConnectionRef: vso-system/default
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
# Credentials for polling the git.unkin.net container registry.
|
||||
# Vault KV path: kv/service/argocd-image-updater/registry-creds
|
||||
# Required key: creds — value format: "<username>:<token>"
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: registry-creds
|
||||
namespace: argocd-image-updater
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: registry-creds
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: service/argocd-image-updater/registry-creds
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
# ArgoCD API token for image updater to discover and update Applications.
|
||||
# Vault KV path: kv/service/argocd-image-updater/argocd-token
|
||||
# Required key: token — generate via: argocd account generate-token --account image-updater
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: argocd-token
|
||||
namespace: argocd-image-updater
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: argocd-token
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: service/argocd-image-updater/argocd-token
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: artifactapi
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: artifactapi-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: artifactapi-http-redirect
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: artifactapi
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: artifactapi-api
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 10g
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
name: artifactapi-ingress
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: artifactapi.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: artifactapi-api
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
secretName: artifactapi-tls
|
||||
@@ -6,8 +6,7 @@ resources:
|
||||
- artifactapi-deployment.yaml
|
||||
- artifactapi-hpa.yaml
|
||||
- configmap.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
- namespace.yaml
|
||||
- postgres-deployment.yaml
|
||||
- pvc.yaml
|
||||
|
||||
@@ -6,10 +6,8 @@ remotes:
|
||||
immutable_patterns:
|
||||
- "^cloudnative-pg/cloudnative-pg"
|
||||
- "^emberstack/helm-charts"
|
||||
- "^open-webui/open-webui"
|
||||
- "^openvoxproject/"
|
||||
- "^stakater/reloader"
|
||||
- "^stalwartlabs/stalwart"
|
||||
- "^voxpupuli/puppetboard"
|
||||
- "^woodpecker-ci/helm"
|
||||
cache:
|
||||
@@ -21,10 +19,7 @@ remotes:
|
||||
package: "docker"
|
||||
description: "Docker Hub registry"
|
||||
immutable_patterns:
|
||||
- "^library/almalinux"
|
||||
- "^library/busybox"
|
||||
- "^library/debian"
|
||||
- "^library/fedora"
|
||||
- "^library/nginx"
|
||||
- "^library/postgres"
|
||||
- "^library/redis"
|
||||
@@ -32,15 +27,10 @@ remotes:
|
||||
- "^bitnami/"
|
||||
- "^curlimages/curl"
|
||||
- "^emberstack/kubernetes-reflector"
|
||||
- "^hashicorp/consul"
|
||||
- "^hashicorp/vault"
|
||||
- "^hashicorp/vault-secrets-operator"
|
||||
- "^jfrog/"
|
||||
- "^kanidm/"
|
||||
- "^rancher/"
|
||||
- "^rspamd/rspamd"
|
||||
- "^tozd/postfix"
|
||||
- "^traefik/"
|
||||
- "^valkey/valkey"
|
||||
- "^ubi9/ubi-minimal"
|
||||
- "^victoriametrics/"
|
||||
- "^woodpeckerci/"
|
||||
|
||||
@@ -5,7 +5,6 @@ remotes:
|
||||
description: "GitHub releases and files"
|
||||
mutable_patterns:
|
||||
- ".*/archive/refs/heads/.*.tar.gz$"
|
||||
- "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
|
||||
immutable_patterns:
|
||||
- ".*/archive/refs/tags/.*.tar.gz$"
|
||||
- "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
|
||||
@@ -27,16 +26,13 @@ remotes:
|
||||
- "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
|
||||
- "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
|
||||
- "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
|
||||
- "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
|
||||
- "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
|
||||
- "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
|
||||
- "lxc/incus/.*.tar.gz$"
|
||||
- "mikefarah/yq/.*/yq_linux_amd64$"
|
||||
- "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
|
||||
- "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
|
||||
- "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
|
||||
- "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
|
||||
- "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
|
||||
- "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
|
||||
@@ -58,7 +54,6 @@ remotes:
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
|
||||
- "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
|
||||
- "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: "198.18.200.4"
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: rancher.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: rancher.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: rancher-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: rancher-http-redirect
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
hostnames:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: rancher
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
hostnames:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: rancher
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: rancher
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: "198.18.200.0"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
secretName: rancher-tls
|
||||
rules:
|
||||
- host: rancher.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: rancher
|
||||
port:
|
||||
number: 80
|
||||
@@ -6,5 +6,4 @@ resources:
|
||||
- namespace.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: consul
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
cert-manager.io/alt-names: consul.service.consul
|
||||
external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
hostname: consul.k8s.syd1.au.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: consul.k8s.syd1.au.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: consul-tls
|
||||
- name: consul-svc
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: consul.service.consul
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: consul-tls
|
||||
@@ -1,83 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: consul-http-redirect
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
spec:
|
||||
hostnames:
|
||||
- consul.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: consul
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
spec:
|
||||
hostnames:
|
||||
- consul.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: consul-ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: consul-svc
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
spec:
|
||||
hostnames:
|
||||
- consul.service.consul
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
sectionName: consul-svc
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: consul-ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: consul
|
||||
@@ -1,32 +0,0 @@
|
||||
# kanidm
|
||||
|
||||
Single-replica kanidm identity server deployment.
|
||||
|
||||
## Initial setup
|
||||
|
||||
After the pod starts for the first time, generate the admin and idm_admin credentials:
|
||||
|
||||
```bash
|
||||
kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account admin
|
||||
kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account idm_admin
|
||||
```
|
||||
|
||||
## Adding replication
|
||||
|
||||
If replication is needed in the future:
|
||||
|
||||
1. Scale the StatefulSet to 3 replicas and add `podAntiAffinity` to spread across nodes.
|
||||
2. Add a `[replication]` section to `configmap.yaml` per pod (origin is pod-specific:
|
||||
`repl://kanidm-N.kanidm-headless.kanidm.svc.cluster.local:8444`).
|
||||
3. Add the replication port (8444) back to the StatefulSet container ports and headless service.
|
||||
4. Restore `rbac.yaml` for the cert-publisher sidecar, or exchange certificates manually:
|
||||
|
||||
```bash
|
||||
# On each pod, get its replication certificate
|
||||
kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd renew-replication-certificate
|
||||
|
||||
# Add each peer's certificate to the other pods' configs under:
|
||||
# [replication."repl://<peer-fqdn>:8444"]
|
||||
# type = "mutual-pull"
|
||||
# partner_cert = "<cert>"
|
||||
```
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: kanidm-tls
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
secretName: kanidm-tls
|
||||
issuerRef:
|
||||
kind: ClusterIssuer
|
||||
name: vault-issuer
|
||||
commonName: auth.unkin.net
|
||||
dnsNames:
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
- kanidm.k8s.syd1.au.unkin.net
|
||||
- kanidm.kanidm.svc.cluster.local
|
||||
- kanidm-0.kanidm-headless.kanidm.svc.cluster.local
|
||||
- kanidm-1.kanidm-headless.kanidm.svc.cluster.local
|
||||
- kanidm-2.kanidm-headless.kanidm.svc.cluster.local
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
- name: https-passthrough
|
||||
port: 443
|
||||
protocol: TLS
|
||||
tls:
|
||||
mode: Passthrough
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: kanidm-http-redirect
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
hostnames:
|
||||
- kanidm.k8s.syd1.au.unkin.net
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: kanidm
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,27 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- serviceaccount.yaml
|
||||
- certificate.yaml
|
||||
- service.yaml
|
||||
- statefulset.yaml
|
||||
- poddisruptionbudget.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- tlsroute.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: kanidm-config
|
||||
namespace: kanidm
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
files:
|
||||
- server-0.toml=resources/server-0.toml
|
||||
- server-1.toml=resources/server-1.toml
|
||||
- server-2.toml=resources/server-2.toml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kanidm
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: kanidm-repl
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["kanidm-repl-certs"]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: kanidm-repl
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: kanidm-repl
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1,27 +0,0 @@
|
||||
version = "2"
|
||||
|
||||
domain = "auth.unkin.net"
|
||||
origin = "https://auth.unkin.net"
|
||||
bindaddress = "[::]:8443"
|
||||
db_path = "/data/kanidm.db"
|
||||
db_arc_size = 2048
|
||||
tls_chain = "/data/tls/tls.crt"
|
||||
tls_key = "/data/tls/tls.key"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "0 22 * * *"
|
||||
versions = 7
|
||||
|
||||
[replication]
|
||||
origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
|
||||
bindaddress = "[::]:8444"
|
||||
|
||||
[replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
|
||||
type = "mutual-pull"
|
||||
partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
|
||||
|
||||
[replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
|
||||
type = "mutual-pull"
|
||||
partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"
|
||||
@@ -1,27 +0,0 @@
|
||||
version = "2"
|
||||
|
||||
domain = "auth.unkin.net"
|
||||
origin = "https://auth.unkin.net"
|
||||
bindaddress = "[::]:8443"
|
||||
db_path = "/data/kanidm.db"
|
||||
db_arc_size = 2048
|
||||
tls_chain = "/data/tls/tls.crt"
|
||||
tls_key = "/data/tls/tls.key"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "0 22 * * *"
|
||||
versions = 7
|
||||
|
||||
[replication]
|
||||
origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
|
||||
bindaddress = "[::]:8444"
|
||||
|
||||
[replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
|
||||
type = "mutual-pull"
|
||||
partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
|
||||
|
||||
[replication."repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"]
|
||||
type = "mutual-pull"
|
||||
partner_cert = "MIIB-TCCAZ-gAwIBAgIRAeFGUAJbCkJ2vzf_Vv4qjeUwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkZTE0NjUwMDItNWIwYS00Mjc2LWJmMzctZmY1NmZlMmE4ZGU1MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyOTEwWhcNMzAwNTI1MTMyOTEwWjBMMS0wKwYDVQQDDCRlMTQ2NTAwMi01YjBhLTQyNzYtYmYzNy1mZjU2ZmUyYThkZTUxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCrncHSbDNSV3_aOSZ14plbVfrvSXQQL9MOqvrDKlf_Q6WbcA8OrTUjs3Jt0Q2beWjC3Z5-5c9fGu8M_k2iVWf-jYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMi5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIQDHY5Yl-bhDTuJaYnHSMSiSAEWPrDcRVzvfmOJukuJ1QQIgSwgyeSG3K0MY87DI1RDYAdZlpP1YOK3Yatj7-YSXPC0"
|
||||
@@ -1,27 +0,0 @@
|
||||
version = "2"
|
||||
|
||||
domain = "auth.unkin.net"
|
||||
origin = "https://auth.unkin.net"
|
||||
bindaddress = "[::]:8443"
|
||||
db_path = "/data/kanidm.db"
|
||||
db_arc_size = 2048
|
||||
tls_chain = "/data/tls/tls.crt"
|
||||
tls_key = "/data/tls/tls.key"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "0 22 * * *"
|
||||
versions = 7
|
||||
|
||||
[replication]
|
||||
origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
|
||||
bindaddress = "[::]:8444"
|
||||
|
||||
[replication."repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"]
|
||||
type = "mutual-pull"
|
||||
partner_cert = "MIIB-jCCAZ-gAwIBAgIRAVKuoPDpF0IBnvFjCwdK41EwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkNTJhZWEwZjAtZTkxNy00MjAxLTllZjEtNjMwYjA3NGFlMzUxMRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMzNzQ5WhcNMzAwNTI1MTMzNzQ5WjBMMS0wKwYDVQQDDCQ1MmFlYTBmMC1lOTE3LTQyMDEtOWVmMS02MzBiMDc0YWUzNTExGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGejqjk0Eet-RILHI236wHYqISdnPlebqnkuUTh4W2mCzkmqKibyjxGIUOs8LBrUeTR2DxVR1VV6H2rYQk2wdROjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMC5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYCIQCSkFj2A-KVWv2tKJLFzb18J5eWWKtsvWewZTn-FVnRnQIhAKJbt84IoZ9oXxgfp0VOLyVZiAgUgwMFS6JOfno3D-Nw"
|
||||
|
||||
[replication."repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"]
|
||||
type = "mutual-pull"
|
||||
partner_cert = "MIIB-TCCAZ-gAwIBAgIRASqOpORz60wiv7wF_7oBOxQwCgYIKoZIzj0EAwIwTDEtMCsGA1UEAwwkMmE4ZWE0ZTQtNzNlYi00YzIyLWJmYmMtMDVmZmJhMDEzYjE0MRswGQYDVQQKDBJLYW5pZG0gUmVwbGljYXRpb24wHhcNMjYwNTI1MTMyODM5WhcNMzAwNTI1MTMyODM5WjBMMS0wKwYDVQQDDCQyYThlYTRlNC03M2ViLTRjMjItYmZiYy0wNWZmYmEwMTNiMTQxGzAZBgNVBAoMEkthbmlkbSBSZXBsaWNhdGlvbjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFQP3zpFRt7TCOhzrUpOJBojn-sC2LmqZUub8P2ymVdIQbmoAyh4Q8Me0hNWJFyuFDnnqO06dt5I2iv0910-X6KjYjBgMCAGA1UdJQEB_wQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATA8BgNVHREENTAzgjFrYW5pZG0tMS5rYW5pZG0taGVhZGxlc3Mua2FuaWRtLnN2Yy5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0gAMEUCIGjl58U6apcDjMEPIca8Wwg_JMfuMvV-uVcJI49Gl_9GAiEA2tFdb9rnFeBI7mwysScf5UsmY3ZziMD3UVm1vWN2IKs"
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kanidm-headless
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
- name: replication
|
||||
port: 8444
|
||||
targetPort: replication
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
@@ -1,115 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
serviceName: kanidm-headless
|
||||
replicas: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
serviceAccountName: kanidm
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
topologyKey: kubernetes.io/hostname
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: config-init
|
||||
image: busybox:1.36
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
volumeMounts:
|
||||
- name: config-template
|
||||
mountPath: /config-template
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /config
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
containers:
|
||||
- name: kanidm
|
||||
image: kanidm/server:1.10.3
|
||||
command: ["/sbin/kanidmd"]
|
||||
args: ["server", "-c", "/config/server.toml"]
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
- name: replication
|
||||
containerPort: 8444
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: tls
|
||||
mountPath: /data/tls
|
||||
readOnly: true
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 8443
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 8443
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
volumes:
|
||||
- name: config-template
|
||||
configMap:
|
||||
name: kanidm-config
|
||||
- name: config
|
||||
emptyDir: {}
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: kanidm-tls
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
storageClassName: cephrbd-fast-delete
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: TLSRoute
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
hostnames:
|
||||
- kanidm.k8s.syd1.au.unkin.net
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: kanidm
|
||||
sectionName: https-passthrough
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: kanidm
|
||||
port: 8443
|
||||
weight: 1
|
||||
@@ -76,11 +76,11 @@ spec:
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
memory: 256Mi
|
||||
smartShutdownTimeout: 180
|
||||
startDelay: 3600
|
||||
stopDelay: 1800
|
||||
|
||||
@@ -56,10 +56,10 @@ spec:
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 8Gi
|
||||
memory: 6Gi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 6Gi
|
||||
memory: 2Gi
|
||||
volumeMounts:
|
||||
- mountPath: /app/config.yaml
|
||||
name: config
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: litellm.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: litellm.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: litellm-tls
|
||||
mode: Terminate
|
||||
@@ -10,14 +10,14 @@ spec:
|
||||
kind: Deployment
|
||||
name: litellm
|
||||
minReplicas: 2
|
||||
maxReplicas: 4
|
||||
maxReplicas: 10
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
averageUtilization: 60
|
||||
behavior:
|
||||
scaleUp:
|
||||
stabilizationWindowSeconds: 0
|
||||
@@ -25,7 +25,7 @@ spec:
|
||||
policies:
|
||||
- type: Percent
|
||||
value: 100
|
||||
periodSeconds: 60
|
||||
periodSeconds: 30
|
||||
- type: Pods
|
||||
value: 4
|
||||
periodSeconds: 30
|
||||
@@ -34,7 +34,7 @@ spec:
|
||||
selectPolicy: Min
|
||||
policies:
|
||||
- type: Percent
|
||||
value: 30
|
||||
value: 10
|
||||
periodSeconds: 60
|
||||
- type: Pods
|
||||
value: 2
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: litellm-http-redirect
|
||||
namespace: litellm
|
||||
spec:
|
||||
hostnames:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: litellm
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
hostnames:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: litellm
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: litellm
|
||||
port: 4000
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
rules:
|
||||
- host: litellm.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: litellm
|
||||
port:
|
||||
number: 4000
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
secretName: litellm-tls
|
||||
@@ -7,8 +7,7 @@ resources:
|
||||
- cnpg_pooler.yaml
|
||||
- deployment.yaml
|
||||
- hpa.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
- namespace.yaml
|
||||
- redis-deployment.yaml
|
||||
- redis-pvc.yaml
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: paperclip-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: paperclip-http-redirect
|
||||
namespace: paperclip
|
||||
spec:
|
||||
hostnames:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: paperclip
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
hostnames:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: paperclip
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: paperclip
|
||||
port: 3100
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
rules:
|
||||
- host: paperclip.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: paperclip
|
||||
port:
|
||||
number: 3100
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
secretName: paperclip-tls
|
||||
@@ -6,8 +6,7 @@ resources:
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- deployment.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
- namespace.yaml
|
||||
- services.yaml
|
||||
- vaultauth.yaml
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- priorityclasses.yaml
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: low
|
||||
value: 100
|
||||
preemptionPolicy: Never
|
||||
globalDefault: false
|
||||
description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: power
|
||||
value: 100
|
||||
preemptionPolicy: Never
|
||||
globalDefault: false
|
||||
description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: medium
|
||||
value: 10000
|
||||
preemptionPolicy: PreemptLowerPriority
|
||||
globalDefault: false
|
||||
description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: high
|
||||
value: 100000
|
||||
preemptionPolicy: PreemptLowerPriority
|
||||
globalDefault: false
|
||||
description: "High-importance services. Will preempt medium- and low-priority pods if necessary."
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard
|
||||
namespace: puppet
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: puppetboard-tls
|
||||
mode: Terminate
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: puppetdb.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: puppetdb-tls
|
||||
mode: Terminate
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard-http-redirect
|
||||
namespace: puppet
|
||||
spec:
|
||||
hostnames:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetboard
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard
|
||||
namespace: puppet
|
||||
spec:
|
||||
hostnames:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetboard
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: puppetboard
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
hostnames:
|
||||
- puppetdb.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetdb
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: puppetdb
|
||||
port: 8080
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard
|
||||
namespace: puppet
|
||||
spec:
|
||||
rules:
|
||||
- host: puppetboard.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: puppetboard
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
secretName: puppetboard-tls
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
rules:
|
||||
- host: puppetdb.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: puppetdb
|
||||
port:
|
||||
number: 8080
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- puppetdb.k8s.syd1.au.unkin.net
|
||||
secretName: puppetdb-tls
|
||||
@@ -25,10 +25,8 @@ resources:
|
||||
- horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
|
||||
- horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
|
||||
- horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
|
||||
- gateway_puppetboard.yaml
|
||||
- httproute_puppetboard.yaml
|
||||
- gateway_puppetdb.yaml
|
||||
- httproute_puppetdb.yaml
|
||||
- ingress_puppetboard.yaml
|
||||
- ingress_puppetdb.yaml
|
||||
- service_puppetserver-agents-to-puppet.yaml
|
||||
- service_puppet-headless.yaml
|
||||
- service_puppet.yaml
|
||||
|
||||
@@ -9,6 +9,7 @@ metadata:
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
clusterIP: null
|
||||
ports:
|
||||
- name: pdb-http
|
||||
port: 8080
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: GatewayClass
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: external
|
||||
name: traefik-external
|
||||
spec:
|
||||
controllerName: traefik.io/gateway-controller
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: GatewayClass
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
name: traefik-internal
|
||||
spec:
|
||||
controllerName: traefik.io/gateway-controller
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- gatewayclass-internal.yaml
|
||||
- gatewayclass-external.yaml
|
||||
@@ -1,52 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: vault.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
cert-manager.io/alt-names: vault.service.consul,vault.query.consul
|
||||
external-dns.alpha.kubernetes.io/hostname: vault.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
hostname: vault.k8s.syd1.au.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: vault.k8s.syd1.au.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: vault-tls
|
||||
- name: vault-direct
|
||||
port: 8200
|
||||
protocol: HTTPS
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: vault-tls
|
||||
@@ -1,84 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: vault-http-redirect
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
spec:
|
||||
hostnames:
|
||||
- vault.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: vault
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
spec:
|
||||
hostnames:
|
||||
- vault.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: vault
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: vault
|
||||
port: 8200
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: vault-consul
|
||||
namespace: vault
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: vault
|
||||
spec:
|
||||
hostnames:
|
||||
- vault.service.consul
|
||||
- vault.query.consul
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: vault
|
||||
sectionName: vault-direct
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: vault
|
||||
port: 8200
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- role_k8s-service-registration.yaml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: vault
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: vault-k8s-service-registration
|
||||
namespace: vault
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: vault-k8s-service-registration
|
||||
namespace: vault
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: vault-k8s-service-registration
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: vault
|
||||
namespace: vault
|
||||
@@ -6,6 +6,5 @@ resources:
|
||||
- namespace.yaml
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- serviceaccount_terraform_vault.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: terraform-vault
|
||||
namespace: woodpecker
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/argocd-image-updater
|
||||
|
||||
helmCharts:
|
||||
- name: argocd-image-updater
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
version: "0.10.3"
|
||||
releaseName: argocd-image-updater
|
||||
namespace: argocd-image-updater
|
||||
valuesFile: values.yaml
|
||||
@@ -0,0 +1,33 @@
|
||||
config:
|
||||
argocd:
|
||||
grpcWeb: false
|
||||
serverAddress: argocd-server.argocd
|
||||
insecure: true
|
||||
plaintext: false
|
||||
|
||||
registries:
|
||||
- name: git.unkin.net
|
||||
api_url: https://git.unkin.net
|
||||
prefix: git.unkin.net
|
||||
credentials: secret:argocd-image-updater/registry-creds#creds
|
||||
insecure: false
|
||||
|
||||
authScripts:
|
||||
enabled: false
|
||||
|
||||
extraEnv:
|
||||
- name: ARGOCD_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: argocd-token
|
||||
key: token
|
||||
|
||||
gitCommitUser: "ArgoCD Image Updater"
|
||||
gitCommitEmail: "argocd-image-updater@unkin.net"
|
||||
|
||||
rbac:
|
||||
enabled: true
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: argocd-image-updater
|
||||
@@ -8,7 +8,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: cert-manager
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
version: "v1.20.2"
|
||||
version: "v1.19.2"
|
||||
releaseName: cert-manager
|
||||
namespace: cert-manager
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -1,11 +1,6 @@
|
||||
crds:
|
||||
enabled: true
|
||||
|
||||
config:
|
||||
apiVersion: controller.config.cert-manager.io/v1alpha1
|
||||
kind: ControllerConfiguration
|
||||
enableGatewayAPI: true
|
||||
|
||||
replicaCount: 2
|
||||
|
||||
resources:
|
||||
|
||||
@@ -1,16 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/consul
|
||||
|
||||
helmCharts:
|
||||
- name: consul
|
||||
repo: https://helm.releases.hashicorp.com
|
||||
version: "1.9.7"
|
||||
releaseName: consul
|
||||
namespace: consul
|
||||
valuesFile: values.yaml
|
||||
apiVersions:
|
||||
- policy/v1/PodDisruptionBudget
|
||||
@@ -1,58 +0,0 @@
|
||||
global:
|
||||
name: consul
|
||||
datacenter: au-syd1
|
||||
domain: consul
|
||||
|
||||
server:
|
||||
image: hashicorp/consul:1.22.7
|
||||
replicas: 5
|
||||
bootstrapExpect: 5
|
||||
storage: 10Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
|
||||
connect: true
|
||||
|
||||
disruptionBudget:
|
||||
maxUnavailable: 1
|
||||
|
||||
extraConfig: |
|
||||
{
|
||||
"disable_remote_exec": true,
|
||||
"disable_update_check": true,
|
||||
"performance": {
|
||||
"raft_multiplier": 10
|
||||
},
|
||||
"ports": {
|
||||
"dns": 8600,
|
||||
"grpc": 8502,
|
||||
"http": 8500,
|
||||
"https": -1
|
||||
},
|
||||
"primary_datacenter": "au-syd1"
|
||||
}
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: "1"
|
||||
|
||||
client:
|
||||
enabled: false
|
||||
|
||||
ui:
|
||||
enabled: true
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
connectInject:
|
||||
enabled: false
|
||||
|
||||
dns:
|
||||
enabled: true
|
||||
type: LoadBalancer
|
||||
annotations: |
|
||||
purelb.io/service-group: "common"
|
||||
purelb.io/addresses: 198.18.200.5
|
||||
@@ -8,7 +8,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: external-dns
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
version: "1.21.1"
|
||||
version: "1.19.0"
|
||||
releaseName: externaldns
|
||||
namespace: externaldns
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -24,8 +24,6 @@ policy: "sync"
|
||||
sources:
|
||||
- service
|
||||
- ingress
|
||||
- gateway-httproute
|
||||
- gateway-grpcroute
|
||||
|
||||
# Environment variables for TSIG secret and algorithm from Vault
|
||||
env:
|
||||
@@ -51,5 +49,3 @@ extraArgs:
|
||||
- --rfc2136-tsig-axfr
|
||||
- --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
|
||||
- --ingress-class=nginx
|
||||
|
||||
logLevel: debug
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/kanidm
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/priority-classes
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/traefik-system
|
||||
|
||||
helmCharts:
|
||||
- name: traefik
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
version: "40.0.0"
|
||||
releaseName: traefik-internal
|
||||
namespace: traefik-system
|
||||
valuesFile: values-internal.yaml
|
||||
apiVersions:
|
||||
- policy/v1/PodDisruptionBudget
|
||||
- name: traefik
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
version: "40.0.0"
|
||||
releaseName: traefik-external
|
||||
namespace: traefik-system
|
||||
valuesFile: values-external.yaml
|
||||
apiVersions:
|
||||
- policy/v1/PodDisruptionBudget
|
||||
@@ -1,98 +0,0 @@
|
||||
image:
|
||||
tag: v3.7.0
|
||||
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
maxUnavailable: 1
|
||||
|
||||
gateway:
|
||||
enabled: false
|
||||
|
||||
gatewayClass:
|
||||
enabled: false
|
||||
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
enabled: false
|
||||
kubernetesIngress:
|
||||
enabled: false
|
||||
kubernetesGateway:
|
||||
enabled: true
|
||||
experimentalChannel: false
|
||||
namespaces: []
|
||||
nativeLBByDefault: false
|
||||
labelSelector: "traefik.io/instance=external"
|
||||
|
||||
logs:
|
||||
access:
|
||||
enabled: true
|
||||
|
||||
global:
|
||||
checkNewVersion: true
|
||||
sendAnonymousUsage: false
|
||||
notAppendXForwardedFor: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
single: true
|
||||
annotations:
|
||||
purelb.io/service-group: "dmz"
|
||||
purelb.io/addresses: 198.18.199.0
|
||||
annotationsTCP: {}
|
||||
annotationsUDP: {}
|
||||
labels: {}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
loadBalancerIP: "198.18.199.0"
|
||||
additionalServices: {}
|
||||
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 5
|
||||
metrics: []
|
||||
behavior: {}
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: "{{ template \"traefik.fullname\" . }}"
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: '{{ template "traefik.name" . }}'
|
||||
app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
podSecurityContext:
|
||||
runAsGroup: 65532
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
add: [NET_BIND_SERVICE]
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
ports:
|
||||
web:
|
||||
port: 80
|
||||
websecure:
|
||||
port: 443
|
||||
|
||||
enabled: true
|
||||
@@ -1,100 +0,0 @@
|
||||
image:
|
||||
tag: v3.7.0
|
||||
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: true
|
||||
maxUnavailable: 1
|
||||
|
||||
gateway:
|
||||
enabled: false
|
||||
|
||||
gatewayClass:
|
||||
enabled: false
|
||||
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
enabled: false
|
||||
kubernetesIngress:
|
||||
enabled: false
|
||||
kubernetesGateway:
|
||||
enabled: true
|
||||
experimentalChannel: false
|
||||
namespaces: []
|
||||
nativeLBByDefault: false
|
||||
labelSelector: "traefik.io/instance=internal"
|
||||
|
||||
logs:
|
||||
access:
|
||||
enabled: true
|
||||
|
||||
global:
|
||||
checkNewVersion: true
|
||||
sendAnonymousUsage: false
|
||||
notAppendXForwardedFor: false
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
single: true
|
||||
annotations:
|
||||
purelb.io/service-group: "common"
|
||||
purelb.io/addresses: 198.18.200.4
|
||||
annotationsTCP: {}
|
||||
annotationsUDP: {}
|
||||
labels: {}
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
loadBalancerIP: "198.18.200.4"
|
||||
additionalServices: {}
|
||||
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
maxReplicas: 5
|
||||
metrics: []
|
||||
behavior: {}
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: "{{ template \"traefik.fullname\" . }}"
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: '{{ template "traefik.name" . }}'
|
||||
app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
|
||||
topologyKey: kubernetes.io/hostname
|
||||
|
||||
podSecurityContext:
|
||||
runAsGroup: 65532
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
add: [NET_BIND_SERVICE]
|
||||
readOnlyRootFilesystem: true
|
||||
|
||||
ports:
|
||||
web:
|
||||
port: 80
|
||||
websecure:
|
||||
port: 443
|
||||
vault-direct:
|
||||
port: 8200
|
||||
|
||||
enabled: true
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../base/vault
|
||||
|
||||
helmCharts:
|
||||
- name: vault
|
||||
repo: https://helm.releases.hashicorp.com
|
||||
version: "0.32.0"
|
||||
releaseName: vault
|
||||
namespace: vault
|
||||
valuesFile: values.yaml
|
||||
@@ -1,79 +0,0 @@
|
||||
server:
|
||||
image:
|
||||
repository: hashicorp/vault
|
||||
tag: "2.0.1"
|
||||
|
||||
ha:
|
||||
enabled: true
|
||||
replicas: 5
|
||||
|
||||
raft:
|
||||
enabled: true
|
||||
setNodeId: true
|
||||
config: |
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
|
||||
listener "tcp" {
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
tls_disable = "true"
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/data"
|
||||
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
|
||||
}
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
|
||||
}
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
|
||||
}
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-3.vault-internal.vault.svc.cluster.local:8200"
|
||||
}
|
||||
retry_join {
|
||||
leader_api_addr = "http://vault-4.vault-internal.vault.svc.cluster.local:8200"
|
||||
}
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
dataStorage:
|
||||
enabled: true
|
||||
size: 10Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
accessMode: ReadWriteOnce
|
||||
|
||||
extraEnv:
|
||||
- name: VAULT_K8S_NAMESPACE
|
||||
value: vault
|
||||
- name: VAULT_K8S_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
|
||||
statefulSet:
|
||||
securityContext:
|
||||
container:
|
||||
capabilities:
|
||||
add:
|
||||
- IPC_LOCK
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
|
||||
injector:
|
||||
enabled: false
|
||||
|
||||
ui:
|
||||
enabled: true
|
||||
serviceType: ClusterIP
|
||||
@@ -8,7 +8,7 @@ resources:
|
||||
helmCharts:
|
||||
- name: woodpecker
|
||||
repo: oci://ghcr.io/woodpecker-ci/helm
|
||||
version: "3.6.3"
|
||||
version: "3.5.1"
|
||||
releaseName: woodpecker
|
||||
namespace: woodpecker
|
||||
valuesFile: values.yaml
|
||||
|
||||
@@ -2,7 +2,6 @@ agent:
|
||||
replicaCount: 3
|
||||
env:
|
||||
WOODPECKER_MAX_WORKFLOWS: "8"
|
||||
WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
|
||||
WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
|
||||
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
|
||||
WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: ApplicationSet
|
||||
metadata:
|
||||
name: image-updater-apps
|
||||
namespace: argocd
|
||||
spec:
|
||||
generators:
|
||||
- git:
|
||||
repoURL: https://git.unkin.net/unkin/argocd-apps
|
||||
revision: HEAD
|
||||
directories:
|
||||
- path: apps/overlays/*/artifactapi
|
||||
template:
|
||||
metadata:
|
||||
name: 'platform-{{path[3]}}'
|
||||
annotations:
|
||||
argocd-image-updater.argoproj.io/image-list: "artifactapi=git.unkin.net/unkin/artifactapi"
|
||||
argocd-image-updater.argoproj.io/artifactapi.update-strategy: semver
|
||||
argocd-image-updater.argoproj.io/write-back-method: git
|
||||
argocd-image-updater.argoproj.io/git-branch: main
|
||||
spec:
|
||||
project: platform
|
||||
source:
|
||||
repoURL: https://git.unkin.net/unkin/argocd-apps
|
||||
targetRevision: HEAD
|
||||
path: '{{path}}'
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: '{{path[3]}}'
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- ServerSideApply=true
|
||||
@@ -4,6 +4,7 @@ kind: Kustomization
|
||||
|
||||
resources:
|
||||
- aitooling.yaml
|
||||
- imageupdater.yaml
|
||||
- observability.yaml
|
||||
- platform.yaml
|
||||
- storage.yaml
|
||||
|
||||
@@ -10,27 +10,22 @@ spec:
|
||||
repoURL: https://git.unkin.net/unkin/argocd-apps
|
||||
revision: HEAD
|
||||
directories:
|
||||
- path: apps/overlays/*/artifactapi
|
||||
- path: apps/overlays/*/argocd-image-updater
|
||||
- path: apps/overlays/*/cattle-system
|
||||
- path: apps/overlays/*/cert-manager
|
||||
- path: apps/overlays/*/certificates
|
||||
- path: apps/overlays/*/cnpg-system
|
||||
- path: apps/overlays/*/consul
|
||||
- path: apps/overlays/*/elastic-system
|
||||
- path: apps/overlays/*/externaldns
|
||||
- path: apps/overlays/*/inteldeviceplugins-system
|
||||
- path: apps/overlays/*/jfrog
|
||||
- path: apps/overlays/*/kanidm
|
||||
- path: apps/overlays/*/node-feature-discovery
|
||||
- path: apps/overlays/*/priority-classes
|
||||
- path: apps/overlays/*/puppet
|
||||
- path: apps/overlays/*/purelb
|
||||
- path: apps/overlays/*/reflector-system
|
||||
- path: apps/overlays/*/reloader-system
|
||||
- path: apps/overlays/*/reposync
|
||||
- path: apps/overlays/*/traefik-system
|
||||
- path: apps/overlays/*/vm-system
|
||||
- path: apps/overlays/*/vault
|
||||
- path: apps/overlays/*/vso-system
|
||||
- path: apps/overlays/*/woodpecker
|
||||
template:
|
||||
@@ -45,12 +40,6 @@ spec:
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: '{{path[3]}}' # Use directory name as namespace
|
||||
ignoreDifferences:
|
||||
- group: ""
|
||||
kind: ConfigMap
|
||||
name: kanidm-repl-certs
|
||||
jsonPointers:
|
||||
- /data
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
|
||||
@@ -21,26 +21,18 @@ spec:
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'certificates'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'consul'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'externaldns'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'jfrog'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'kanidm'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'node-feature-discovery'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'priority-classes'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'purelb'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'puppet'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'reposync'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'vault'
|
||||
server: https://kubernetes.default.svc
|
||||
- namespace: 'woodpecker'
|
||||
server: https://kubernetes.default.svc
|
||||
clusterResourceWhitelist:
|
||||
@@ -68,10 +60,6 @@ spec:
|
||||
kind: Certificate
|
||||
- group: 'cert-manager.io'
|
||||
kind: Issuer
|
||||
- group: 'gateway.networking.k8s.io'
|
||||
kind: GatewayClass
|
||||
- group: 'networking.k8s.io'
|
||||
kind: IngressClass
|
||||
namespaceResourceWhitelist:
|
||||
- group: '*'
|
||||
kind: '*'
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
#!/usr/bin/env -S uv run
|
||||
# /// script
|
||||
# requires-python = ">=3.11"
|
||||
# dependencies = ["pyyaml"]
|
||||
# ///
|
||||
"""
|
||||
Extract OpenAPI v3 schemas from CRD YAML on stdin and write JSON schema files
|
||||
to the output directory for use with kubeconform.
|
||||
|
||||
Usage: kustomize build ... | ci/generate-crd-schemas.py <output-dir>
|
||||
"""
|
||||
import sys
|
||||
import json
|
||||
import os
|
||||
|
||||
import yaml
|
||||
|
||||
|
||||
def main() -> int:
|
||||
output_dir = sys.argv[1] if len(sys.argv) > 1 else "ci/crd-schemas"
|
||||
count = 0
|
||||
|
||||
for doc in yaml.safe_load_all(sys.stdin):
|
||||
if not doc or doc.get("kind") != "CustomResourceDefinition":
|
||||
continue
|
||||
|
||||
group = doc["spec"]["group"]
|
||||
kind = doc["spec"]["names"]["kind"]
|
||||
group_dir = os.path.join(output_dir, group)
|
||||
os.makedirs(group_dir, exist_ok=True)
|
||||
|
||||
for ver in doc["spec"].get("versions", []):
|
||||
if not ver.get("served", True):
|
||||
continue
|
||||
schema = ver.get("schema", {}).get("openAPIV3Schema")
|
||||
if not schema:
|
||||
continue
|
||||
fname = os.path.join(group_dir, f"{kind.lower()}_{ver['name']}.json")
|
||||
with open(fname, "w") as f:
|
||||
json.dump({"$schema": "http://json-schema.org/schema#", **schema}, f, indent=2)
|
||||
f.write("\n")
|
||||
print(f" wrote {fname}", file=sys.stderr)
|
||||
count += 1
|
||||
|
||||
return count
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
print(main())
|
||||
@@ -1,23 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Extract OpenAPI v3 schemas from CRD definitions in all kustomize overlays
|
||||
# and write JSON schema files to ci/crd-schemas/ for kubeconform validation.
|
||||
#
|
||||
# Run this script whenever CRD versions change, then commit the output.
|
||||
# Usage: ci/generate-crd-schemas.sh [output-dir]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
OUTPUT_DIR="${1:-${SCRIPT_DIR}/crd-schemas}"
|
||||
mkdir -p "$OUTPUT_DIR"
|
||||
|
||||
total=0
|
||||
|
||||
while IFS= read -r -d "" k; do
|
||||
dir="$(dirname "$k")"
|
||||
n=$(kustomize build --enable-helm "$dir" 2>/dev/null \
|
||||
| "$SCRIPT_DIR/generate-crd-schemas.py" "$OUTPUT_DIR") || continue
|
||||
total=$((total + n))
|
||||
done < <(find apps/overlays clusters -name kustomization.yaml -print0 | sort -z)
|
||||
|
||||
echo "Generated ${total} schema(s) in ${OUTPUT_DIR}" >&2
|
||||
+1
-2
@@ -6,7 +6,6 @@ KUBE_VERSION="1.33.7"
|
||||
schema_args=(
|
||||
-schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
|
||||
-schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
|
||||
-schema-location "file://${PWD}/ci/crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
|
||||
)
|
||||
|
||||
while IFS= read -r -d "" k; do
|
||||
@@ -19,6 +18,6 @@ while IFS= read -r -d "" k; do
|
||||
-summary \
|
||||
-output pretty \
|
||||
-verbose \
|
||||
-skip GpuDevicePlugin,LBNodeAgent,ServiceGroup \
|
||||
-skip CustomResourceDefinition,GpuDevicePlugin,LBNodeAgent,ServiceGroup \
|
||||
"${schema_args[@]}"
|
||||
done < <(find apps/overlays -name kustomization.yaml -print0)
|
||||
|
||||
@@ -6,7 +6,6 @@ KUBE_VERSION="1.33.7"
|
||||
schema_args=(
|
||||
-schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{.NormalizedKubernetesVersion}}-standalone{{.StrictSuffix}}/{{.ResourceKind}}{{.KindSuffix}}.json"
|
||||
-schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
|
||||
-schema-location "file://${PWD}/ci/crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json"
|
||||
)
|
||||
|
||||
while IFS= read -r -d "" k; do
|
||||
|
||||
Reference in New Issue
Block a user