Compare commits
5 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
0fd269ed9a | ||
|
unkinben
|
1112309a60 | ||
|
unkinben
|
b87844b4cc | ||
|
unkinben
|
2ddd2173e3 | ||
|
unkinben
|
1e88102a46 |
@@ -40,10 +40,3 @@ repos:
|
||||
entry: ci/validate-no-secrets.sh
|
||||
language: system
|
||||
pass_filenames: false
|
||||
- id: conftest_policies
|
||||
name: OPA policy checks (conftest)
|
||||
entry: conftest test --policy policy/
|
||||
language: system
|
||||
types: [yaml]
|
||||
exclude: ".*/charts/.*|.*/templates/.*|\\.woodpecker/.*"
|
||||
pass_filenames: true
|
||||
|
||||
@@ -31,7 +31,6 @@ spec:
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: artifactapi-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -8,9 +8,7 @@ spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
- name: artifactapi
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -32,17 +30,12 @@ spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
- name: artifactapi
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: artifactapi-api
|
||||
- name: artifactapi-api
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -8,7 +8,6 @@ remotes:
|
||||
- "^emberstack/helm-charts"
|
||||
- "^openvoxproject/"
|
||||
- "^stakater/reloader"
|
||||
- "^stalwartlabs/stalwart"
|
||||
- "^voxpupuli/puppetboard"
|
||||
- "^woodpecker-ci/helm"
|
||||
cache:
|
||||
@@ -34,12 +33,8 @@ remotes:
|
||||
- "^hashicorp/consul"
|
||||
- "^hashicorp/vault"
|
||||
- "^jfrog/"
|
||||
- "^kanidm/"
|
||||
- "^rancher/"
|
||||
- "^rspamd/rspamd"
|
||||
- "^tozd/postfix"
|
||||
- "^traefik/"
|
||||
- "^valkey/valkey"
|
||||
- "^ubi9/ubi-minimal"
|
||||
- "^victoriametrics/"
|
||||
- "^woodpeckerci/"
|
||||
|
||||
@@ -5,7 +5,6 @@ remotes:
|
||||
description: "GitHub releases and files"
|
||||
mutable_patterns:
|
||||
- ".*/archive/refs/heads/.*.tar.gz$"
|
||||
- "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
|
||||
immutable_patterns:
|
||||
- ".*/archive/refs/tags/.*.tar.gz$"
|
||||
- "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
|
||||
|
||||
@@ -31,7 +31,6 @@ spec:
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: rancher-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -8,9 +8,7 @@ spec:
|
||||
hostnames:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: rancher
|
||||
- name: rancher
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -32,17 +30,12 @@ spec:
|
||||
hostnames:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: rancher
|
||||
- name: rancher
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: rancher
|
||||
- name: rancher
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -35,8 +35,7 @@ spec:
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: consul-tls
|
||||
- name: consul-svc
|
||||
port: 443
|
||||
@@ -48,6 +47,5 @@ spec:
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: consul-tls
|
||||
|
||||
@@ -11,9 +11,7 @@ spec:
|
||||
hostnames:
|
||||
- consul.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
- name: consul
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -38,17 +36,12 @@ spec:
|
||||
hostnames:
|
||||
- consul.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
- name: consul
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: consul-ui
|
||||
- name: consul-ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
@@ -66,17 +59,12 @@ spec:
|
||||
hostnames:
|
||||
- consul.service.consul
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
- name: consul
|
||||
sectionName: consul-svc
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: consul-ui
|
||||
- name: consul-ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -13,9 +13,7 @@ spec:
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: kanidm
|
||||
- name: kanidm
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
|
||||
@@ -36,7 +36,7 @@ spec:
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: config-init
|
||||
image: kanidm/server:1.10.3
|
||||
image: ghcr.io/kanidm/server:1.10.3
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
@@ -99,7 +99,7 @@ spec:
|
||||
readOnlyRootFilesystem: false
|
||||
containers:
|
||||
- name: kanidm
|
||||
image: kanidm/server:1.10.3
|
||||
image: ghcr.io/kanidm/server:1.10.3
|
||||
command: ["/sbin/kanidmd"]
|
||||
args: ["server", "-c", "/config/server.toml"]
|
||||
ports:
|
||||
|
||||
@@ -76,8 +76,8 @@ spec:
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
cpu: 1
|
||||
memory: 1024Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
|
||||
@@ -31,7 +31,6 @@ spec:
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: litellm-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -8,9 +8,7 @@ spec:
|
||||
hostnames:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: litellm
|
||||
- name: litellm
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -32,17 +30,12 @@ spec:
|
||||
hostnames:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: litellm
|
||||
- name: litellm
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: litellm
|
||||
- name: litellm
|
||||
port: 4000
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -31,7 +31,6 @@ spec:
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: paperclip-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -8,9 +8,7 @@ spec:
|
||||
hostnames:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: paperclip
|
||||
- name: paperclip
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -32,17 +30,12 @@ spec:
|
||||
hostnames:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: paperclip
|
||||
- name: paperclip
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: paperclip
|
||||
- name: paperclip
|
||||
port: 3100
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -150,7 +150,7 @@ spec:
|
||||
memory: 350Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
memory: 1024Mi
|
||||
cpu: 500m
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
@@ -35,7 +35,7 @@ spec:
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
cpu: 1
|
||||
memory: 1536Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
|
||||
@@ -31,11 +31,11 @@ spec:
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 3Gi
|
||||
cpu: 2
|
||||
memory: 3072Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
memory: 1024Mi
|
||||
ports:
|
||||
- containerPort: 8140
|
||||
name: puppetserver
|
||||
|
||||
@@ -35,11 +35,11 @@ spec:
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
cpu: 2
|
||||
memory: 3500Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 1Gi
|
||||
memory: 1024Mi
|
||||
ports:
|
||||
- containerPort: 8140
|
||||
name: puppetserver
|
||||
|
||||
@@ -35,7 +35,6 @@ spec:
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: puppetboard-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -28,7 +28,6 @@ spec:
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: puppetdb-tls
|
||||
mode: Terminate
|
||||
|
||||
@@ -13,9 +13,7 @@ spec:
|
||||
hostnames:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetboard
|
||||
- name: puppetboard
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -42,17 +40,12 @@ spec:
|
||||
hostnames:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetboard
|
||||
- name: puppetboard
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: puppetboard
|
||||
- name: puppetboard
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -13,17 +13,12 @@ spec:
|
||||
hostnames:
|
||||
- puppetdb.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetdb
|
||||
- name: puppetdb
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: puppetdb
|
||||
- name: puppetdb
|
||||
port: 8080
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -53,7 +53,7 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "2"
|
||||
cpu: 2000m
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: repodata
|
||||
|
||||
@@ -56,7 +56,7 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "2"
|
||||
cpu: 2000m
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: repodata
|
||||
|
||||
@@ -53,7 +53,7 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "2"
|
||||
cpu: 2000m
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: repodata
|
||||
|
||||
@@ -52,7 +52,7 @@ spec:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "2"
|
||||
cpu: 2000m
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: repodata
|
||||
|
||||
@@ -35,8 +35,7 @@ spec:
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: vault-tls
|
||||
- name: vault-direct
|
||||
port: 8200
|
||||
@@ -47,6 +46,5 @@ spec:
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
- kind: Secret
|
||||
name: vault-tls
|
||||
|
||||
@@ -11,9 +11,7 @@ spec:
|
||||
hostnames:
|
||||
- vault.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: vault
|
||||
- name: vault
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
@@ -38,17 +36,12 @@ spec:
|
||||
hostnames:
|
||||
- vault.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: vault
|
||||
- name: vault
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: vault
|
||||
- name: vault
|
||||
port: 8200
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
@@ -67,17 +60,12 @@ spec:
|
||||
- vault.service.consul
|
||||
- vault.query.consul
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: vault
|
||||
- name: vault
|
||||
sectionName: vault-direct
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: vault
|
||||
- name: vault
|
||||
port: 8200
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
|
||||
@@ -1,94 +0,0 @@
|
||||
package main
|
||||
|
||||
# Gateway API resources require several fields to be set explicitly even though
|
||||
# the Gateway API controller defaults them. ArgoCD diffs desired vs live by
|
||||
# string comparison, so any field the controller defaults that is absent from
|
||||
# the git manifest causes a permanent OutOfSync.
|
||||
#
|
||||
# Affected resources:
|
||||
# HTTPRoute / TLSRoute — parentRefs and backendRefs (see PR #162, #165)
|
||||
# Gateway — listeners[*].tls.certificateRefs (see PR #153)
|
||||
|
||||
_route_kinds := {"HTTPRoute", "TLSRoute"}
|
||||
|
||||
# ---- parentRefs: group must be "gateway.networking.k8s.io" ----
|
||||
|
||||
deny contains msg if {
|
||||
_route_kinds[input.kind]
|
||||
ref := input.spec.parentRefs[i]
|
||||
object.get(ref, "group", null) != "gateway.networking.k8s.io"
|
||||
msg := sprintf(
|
||||
"%s %s/%s parentRefs[%d]: add 'group: gateway.networking.k8s.io' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
|
||||
[input.kind, input.metadata.namespace, input.metadata.name, i],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- parentRefs: kind must be "Gateway" ----
|
||||
|
||||
deny contains msg if {
|
||||
_route_kinds[input.kind]
|
||||
ref := input.spec.parentRefs[i]
|
||||
object.get(ref, "kind", null) != "Gateway"
|
||||
msg := sprintf(
|
||||
"%s %s/%s parentRefs[%d]: add 'kind: Gateway' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
|
||||
[input.kind, input.metadata.namespace, input.metadata.name, i],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- backendRefs: group must be present (may be empty string "") ----
|
||||
|
||||
deny contains msg if {
|
||||
_route_kinds[input.kind]
|
||||
rule := input.spec.rules[ri]
|
||||
ref := rule.backendRefs[bi]
|
||||
not _has_key(ref, "group")
|
||||
msg := sprintf(
|
||||
"%s %s/%s rules[%d].backendRefs[%d]: add 'group: \"\"' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
|
||||
[input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- backendRefs: kind must be "Service" ----
|
||||
|
||||
deny contains msg if {
|
||||
_route_kinds[input.kind]
|
||||
rule := input.spec.rules[ri]
|
||||
ref := rule.backendRefs[bi]
|
||||
object.get(ref, "kind", null) != "Service"
|
||||
msg := sprintf(
|
||||
"%s %s/%s rules[%d].backendRefs[%d]: add 'kind: Service' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
|
||||
[input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- backendRefs: weight must be present ----
|
||||
|
||||
deny contains msg if {
|
||||
_route_kinds[input.kind]
|
||||
rule := input.spec.rules[ri]
|
||||
ref := rule.backendRefs[bi]
|
||||
not _has_key(ref, "weight")
|
||||
msg := sprintf(
|
||||
"%s %s/%s rules[%d].backendRefs[%d]: add 'weight: 1' — controller defaults this field, causing ArgoCD OutOfSync when omitted",
|
||||
[input.kind, input.metadata.namespace, input.metadata.name, ri, bi],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- Gateway certificateRefs: group must be present (may be empty string "") ----
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Gateway"
|
||||
listener := input.spec.listeners[li]
|
||||
ref := listener.tls.certificateRefs[ci]
|
||||
not _has_key(ref, "group")
|
||||
msg := sprintf(
|
||||
"Gateway %s/%s listeners[%d].tls.certificateRefs[%d]: add 'group: \"\"' — admission webhook defaults this field, causing ArgoCD OutOfSync when omitted",
|
||||
[input.metadata.namespace, input.metadata.name, li, ci],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- Helper: key presence check (works for null, "", and any defined value) ----
|
||||
|
||||
_has_key(obj, key) if {
|
||||
_ = obj[key]
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
package main
|
||||
|
||||
# Deny all Kubernetes Ingress resources.
|
||||
# This cluster uses Gateway API (HTTPRoute + Gateway) for ingress routing.
|
||||
# Ingress is the legacy API and must not be added.
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Ingress"
|
||||
msg := sprintf(
|
||||
"%s/%s: Ingress resources are forbidden — use Gateway API HTTPRoute instead",
|
||||
[input.metadata.namespace, input.metadata.name],
|
||||
)
|
||||
}
|
||||
@@ -1,173 +0,0 @@
|
||||
package main
|
||||
|
||||
# Kubernetes normalizes resource quantity values on write. ArgoCD diffs by
|
||||
# string comparison, so a non-canonical value in git will always differ from
|
||||
# the live object, causing permanent OutOfSync.
|
||||
#
|
||||
# Rules enforced here:
|
||||
# CPU integers — k8s converts integer 1 to string "1" (see PR #163)
|
||||
# CPU milliCPU — k8s converts 1000m → "1", 2000m → "2", etc. (PR #164)
|
||||
# Memory Mi→Gi — k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc. (PR #163)
|
||||
# clusterIP null — k8s assigns a real IP; null in git always differs
|
||||
# from the live assigned value (see PR #166)
|
||||
|
||||
# ---- Container helpers ----
|
||||
# Extracts containers from Deployment/StatefulSet/DaemonSet/Job/CronJob/Pod
|
||||
|
||||
_containers contains c if { c := input.spec.template.spec.containers[_] }
|
||||
_containers contains c if { c := input.spec.template.spec.initContainers[_] }
|
||||
_containers contains c if { c := input.spec.containers[_] }
|
||||
_containers contains c if { c := input.spec.initContainers[_] }
|
||||
_containers contains c if { c := input.spec.jobTemplate.spec.template.spec.containers[_] }
|
||||
|
||||
# ---- CPU: must not be an integer ----
|
||||
# YAML `cpu: 1` (unquoted) parses as JSON integer; k8s stores as string "1".
|
||||
|
||||
deny contains msg if {
|
||||
c := _containers[_]
|
||||
cpu := c.resources.limits.cpu
|
||||
is_number(cpu)
|
||||
msg := sprintf(
|
||||
"%s container %q: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
|
||||
[input.kind, c.name, cpu, cpu],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
c := _containers[_]
|
||||
cpu := c.resources.requests.cpu
|
||||
is_number(cpu)
|
||||
msg := sprintf(
|
||||
"%s container %q: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
|
||||
[input.kind, c.name, cpu, cpu],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Cluster"
|
||||
cpu := input.spec.resources.limits.cpu
|
||||
is_number(cpu)
|
||||
msg := sprintf(
|
||||
"Cluster %s/%s: cpu limit %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name, cpu, cpu],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Cluster"
|
||||
cpu := input.spec.resources.requests.cpu
|
||||
is_number(cpu)
|
||||
msg := sprintf(
|
||||
"Cluster %s/%s: cpu request %v is an unquoted integer — use \"%v\" (string) to prevent ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name, cpu, cpu],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- CPU: milliCPU divisible by 1000 normalizes to a whole number ----
|
||||
# k8s converts 1000m → "1", 2000m → "2". Use the canonical whole-number form.
|
||||
|
||||
_milli_whole(cpu) := n if {
|
||||
is_string(cpu)
|
||||
endswith(cpu, "m")
|
||||
val := to_number(substring(cpu, 0, count(cpu) - 1))
|
||||
val % 1000 == 0
|
||||
val > 0
|
||||
n := val / 1000
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
c := _containers[_]
|
||||
n := _milli_whole(c.resources.limits.cpu)
|
||||
msg := sprintf(
|
||||
"%s container %q: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.kind, c.name, c.resources.limits.cpu, n],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
c := _containers[_]
|
||||
n := _milli_whole(c.resources.requests.cpu)
|
||||
msg := sprintf(
|
||||
"%s container %q: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.kind, c.name, c.resources.requests.cpu, n],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Cluster"
|
||||
n := _milli_whole(input.spec.resources.limits.cpu)
|
||||
msg := sprintf(
|
||||
"Cluster %s/%s: cpu limit %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name, input.spec.resources.limits.cpu, n],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Cluster"
|
||||
n := _milli_whole(input.spec.resources.requests.cpu)
|
||||
msg := sprintf(
|
||||
"Cluster %s/%s: cpu request %q normalizes to \"%v\" — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name, input.spec.resources.requests.cpu, n],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- Memory: Mi values divisible by 1024 normalize to Gi ----
|
||||
# k8s converts 1024Mi → 1Gi, 2048Mi → 2Gi, etc.
|
||||
|
||||
_mi_canonical(mem) := canonical if {
|
||||
endswith(mem, "Mi")
|
||||
val := to_number(substring(mem, 0, count(mem) - 2))
|
||||
val % 1024 == 0
|
||||
val > 0
|
||||
canonical := sprintf("%vGi", [val / 1024])
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
c := _containers[_]
|
||||
canonical := _mi_canonical(c.resources.limits.memory)
|
||||
msg := sprintf(
|
||||
"%s container %q: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.kind, c.name, c.resources.limits.memory, canonical],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
c := _containers[_]
|
||||
canonical := _mi_canonical(c.resources.requests.memory)
|
||||
msg := sprintf(
|
||||
"%s container %q: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.kind, c.name, c.resources.requests.memory, canonical],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Cluster"
|
||||
canonical := _mi_canonical(input.spec.resources.limits.memory)
|
||||
msg := sprintf(
|
||||
"Cluster %s/%s: memory limit %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name, input.spec.resources.limits.memory, canonical],
|
||||
)
|
||||
}
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Cluster"
|
||||
canonical := _mi_canonical(input.spec.resources.requests.memory)
|
||||
msg := sprintf(
|
||||
"Cluster %s/%s: memory request %q normalizes to %q — use canonical form to prevent ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name, input.spec.resources.requests.memory, canonical],
|
||||
)
|
||||
}
|
||||
|
||||
# ---- Service: clusterIP must not be null ----
|
||||
# k8s assigns a real IP on creation; clusterIP is immutable afterward.
|
||||
# Setting null in git means desired=null vs live=10.x.x.x → permanent OutOfSync.
|
||||
# Remove the field and let k8s own it.
|
||||
|
||||
deny contains msg if {
|
||||
input.kind == "Service"
|
||||
input.spec.clusterIP == null
|
||||
msg := sprintf(
|
||||
"Service %s/%s has 'clusterIP: null' — remove this field; Kubernetes assigns the IP on creation and it causes ArgoCD OutOfSync",
|
||||
[input.metadata.namespace, input.metadata.name],
|
||||
)
|
||||
}
|
||||
Reference in New Issue
Block a user