Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
da548a227c |
@@ -6,13 +6,3 @@ steps:
|
||||
image: git.unkin.net/unkin/almalinux9-kubetest:20260319
|
||||
commands:
|
||||
- make kubeconform
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
|
||||
@@ -6,13 +6,3 @@ steps:
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260308
|
||||
commands:
|
||||
- uvx pre-commit run --all-files
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1
|
||||
|
||||
@@ -19,8 +19,8 @@ spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: artifactapi
|
||||
image: git.unkin.net/unkin/artifactapi:v2.7.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
image: git.unkin.net/unkin/almalinux9-artifactapi:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
@@ -60,30 +60,10 @@ spec:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- mountPath: /etc/artifactapi/conf.d/config.yaml
|
||||
- mountPath: /app/remotes.yaml
|
||||
mountPropagation: None
|
||||
name: remotes-config
|
||||
subPath: config.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/local-generic.yaml
|
||||
name: remotes-config
|
||||
subPath: local-generic.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-alpine.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-docker.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-generic.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-helm.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
|
||||
name: remotes-config
|
||||
subPath: remote-rpm.yaml
|
||||
- mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
|
||||
name: remotes-config
|
||||
subPath: virtual-helm.yaml
|
||||
subPath: remotes.yaml
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- configMap:
|
||||
|
||||
@@ -5,7 +5,7 @@ metadata:
|
||||
name: artifactapi-env
|
||||
namespace: artifactapi
|
||||
data:
|
||||
CONFIG_PATH: /etc/artifactapi/conf.d/
|
||||
CONFIG_PATH: /app/remotes.yaml
|
||||
DBHOST: postgres-service
|
||||
DBNAME: artifacts
|
||||
DBPORT: "5432"
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: artifactapi
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: artifactapi-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: artifactapi-http-redirect
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: artifactapi
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
hostnames:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: artifactapi
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: artifactapi-api
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,32 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 10g
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
name: artifactapi-ingress
|
||||
namespace: artifactapi
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: artifactapi.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: artifactapi-api
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- artifactapi.k8s.syd1.au.unkin.net
|
||||
secretName: artifactapi-tls
|
||||
@@ -6,8 +6,7 @@ resources:
|
||||
- artifactapi-deployment.yaml
|
||||
- artifactapi-hpa.yaml
|
||||
- configmap.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
- namespace.yaml
|
||||
- postgres-deployment.yaml
|
||||
- pvc.yaml
|
||||
@@ -19,13 +18,6 @@ resources:
|
||||
configMapGenerator:
|
||||
- name: remotes-config
|
||||
files:
|
||||
- resources/conf.d/config.yaml
|
||||
- resources/conf.d/local-generic.yaml
|
||||
- resources/conf.d/remote-generic.yaml
|
||||
- resources/conf.d/remote-alpine.yaml
|
||||
- resources/conf.d/remote-rpm.yaml
|
||||
- resources/conf.d/remote-docker.yaml
|
||||
- resources/conf.d/remote-helm.yaml
|
||||
- resources/conf.d/virtual-helm.yaml
|
||||
- resources/remotes.yaml
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
# Global artifactapi configuration.
|
||||
# S3, Redis, and database connection settings are injected via environment variables.
|
||||
# Add any top-level overrides here if needed.
|
||||
@@ -1,7 +0,0 @@
|
||||
locals:
|
||||
local-generic:
|
||||
package: "generic"
|
||||
description: "Local generic file repository"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 0
|
||||
@@ -1,10 +0,0 @@
|
||||
remotes:
|
||||
alpine:
|
||||
base_url: "https://dl-cdn.alpinelinux.org"
|
||||
package: "alpine"
|
||||
description: "Alpine Linux APK package repository"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.apk$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
@@ -1,103 +0,0 @@
|
||||
remotes:
|
||||
ghcr:
|
||||
base_url: "https://ghcr.io"
|
||||
package: "docker"
|
||||
description: "GitHub Container Registry"
|
||||
immutable_patterns:
|
||||
- "^cloudnative-pg/cloudnative-pg"
|
||||
- "^emberstack/helm-charts"
|
||||
- "^open-webui/open-webui"
|
||||
- "^openvoxproject/"
|
||||
- "^stakater/reloader"
|
||||
- "^stalwartlabs/stalwart"
|
||||
- "^voxpupuli/puppetboard"
|
||||
- "^woodpecker-ci/helm"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
dockerhub:
|
||||
base_url: "https://registry-1.docker.io"
|
||||
package: "docker"
|
||||
description: "Docker Hub registry"
|
||||
immutable_patterns:
|
||||
- "^library/almalinux"
|
||||
- "^library/busybox"
|
||||
- "^library/debian"
|
||||
- "^library/fedora"
|
||||
- "^library/nginx"
|
||||
- "^library/postgres"
|
||||
- "^library/redis"
|
||||
- "^beats/filebeat"
|
||||
- "^bitnami/"
|
||||
- "^curlimages/curl"
|
||||
- "^emberstack/kubernetes-reflector"
|
||||
- "^hashicorp/consul"
|
||||
- "^hashicorp/vault"
|
||||
- "^jfrog/"
|
||||
- "^kanidm/"
|
||||
- "^rancher/"
|
||||
- "^rspamd/rspamd"
|
||||
- "^tozd/postfix"
|
||||
- "^traefik/"
|
||||
- "^valkey/valkey"
|
||||
- "^ubi9/ubi-minimal"
|
||||
- "^victoriametrics/"
|
||||
- "^woodpeckerci/"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
quay:
|
||||
base_url: "https://quay.io"
|
||||
package: "docker"
|
||||
description: "Quay.io container registry"
|
||||
immutable_patterns:
|
||||
- "^brancz/kube-rbac-proxy"
|
||||
- "^cephcsi/cephcsi"
|
||||
- "^jetstack/cert-manager-"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
k8s-registry:
|
||||
base_url: "https://registry.k8s.io"
|
||||
package: "docker"
|
||||
description: "Kubernetes container registry"
|
||||
immutable_patterns:
|
||||
- "^external-dns/external-dns"
|
||||
- "^sig-storage/"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
gitlab:
|
||||
base_url: "https://registry.gitlab.com"
|
||||
package: "docker"
|
||||
description: "GitLab container registry"
|
||||
immutable_patterns:
|
||||
- "^purelb/purelb"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
elastic:
|
||||
base_url: "https://docker.elastic.co"
|
||||
package: "docker"
|
||||
description: "Elastic container registry"
|
||||
immutable_patterns:
|
||||
- "^eck/eck-operator"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
|
||||
gcr:
|
||||
base_url: "https://gcr.io"
|
||||
package: "docker"
|
||||
description: "Google Container Registry"
|
||||
immutable_patterns:
|
||||
- "^k8s-staging-nfd/charts"
|
||||
- "^k8s-staging-nfd/node-feature-discovery"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 300
|
||||
@@ -1,132 +0,0 @@
|
||||
remotes:
|
||||
github:
|
||||
base_url: "https://github.com"
|
||||
package: "generic"
|
||||
description: "GitHub releases and files"
|
||||
mutable_patterns:
|
||||
- ".*/archive/refs/heads/.*.tar.gz$"
|
||||
- "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
|
||||
immutable_patterns:
|
||||
- ".*/archive/refs/tags/.*.tar.gz$"
|
||||
- "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
|
||||
- "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
|
||||
- "apple/foundationdb/.*/libfdb_c.x86_64.so$"
|
||||
- "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
|
||||
- "coder/code-server/.*/code-server-.*-amd64.rpm$"
|
||||
- "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
|
||||
- "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
|
||||
- "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
|
||||
- "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
|
||||
- "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
|
||||
- "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
|
||||
- "hadolint/hadolint/.*/hadolint-linux-x86_64$"
|
||||
- "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
|
||||
- "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
|
||||
- "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
|
||||
- "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
|
||||
- "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
|
||||
- "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
|
||||
- "lxc/incus/.*.tar.gz$"
|
||||
- "mikefarah/yq/.*/yq_linux_amd64$"
|
||||
- "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
|
||||
- "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
|
||||
- "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
|
||||
- "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
|
||||
- "open-policy-agent/conftest/.*/conftest_.*_Linux_x86_64.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
|
||||
- "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
|
||||
- "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
|
||||
- "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
|
||||
- "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
|
||||
- "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
github_user:
|
||||
base_url: "https://raw.githubusercontent.com"
|
||||
package: "generic"
|
||||
description: "GitHub User Content"
|
||||
immutable_patterns:
|
||||
- "argoproj/argo-cd/.*.yaml$"
|
||||
- "yannh/kubernetes-json-schema/master/.*.json$"
|
||||
- "datreeio/CRDs-catalog/main/.*.json$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
gitea-dl:
|
||||
base_url: "https://dl.gitea.com"
|
||||
package: "generic"
|
||||
description: "Gitea download site"
|
||||
immutable_patterns:
|
||||
- "act_runner/.*/act_runner-.*-linux-amd64$"
|
||||
- "tea/.*/tea-.*-linux-amd64$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
hashicorp-releases:
|
||||
base_url: "https://releases.hashicorp.com"
|
||||
package: "generic"
|
||||
description: "HashiCorp product releases"
|
||||
immutable_patterns:
|
||||
- "terraform/.*terraform_.*_linux_amd64\\.zip$"
|
||||
- "terraform/.*terraform_.*_windows_amd64\\.zip$"
|
||||
- "terraform/.*terraform_.*_darwin_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_linux_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_windows_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_darwin_amd64\\.zip$"
|
||||
- "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
|
||||
- "consul/.*/consul_.*_linux_amd64\\.zip$"
|
||||
- "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
|
||||
- "nomad/.*/nomad_.*_linux_amd64\\.zip$"
|
||||
- "packer/.*/packer_.*_linux_amd64\\.zip$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
rarlab:
|
||||
base_url: "https://www.rarlab.com"
|
||||
package: "generic"
|
||||
description: "RARLab"
|
||||
immutable_patterns:
|
||||
- "rar/rarlinux-x64-.*.tar.gz"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
claude-ai:
|
||||
base_url: "https://downloads.claude.ai"
|
||||
package: "generic"
|
||||
description: "Anthropic Claude Code binary releases"
|
||||
mutable_patterns:
|
||||
- "claude-code-releases/.*/manifest.json$"
|
||||
immutable_patterns:
|
||||
- "claude-code-releases/.*/linux-x64/claude$"
|
||||
- "claude-code-releases/.*/linux-arm64/claude$"
|
||||
- "claude-code-releases/.*/linux-x64-musl/claude$"
|
||||
- "claude-code-releases/.*/linux-arm64-musl/claude$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
@@ -1,143 +0,0 @@
|
||||
remotes:
|
||||
ceph-csi:
|
||||
base_url: "https://ceph.github.io/csi-charts"
|
||||
package: "helm"
|
||||
description: "Ceph CSI driver Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
cnpg:
|
||||
base_url: "https://cloudnative-pg.github.io/charts"
|
||||
package: "helm"
|
||||
description: "CloudNativePG operator Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
elastic-helm:
|
||||
base_url: "https://helm.elastic.co"
|
||||
package: "helm"
|
||||
description: "Elastic stack Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
external-dns:
|
||||
base_url: "https://kubernetes-sigs.github.io/external-dns/"
|
||||
package: "helm"
|
||||
description: "ExternalDNS Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
hashicorp-helm:
|
||||
base_url: "https://helm.releases.hashicorp.com"
|
||||
package: "helm"
|
||||
description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
intel-helm:
|
||||
base_url: "https://intel.github.io/helm-charts/"
|
||||
package: "helm"
|
||||
description: "Intel Helm charts (device plugins)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
jetstack:
|
||||
base_url: "https://charts.jetstack.io"
|
||||
package: "helm"
|
||||
description: "Jetstack Helm charts (cert-manager)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
purelb:
|
||||
base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
|
||||
package: "helm"
|
||||
description: "PureLB load balancer Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
rancher-stable:
|
||||
base_url: "https://releases.rancher.com/server-charts/stable"
|
||||
package: "helm"
|
||||
description: "Rancher stable Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
stakater:
|
||||
base_url: "https://stakater.github.io/stakater-charts"
|
||||
package: "helm"
|
||||
description: "Stakater Helm charts (Reloader)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
traefik:
|
||||
base_url: "https://traefik.github.io/charts"
|
||||
package: "helm"
|
||||
description: "Traefik Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
victoriametrics:
|
||||
base_url: "https://victoriametrics.github.io/helm-charts/"
|
||||
package: "helm"
|
||||
description: "VictoriaMetrics observability Helm charts"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
|
||||
argo-helm:
|
||||
base_url: "https://argoproj.github.io/argo-helm"
|
||||
package: "helm"
|
||||
description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
|
||||
check_mutable_updates: true
|
||||
immutable_patterns:
|
||||
- "\\.tgz$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 3600
|
||||
@@ -1,154 +0,0 @@
|
||||
remotes:
|
||||
almalinux:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/almalinux"
|
||||
package: "rpm"
|
||||
description: "AlmaLinux RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.sqlite.*$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/repodata/.*\\.yaml.*$"
|
||||
- ".*/install.img"
|
||||
- ".*/squashfs.img"
|
||||
- ".*/updates.img"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
ceph-reef:
|
||||
base_url: "https://download.ceph.com/rpm-reef/"
|
||||
package: "rpm"
|
||||
description: "Ceph Reef 18"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
ceph-squid:
|
||||
base_url: "https://download.ceph.com/rpm-squid/"
|
||||
package: "rpm"
|
||||
description: "Ceph Squid 19"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
ceph-tentacle:
|
||||
base_url: "https://download.ceph.com/rpm-tentacle/"
|
||||
package: "rpm"
|
||||
description: "Ceph Tentacle 20"
|
||||
immutable_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
epel:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/epel"
|
||||
package: "rpm"
|
||||
description: "EPEL (Extra Packages for Enterprise Linux)"
|
||||
immutable_patterns:
|
||||
- ".*/Everything/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.sqlite.*$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/repodata/.*\\.yaml.*$"
|
||||
- "RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
fedora:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
|
||||
package: "rpm"
|
||||
description: "Fedora Linux RPM package repository"
|
||||
immutable_patterns:
|
||||
- "releases/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- "updates/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- "development/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
frr:
|
||||
base_url: "https://rpm.frrouting.org/repo"
|
||||
package: "rpm"
|
||||
description: "FRR RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
mariadb:
|
||||
base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
|
||||
package: "rpm"
|
||||
description: "MariaDB RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
openvox:
|
||||
base_url: "https://yum.voxpupuli.org"
|
||||
package: "rpm"
|
||||
description: "OpenVox RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- "GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
postgresql:
|
||||
base_url: "https://download.postgresql.org/pub/repos/yum"
|
||||
package: "rpm"
|
||||
description: "PostgreSQL RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
- ".*/PGDG-RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
rke2:
|
||||
base_url: "https://rpm.rancher.io"
|
||||
package: "rpm"
|
||||
description: "RKE2 RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- "public.key$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
|
||||
zfs:
|
||||
base_url: "http://download.zfsonlinux.org"
|
||||
package: "rpm"
|
||||
description: "ZFS RPM package repository"
|
||||
immutable_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
immutable_ttl: 0
|
||||
mutable_ttl: 7200
|
||||
@@ -1,18 +0,0 @@
|
||||
virtuals:
|
||||
helm:
|
||||
package: "helm"
|
||||
description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
|
||||
members:
|
||||
- ceph-csi
|
||||
- cnpg
|
||||
- elastic-helm
|
||||
- external-dns
|
||||
- hashicorp-helm
|
||||
- intel-helm
|
||||
- jetstack
|
||||
- purelb
|
||||
- rancher-stable
|
||||
- stakater
|
||||
- traefik
|
||||
- victoriametrics
|
||||
- argo-helm
|
||||
@@ -0,0 +1,286 @@
|
||||
remotes:
|
||||
github:
|
||||
base_url: "https://github.com"
|
||||
type: "remote"
|
||||
package: "generic"
|
||||
description: "GitHub releases and files"
|
||||
include_patterns:
|
||||
- "apple/foundationdb/.*/libfdb_c.x86_64.so$"
|
||||
- "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
|
||||
- "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
|
||||
- "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
|
||||
- "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
|
||||
- "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
|
||||
- "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
|
||||
- "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
|
||||
- "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
|
||||
- "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
|
||||
- "lxc/incus/.*.tar.gz$"
|
||||
- "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
|
||||
- "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
|
||||
- "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
|
||||
- "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
|
||||
- "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
|
||||
- "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
|
||||
- "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
|
||||
- "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 0
|
||||
|
||||
github_user:
|
||||
base_url: "https://raw.githubusercontent.com"
|
||||
type: "remote"
|
||||
package: "generic"
|
||||
description: "GitHub User Content"
|
||||
include_patterns:
|
||||
- "argoproj/argo-cd/.*.yaml$"
|
||||
- "yannh/kubernetes-json-schema/master/.*.json$"
|
||||
- "datreeio/CRDs-catalog/main/.*.json$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 0
|
||||
|
||||
gitea-dl:
|
||||
base_url: "https://dl.gitea.com"
|
||||
type: "remote"
|
||||
package: "generic"
|
||||
description: "Gitea download site"
|
||||
include_patterns:
|
||||
- "act_runner/.*/act_runner-.*-linux-amd64$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 0
|
||||
|
||||
hashicorp-releases:
|
||||
base_url: "https://releases.hashicorp.com"
|
||||
type: "remote"
|
||||
package: "generic"
|
||||
description: "HashiCorp product releases"
|
||||
include_patterns:
|
||||
- "terraform/.*terraform_.*_linux_amd64\\.zip$"
|
||||
- "terraform/.*terraform_.*_windows_amd64\\.zip$"
|
||||
- "terraform/.*terraform_.*_darwin_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_linux_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_windows_amd64\\.zip$"
|
||||
- "vault/.*vault_.*_darwin_amd64\\.zip$"
|
||||
- "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
|
||||
- "consul/.*/consul_.*_linux_amd64\\.zip$"
|
||||
- "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
|
||||
- "nomad/.*/nomad_.*_linux_amd64\\.zip$"
|
||||
- "packer/.*/packer_.*_linux_amd64\\.zip$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 0
|
||||
|
||||
rarlab:
|
||||
base_url: "https://www.rarlab.com"
|
||||
type: "remote"
|
||||
package: "generic"
|
||||
description: "RARLab"
|
||||
include_patterns:
|
||||
- "rar/rarlinux-x64-.*.tar.gz"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 0
|
||||
|
||||
alpine:
|
||||
base_url: "https://dl-cdn.alpinelinux.org"
|
||||
type: "remote"
|
||||
package: "alpine"
|
||||
description: "Alpine Linux APK package repository"
|
||||
include_patterns:
|
||||
- ".*/x86_64/.*\\.apk$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
almalinux:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/almalinux"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "AlmaLinux RPM package repository"
|
||||
include_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.sqlite.*$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/repodata/.*\\.yaml.*$"
|
||||
- ".*/install.img"
|
||||
- ".*/squashfs.img"
|
||||
- ".*/updates.img"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
ceph-reef:
|
||||
base_url: "https://download.ceph.com/rpm-reef/"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "Ceph Reef 18"
|
||||
include_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
ceph-squid:
|
||||
base_url: "https://download.ceph.com/rpm-squid/"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "Ceph Squid 19"
|
||||
include_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
ceph-tentacle:
|
||||
base_url: "https://download.ceph.com/rpm-tentacle/"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "Ceph Tentacle 20"
|
||||
include_patterns:
|
||||
- ".*/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
epel:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/epel"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "EPEL (Extra Packages for Enterprise Linux)"
|
||||
include_patterns:
|
||||
- ".*/Everything/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.sqlite.*$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/repodata/.*\\.yaml.*$"
|
||||
- "RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
fedora:
|
||||
base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "Fedora Linux RPM package repository"
|
||||
include_patterns:
|
||||
- "releases/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- "updates/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- "development/.*/Everything/x86_64/.*\\.rpm$"
|
||||
- ".*/noarch/.*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
frr:
|
||||
base_url: "https://rpm.frrouting.org/repo"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "FRR RPM package repository"
|
||||
include_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
mariadb:
|
||||
base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "MariaDB RPM package repository"
|
||||
include_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
openvox:
|
||||
base_url: "https://yum.voxpupuli.org"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "OpenVox RPM package repository"
|
||||
include_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- "GPG-KEY-.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
postgresql:
|
||||
base_url: "https://download.postgresql.org/pub/repos/yum"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "PostgreSQL RPM package repository"
|
||||
include_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- ".*/RPM-GPG-KEY-.*$"
|
||||
- ".*/PGDG-RPM-GPG-KEY-.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
rke2:
|
||||
base_url: "https://rpm.rancher.io"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "RKE2 RPM package repository"
|
||||
include_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
- "public.key$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
zfs:
|
||||
base_url: "http://download.zfsonlinux.org"
|
||||
type: "remote"
|
||||
package: "rpm"
|
||||
description: "ZFS RPM package repository"
|
||||
include_patterns:
|
||||
- ".*\\.rpm$"
|
||||
- ".*/repodata/.*\\.xml.*$"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 7200
|
||||
|
||||
|
||||
local-generic:
|
||||
type: "local"
|
||||
package: "generic"
|
||||
description: "Local generic file repository"
|
||||
cache:
|
||||
file_ttl: 0
|
||||
index_ttl: 0
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: "198.18.200.4"
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: rancher.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: rancher.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: rancher-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: rancher-http-redirect
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
hostnames:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: rancher
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
spec:
|
||||
hostnames:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: rancher
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: rancher
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: rancher
|
||||
namespace: cattle-system
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: "198.18.200.0"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- rancher.k8s.syd1.au.unkin.net
|
||||
secretName: rancher-tls
|
||||
rules:
|
||||
- host: rancher.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: rancher
|
||||
port:
|
||||
number: 80
|
||||
@@ -6,5 +6,4 @@ resources:
|
||||
- namespace.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- ingress.yaml
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: consul
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
cert-manager.io/alt-names: consul.service.consul
|
||||
external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
hostname: consul.k8s.syd1.au.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: consul.k8s.syd1.au.unkin.net
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: consul-tls
|
||||
- name: consul-svc
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: consul.service.consul
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: consul-tls
|
||||
@@ -1,83 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: consul-http-redirect
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
spec:
|
||||
hostnames:
|
||||
- consul.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: consul
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
spec:
|
||||
hostnames:
|
||||
- consul.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: consul-ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: consul-svc
|
||||
namespace: consul
|
||||
labels:
|
||||
app.kubernetes.io/name: consul
|
||||
app.kubernetes.io/instance: consul
|
||||
spec:
|
||||
hostnames:
|
||||
- consul.service.consul
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: consul
|
||||
sectionName: consul-svc
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: consul-ui
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,8 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: consul
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: elastic-system
|
||||
name: elastic-system
|
||||
@@ -7,12 +7,11 @@ resources:
|
||||
|
||||
helmCharts:
|
||||
- name: intel-device-plugins-operator
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
version: "0.35.0"
|
||||
repo: https://intel.github.io/helm-charts/
|
||||
releaseName: intel-device-plugins-operator
|
||||
namespace: inteldeviceplugins-system
|
||||
- name: intel-device-plugins-gpu
|
||||
repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
|
||||
repo: https://intel.github.io/helm-charts/
|
||||
version: "0.34.1"
|
||||
releaseName: intel-gpu-plugin
|
||||
namespace: inteldeviceplugins-system
|
||||
|
||||
@@ -2,4 +2,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: vault
|
||||
name: jfrog
|
||||
@@ -1,51 +0,0 @@
|
||||
# kanidm
|
||||
|
||||
Three-replica kanidm identity server with Vault-managed replication certificates.
|
||||
|
||||
## Architecture
|
||||
|
||||
- Per-pod `server-N.toml` in `resources/` — each has its own replication origin hardcoded
|
||||
- `config-init` busybox init container copies the right config and injects peer certs from the
|
||||
vault-synced `kanidm-repl-certs` Secret at pod startup
|
||||
- `reloader.stakater.com/auto: "true"` triggers a rolling restart when the ConfigMap or Secret changes
|
||||
- Vault path: `kv/kubernetes/namespace/kanidm/default/repl-certs`
|
||||
- Keys: `kanidm-0`, `kanidm-1`, `kanidm-2` — each holds that pod's replication certificate
|
||||
|
||||
## Initial setup
|
||||
|
||||
After the first pod starts, generate the admin credentials:
|
||||
|
||||
```bash
|
||||
kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml admin
|
||||
kubectl exec -n kanidm kanidm-0 -- /sbin/kanidmd recover-account -c /config/server.toml idm_admin
|
||||
```
|
||||
|
||||
## Replication certificate rotation
|
||||
|
||||
When certs need to be renewed, update vault and reloader will roll the StatefulSet:
|
||||
|
||||
```bash
|
||||
# Get new cert from a pod
|
||||
kubectl exec -it -n kanidm kanidm-N -- /sbin/kanidmd renew-replication-certificate -c /config/server.toml
|
||||
|
||||
# Write updated cert to vault (reloader triggers restart automatically)
|
||||
vault kv patch kv/kubernetes/namespace/kanidm/default/repl-certs "kanidm-N=<cert>"
|
||||
```
|
||||
|
||||
## Resolving domain UUID mismatch
|
||||
|
||||
If pods initialized independently (each with a different domain UUID), replication will fail with
|
||||
`Consumer Domain UUID does not match`. Fix by resetting kanidm-1 and kanidm-2 to sync from
|
||||
kanidm-0 (the authoritative node):
|
||||
|
||||
```bash
|
||||
# Scale down to avoid split-brain during reset
|
||||
kubectl scale statefulset -n kanidm kanidm --replicas=1
|
||||
|
||||
# Delete the stale PVCs for the replica pods
|
||||
kubectl delete pvc -n kanidm data-kanidm-1 data-kanidm-2
|
||||
|
||||
# Scale back up — replicas start with empty DBs and automatic_refresh=true
|
||||
# will trigger a full sync from kanidm-0 once TLS peer certs are verified
|
||||
kubectl scale statefulset -n kanidm kanidm --replicas=3
|
||||
```
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: kanidm-tls
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
secretName: kanidm-tls
|
||||
issuerRef:
|
||||
kind: ClusterIssuer
|
||||
name: vault-issuer
|
||||
commonName: auth.unkin.net
|
||||
dnsNames:
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
- kanidm.k8s.syd1.au.unkin.net
|
||||
- kanidm.kanidm.svc.cluster.local
|
||||
- kanidm-0.kanidm-headless.kanidm.svc.cluster.local
|
||||
- kanidm-1.kanidm-headless.kanidm.svc.cluster.local
|
||||
- kanidm-2.kanidm-headless.kanidm.svc.cluster.local
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/hostname: kanidm.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
- name: https-passthrough
|
||||
port: 443
|
||||
protocol: TLS
|
||||
tls:
|
||||
mode: Passthrough
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: kanidm-http-redirect
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
hostnames:
|
||||
- kanidm.k8s.syd1.au.unkin.net
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: kanidm
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- serviceaccount.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- certificate.yaml
|
||||
- service.yaml
|
||||
- statefulset.yaml
|
||||
- poddisruptionbudget.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- tlsroute.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: kanidm-config
|
||||
namespace: kanidm
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
files:
|
||||
- server-0.toml=resources/server-0.toml
|
||||
- server-1.toml=resources/server-1.toml
|
||||
- server-2.toml=resources/server-2.toml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kanidm
|
||||
@@ -1,15 +0,0 @@
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: kanidm-repl
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods/exec"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["kanidm-repl-certs"]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: kanidm-repl
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: kanidm-repl
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -1,19 +0,0 @@
|
||||
version = "2"
|
||||
|
||||
domain = "auth.unkin.net"
|
||||
origin = "https://auth.unkin.net"
|
||||
bindaddress = "[::]:8443"
|
||||
db_path = "/data/kanidm.db"
|
||||
db_arc_size = 2048
|
||||
tls_chain = "/data/tls/tls.crt"
|
||||
tls_key = "/data/tls/tls.key"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "0 22 * * *"
|
||||
versions = 7
|
||||
|
||||
[replication]
|
||||
origin = "repl://kanidm-0.kanidm-headless.kanidm.svc.cluster.local:8444"
|
||||
bindaddress = "[::]:8444"
|
||||
@@ -1,19 +0,0 @@
|
||||
version = "2"
|
||||
|
||||
domain = "auth.unkin.net"
|
||||
origin = "https://auth.unkin.net"
|
||||
bindaddress = "[::]:8443"
|
||||
db_path = "/data/kanidm.db"
|
||||
db_arc_size = 2048
|
||||
tls_chain = "/data/tls/tls.crt"
|
||||
tls_key = "/data/tls/tls.key"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "0 22 * * *"
|
||||
versions = 7
|
||||
|
||||
[replication]
|
||||
origin = "repl://kanidm-1.kanidm-headless.kanidm.svc.cluster.local:8444"
|
||||
bindaddress = "[::]:8444"
|
||||
@@ -1,19 +0,0 @@
|
||||
version = "2"
|
||||
|
||||
domain = "auth.unkin.net"
|
||||
origin = "https://auth.unkin.net"
|
||||
bindaddress = "[::]:8443"
|
||||
db_path = "/data/kanidm.db"
|
||||
db_arc_size = 2048
|
||||
tls_chain = "/data/tls/tls.crt"
|
||||
tls_key = "/data/tls/tls.key"
|
||||
log_level = "info"
|
||||
|
||||
[online_backup]
|
||||
path = "/data/backups/"
|
||||
schedule = "0 22 * * *"
|
||||
versions = 7
|
||||
|
||||
[replication]
|
||||
origin = "repl://kanidm-2.kanidm-headless.kanidm.svc.cluster.local:8444"
|
||||
bindaddress = "[::]:8444"
|
||||
@@ -1,43 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: kanidm-headless
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
- name: replication
|
||||
port: 8444
|
||||
targetPort: replication
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
@@ -1,133 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
serviceName: kanidm-headless
|
||||
replicas: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
serviceAccountName: kanidm
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
topologyKey: kubernetes.io/hostname
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: config-init
|
||||
image: busybox:1.36
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
cp "/config-template/server-${POD_NAME##*-}.toml" /config/server.toml
|
||||
for peer in kanidm-0 kanidm-1 kanidm-2; do
|
||||
[ "${peer}" = "${POD_NAME}" ] && continue
|
||||
cert_file="/repl-certs/${peer}"
|
||||
[ -s "${cert_file}" ] || continue
|
||||
fqdn="${peer}.kanidm-headless.kanidm.svc.cluster.local"
|
||||
printf '\n[replication."repl://%s:8444"]\ntype = "mutual-pull"\npartner_cert = "%s"\n' \
|
||||
"${fqdn}" "$(cat ${cert_file})" >> /config/server.toml
|
||||
done
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
volumeMounts:
|
||||
- name: config-template
|
||||
mountPath: /config-template
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: repl-certs
|
||||
mountPath: /repl-certs
|
||||
readOnly: true
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
containers:
|
||||
- name: kanidm
|
||||
image: kanidm/server:1.10.3
|
||||
command: ["/sbin/kanidmd"]
|
||||
args: ["server", "-c", "/config/server.toml"]
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
- name: replication
|
||||
containerPort: 8444
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: tls
|
||||
mountPath: /data/tls
|
||||
readOnly: true
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 8443
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 8443
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
volumes:
|
||||
- name: config-template
|
||||
configMap:
|
||||
name: kanidm-config
|
||||
- name: config
|
||||
emptyDir: {}
|
||||
- name: repl-certs
|
||||
secret:
|
||||
secretName: kanidm-repl-certs
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: kanidm-tls
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
storageClassName: cephrbd-fast-delete
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -1,26 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: TLSRoute
|
||||
metadata:
|
||||
name: kanidm
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
hostnames:
|
||||
- kanidm.k8s.syd1.au.unkin.net
|
||||
- auth.unkin.net
|
||||
- au.auth.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: kanidm
|
||||
sectionName: https-passthrough
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: kanidm
|
||||
port: 8443
|
||||
weight: 1
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: kanidm
|
||||
spec:
|
||||
allowedNamespaces:
|
||||
- kanidm
|
||||
kubernetes:
|
||||
audiences:
|
||||
- vault
|
||||
role: default
|
||||
serviceAccount: default
|
||||
tokenExpirationSeconds: 600
|
||||
method: kubernetes
|
||||
mount: k8s/au/syd1
|
||||
vaultConnectionRef: vso-system/default
|
||||
@@ -1,20 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: repl-certs
|
||||
namespace: kanidm
|
||||
labels:
|
||||
app.kubernetes.io/name: kanidm
|
||||
app.kubernetes.io/instance: kanidm
|
||||
spec:
|
||||
vaultAuthRef: default
|
||||
mount: kv
|
||||
type: kv-v2
|
||||
path: kubernetes/namespace/kanidm/default/repl-certs
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: kanidm-repl-certs
|
||||
create: true
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
@@ -1,91 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: litellm-postgres
|
||||
namespace: litellm
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinityType: preferred
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: litellm
|
||||
encoding: UTF8
|
||||
localeCType: C
|
||||
localeCollate: C
|
||||
owner: litellm
|
||||
secret:
|
||||
name: postgres-credentials
|
||||
enablePDB: true
|
||||
enableSuperuserAccess: false
|
||||
failoverDelay: 0
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
|
||||
instances: 3
|
||||
logLevel: info
|
||||
maxSyncReplicas: 0
|
||||
minSyncReplicas: 0
|
||||
monitoring:
|
||||
customQueriesConfigMap:
|
||||
- key: queries
|
||||
name: cnpg-default-monitoring
|
||||
disableDefaultQueries: false
|
||||
enablePodMonitor: false
|
||||
postgresql:
|
||||
parameters:
|
||||
archive_mode: "on"
|
||||
archive_timeout: 5min
|
||||
dynamic_shared_memory_type: posix
|
||||
effective_cache_size: 256MB
|
||||
full_page_writes: "on"
|
||||
log_destination: csvlog
|
||||
log_directory: /controller/log
|
||||
log_filename: postgres
|
||||
log_rotation_age: "0"
|
||||
log_rotation_size: "0"
|
||||
log_truncate_on_rotation: "false"
|
||||
logging_collector: "on"
|
||||
max_connections: "200"
|
||||
max_parallel_workers: "16"
|
||||
max_replication_slots: "16"
|
||||
max_worker_processes: "16"
|
||||
shared_buffers: 128MB
|
||||
shared_memory_type: mmap
|
||||
ssl_max_protocol_version: TLSv1.3
|
||||
ssl_min_protocol_version: TLSv1.3
|
||||
wal_keep_size: 256MB
|
||||
wal_level: logical
|
||||
wal_log_hints: "on"
|
||||
wal_receiver_timeout: 5s
|
||||
wal_sender_timeout: 5s
|
||||
syncReplicaElectionConstraint:
|
||||
enabled: false
|
||||
primaryUpdateMethod: restart
|
||||
primaryUpdateStrategy: unsupervised
|
||||
probes:
|
||||
liveness:
|
||||
isolationCheck:
|
||||
connectionTimeout: 1000
|
||||
enabled: true
|
||||
requestTimeout: 1000
|
||||
replicationSlots:
|
||||
highAvailability:
|
||||
enabled: true
|
||||
slotPrefix: _cnpg_
|
||||
synchronizeReplicas:
|
||||
enabled: true
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
smartShutdownTimeout: 180
|
||||
startDelay: 3600
|
||||
stopDelay: 1800
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 10Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
switchoverDelay: 3600
|
||||
@@ -1,33 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Pooler
|
||||
metadata:
|
||||
name: litellm-postgres-pooler
|
||||
namespace: litellm
|
||||
spec:
|
||||
cluster:
|
||||
name: litellm-postgres
|
||||
instances: 2
|
||||
pgbouncer:
|
||||
parameters:
|
||||
default_pool_size: "100"
|
||||
max_client_conn: "400"
|
||||
paused: false
|
||||
poolMode: session
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pooler
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- pooler
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: rw
|
||||
@@ -1,71 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: litellm
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
labels:
|
||||
app: litellm
|
||||
spec:
|
||||
containers:
|
||||
- name: litellm
|
||||
image: docker.litellm.ai/berriai/litellm-database:main-stable
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
- --config
|
||||
- /app/config.yaml
|
||||
- --port
|
||||
- "4000"
|
||||
- --num_workers
|
||||
- "8"
|
||||
ports:
|
||||
- containerPort: 4000
|
||||
name: http
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: litellm-credentials
|
||||
- configMapRef:
|
||||
name: litellm-env
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health/liveliness
|
||||
port: 4000
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health/readiness
|
||||
port: 4000
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: "2"
|
||||
memory: 8Gi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 6Gi
|
||||
volumeMounts:
|
||||
- mountPath: /app/config.yaml
|
||||
name: config
|
||||
subPath: config.yaml
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: litellm-config
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: litellm.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: litellm.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: litellm-tls
|
||||
mode: Terminate
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: litellm-hpa
|
||||
namespace: litellm
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: litellm
|
||||
minReplicas: 2
|
||||
maxReplicas: 4
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 80
|
||||
behavior:
|
||||
scaleUp:
|
||||
stabilizationWindowSeconds: 0
|
||||
selectPolicy: Max
|
||||
policies:
|
||||
- type: Percent
|
||||
value: 100
|
||||
periodSeconds: 60
|
||||
- type: Pods
|
||||
value: 4
|
||||
periodSeconds: 30
|
||||
scaleDown:
|
||||
stabilizationWindowSeconds: 300
|
||||
selectPolicy: Min
|
||||
policies:
|
||||
- type: Percent
|
||||
value: 30
|
||||
periodSeconds: 60
|
||||
- type: Pods
|
||||
value: 2
|
||||
periodSeconds: 60
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: litellm-http-redirect
|
||||
namespace: litellm
|
||||
spec:
|
||||
hostnames:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: litellm
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
hostnames:
|
||||
- litellm.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: litellm
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: litellm
|
||||
port: 4000
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,29 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- deployment.yaml
|
||||
- hpa.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- namespace.yaml
|
||||
- redis-deployment.yaml
|
||||
- redis-pvc.yaml
|
||||
- services.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: litellm-config
|
||||
files:
|
||||
- config.yaml=resources/config.yaml
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: litellm-env
|
||||
literals:
|
||||
- STORE_MODEL_IN_DB=True
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: litellm
|
||||
@@ -1,67 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: litellm
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:7-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- redis-server
|
||||
- --save
|
||||
- "20"
|
||||
- "1"
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
name: redis
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- redis-cli
|
||||
- ping
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- redis-cli
|
||||
- ping
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
mountPropagation: None
|
||||
name: data
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: litellm-redis-data
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: litellm-redis-data
|
||||
namespace: litellm
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: cephrbd-fast-delete
|
||||
volumeMode: Filesystem
|
||||
@@ -1,15 +0,0 @@
|
||||
model_list: []
|
||||
|
||||
router_settings:
|
||||
redis_host: redis-service
|
||||
redis_port: 6379
|
||||
|
||||
general_settings:
|
||||
use_redis_transaction_buffer: true
|
||||
|
||||
litellm_settings:
|
||||
cache: true
|
||||
cache_params:
|
||||
type: redis
|
||||
host: redis-service
|
||||
port: 6379
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: litellm
|
||||
namespace: litellm
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 4000
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: litellm
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis-service
|
||||
namespace: litellm
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: redis
|
||||
port: 6379
|
||||
protocol: TCP
|
||||
targetPort: redis
|
||||
selector:
|
||||
app: redis
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: litellm
|
||||
spec:
|
||||
allowedNamespaces:
|
||||
- litellm
|
||||
kubernetes:
|
||||
audiences:
|
||||
- vault
|
||||
role: default
|
||||
serviceAccount: default
|
||||
tokenExpirationSeconds: 600
|
||||
method: kubernetes
|
||||
mount: k8s/au/syd1
|
||||
vaultConnectionRef: vso-system/default
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: postgres-credentials
|
||||
namespace: litellm
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: postgres-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/litellm/default/postgres-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: litellm-credentials
|
||||
namespace: litellm
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: litellm-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/litellm/default/litellm-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- namespace.yaml
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: observability
|
||||
name: observability
|
||||
@@ -1,91 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: paperclip-postgres
|
||||
namespace: paperclip
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinityType: preferred
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: paperclip
|
||||
encoding: UTF8
|
||||
localeCType: C
|
||||
localeCollate: C
|
||||
owner: paperclip
|
||||
secret:
|
||||
name: postgres-credentials
|
||||
enablePDB: true
|
||||
enableSuperuserAccess: false
|
||||
failoverDelay: 0
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
|
||||
instances: 3
|
||||
logLevel: info
|
||||
maxSyncReplicas: 0
|
||||
minSyncReplicas: 0
|
||||
monitoring:
|
||||
customQueriesConfigMap:
|
||||
- key: queries
|
||||
name: cnpg-default-monitoring
|
||||
disableDefaultQueries: false
|
||||
enablePodMonitor: false
|
||||
postgresql:
|
||||
parameters:
|
||||
archive_mode: "on"
|
||||
archive_timeout: 5min
|
||||
dynamic_shared_memory_type: posix
|
||||
effective_cache_size: 256MB
|
||||
full_page_writes: "on"
|
||||
log_destination: csvlog
|
||||
log_directory: /controller/log
|
||||
log_filename: postgres
|
||||
log_rotation_age: "0"
|
||||
log_rotation_size: "0"
|
||||
log_truncate_on_rotation: "false"
|
||||
logging_collector: "on"
|
||||
max_connections: "200"
|
||||
max_parallel_workers: "16"
|
||||
max_replication_slots: "16"
|
||||
max_worker_processes: "16"
|
||||
shared_buffers: 128MB
|
||||
shared_memory_type: mmap
|
||||
ssl_max_protocol_version: TLSv1.3
|
||||
ssl_min_protocol_version: TLSv1.3
|
||||
wal_keep_size: 256MB
|
||||
wal_level: logical
|
||||
wal_log_hints: "on"
|
||||
wal_receiver_timeout: 5s
|
||||
wal_sender_timeout: 5s
|
||||
syncReplicaElectionConstraint:
|
||||
enabled: false
|
||||
primaryUpdateMethod: restart
|
||||
primaryUpdateStrategy: unsupervised
|
||||
probes:
|
||||
liveness:
|
||||
isolationCheck:
|
||||
connectionTimeout: 1000
|
||||
enabled: true
|
||||
requestTimeout: 1000
|
||||
replicationSlots:
|
||||
highAvailability:
|
||||
enabled: true
|
||||
slotPrefix: _cnpg_
|
||||
synchronizeReplicas:
|
||||
enabled: true
|
||||
updateInterval: 30
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
smartShutdownTimeout: 180
|
||||
startDelay: 3600
|
||||
stopDelay: 1800
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 10Gi
|
||||
storageClass: cephrbd-fast-delete
|
||||
switchoverDelay: 3600
|
||||
@@ -1,33 +0,0 @@
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Pooler
|
||||
metadata:
|
||||
name: paperclip-pooler-rw
|
||||
namespace: paperclip
|
||||
spec:
|
||||
cluster:
|
||||
name: paperclip-postgres
|
||||
instances: 2
|
||||
pgbouncer:
|
||||
parameters:
|
||||
default_pool_size: "100"
|
||||
max_client_conn: "400"
|
||||
paused: false
|
||||
poolMode: session
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pooler
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- pooler
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: rw
|
||||
@@ -1,108 +0,0 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: paperclip
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: paperclip
|
||||
spec:
|
||||
containers:
|
||||
- name: paperclip
|
||||
image: ghcr.io/paperclipai/paperclip:latest
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 3100
|
||||
name: http
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: PORT
|
||||
value: "3100"
|
||||
- name: PAPERCLIP_BIND
|
||||
value: custom
|
||||
- name: PAPERCLIP_BIND_HOST
|
||||
value: 0.0.0.0
|
||||
- name: PAPERCLIP_API_URL
|
||||
value: https://paperclip.k8s.syd1.au.unkin.net
|
||||
- name: BETTER_AUTH_BASE_URL
|
||||
value: https://paperclip.k8s.syd1.au.unkin.net
|
||||
- name: PAPERCLIP_ALLOWED_HOSTNAMES
|
||||
value: paperclip.k8s.syd1.au.unkin.net,localhost
|
||||
- name: PAPERCLIP_HOME
|
||||
value: /paperclip
|
||||
- name: PAPERCLIP_INSTANCE_ID
|
||||
value: default
|
||||
- name: PAPERCLIP_DEPLOYMENT_MODE
|
||||
value: authenticated
|
||||
- name: PAPERCLIP_DEPLOYMENT_EXPOSURE
|
||||
value: private
|
||||
- name: SERVE_UI
|
||||
value: "true"
|
||||
- name: HEARTBEAT_SCHEDULER_ENABLED
|
||||
value: "true"
|
||||
- name: PAPERCLIP_MIGRATION_AUTO_APPLY
|
||||
value: "true"
|
||||
- name: PAPERCLIP_STORAGE_PROVIDER
|
||||
value: s3
|
||||
- name: PAPERCLIP_STORAGE_S3_BUCKET
|
||||
value: paperclip
|
||||
- name: PAPERCLIP_STORAGE_S3_REGION
|
||||
value: us-east-1
|
||||
- name: PAPERCLIP_STORAGE_S3_ENDPOINT
|
||||
value: https://radosgw.service.consul
|
||||
- name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
|
||||
value: "true"
|
||||
- name: NODE_EXTRA_CA_CERTS
|
||||
value: /etc/ssl/paperclip/ca.crt
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: paperclip-credentials
|
||||
volumeMounts:
|
||||
- name: vault-ca-cert
|
||||
mountPath: /etc/ssl/paperclip
|
||||
readOnly: true
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3100
|
||||
httpHeaders:
|
||||
- name: Host
|
||||
value: localhost
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3100
|
||||
httpHeaders:
|
||||
- name: Host
|
||||
value: localhost
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 2Gi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
restartPolicy: Always
|
||||
@@ -1,37 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: paperclip.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: paperclip-tls
|
||||
mode: Terminate
|
||||
@@ -1,49 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: paperclip-http-redirect
|
||||
namespace: paperclip
|
||||
spec:
|
||||
hostnames:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: paperclip
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
hostnames:
|
||||
- paperclip.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: paperclip
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: paperclip
|
||||
port: 3100
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,14 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- deployment.yaml
|
||||
- gateway.yaml
|
||||
- httproute.yaml
|
||||
- namespace.yaml
|
||||
- services.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: paperclip
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: paperclip
|
||||
namespace: paperclip
|
||||
spec:
|
||||
internalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: http
|
||||
port: 3100
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: paperclip
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: paperclip
|
||||
spec:
|
||||
allowedNamespaces:
|
||||
- paperclip
|
||||
kubernetes:
|
||||
audiences:
|
||||
- vault
|
||||
role: default
|
||||
serviceAccount: default
|
||||
tokenExpirationSeconds: 600
|
||||
method: kubernetes
|
||||
mount: k8s/au/syd1
|
||||
vaultConnectionRef: vso-system/default
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: postgres-credentials
|
||||
namespace: paperclip
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: postgres-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/paperclip/default/postgres-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: paperclip-credentials
|
||||
namespace: paperclip
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: paperclip-credentials
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/paperclip/default/paperclip-credentials
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- priorityclasses.yaml
|
||||
@@ -1,36 +0,0 @@
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: low
|
||||
value: 100
|
||||
preemptionPolicy: Never
|
||||
globalDefault: false
|
||||
description: "Low-importance workloads. Can be evicted under pressure but will not preempt other pods."
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: power
|
||||
value: 100
|
||||
preemptionPolicy: Never
|
||||
globalDefault: false
|
||||
description: "Compute-heavy workloads with low scheduling importance. Evictable under pressure."
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: medium
|
||||
value: 10000
|
||||
preemptionPolicy: PreemptLowerPriority
|
||||
globalDefault: false
|
||||
description: "Standard workloads. Will preempt low-priority pods if the cluster is under pressure."
|
||||
---
|
||||
apiVersion: scheduling.k8s.io/v1
|
||||
kind: PriorityClass
|
||||
metadata:
|
||||
name: high
|
||||
value: 100000
|
||||
preemptionPolicy: PreemptLowerPriority
|
||||
globalDefault: false
|
||||
description: "High-importance services. Will preempt medium- and low-priority pods if necessary."
|
||||
@@ -19,24 +19,6 @@ spec:
|
||||
postInitApplicationSQL:
|
||||
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
||||
- CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
||||
- GRANT CONNECT ON DATABASE puppetdb TO puppetdb_read;
|
||||
- GRANT USAGE ON SCHEMA public TO puppetdb_read;
|
||||
- GRANT SELECT ON ALL TABLES IN SCHEMA public TO puppetdb_read;
|
||||
- ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO puppetdb_read;
|
||||
managed:
|
||||
roles:
|
||||
- name: puppetdb_read
|
||||
ensure: present
|
||||
comment: PuppetDB read-only database user
|
||||
login: true
|
||||
superuser: false
|
||||
createdb: false
|
||||
createrole: false
|
||||
inherit: true
|
||||
replication: false
|
||||
connectionLimit: -1
|
||||
passwordSecret:
|
||||
name: postgres-read-credentials
|
||||
enablePDB: true
|
||||
enableSuperuserAccess: false
|
||||
failoverDelay: 0
|
||||
|
||||
@@ -31,36 +31,3 @@ spec:
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: rw
|
||||
---
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Pooler
|
||||
metadata:
|
||||
name: puppet-postgres-pooler-ro
|
||||
namespace: puppet
|
||||
spec:
|
||||
cluster:
|
||||
name: puppet-postgres
|
||||
instances: 2
|
||||
pgbouncer:
|
||||
parameters:
|
||||
default_pool_size: "100"
|
||||
max_client_conn: "400"
|
||||
paused: false
|
||||
poolMode: session
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pooler-ro
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- pooler-ro
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers: []
|
||||
type: ro
|
||||
|
||||
@@ -13,9 +13,9 @@ data:
|
||||
PUPPETDB_HOST: "puppetdb"
|
||||
PUPPETDB_PORT: "8081"
|
||||
PUPPETDB_SSL_VERIFY: "/opt/puppetboard/ssl/ca.pem"
|
||||
PUPPETDB_CERT: "/opt/puppetboard/ssl/puppetboard.pem"
|
||||
PUPPETDB_KEY: "/opt/puppetboard/ssl/puppetboard.key"
|
||||
LOGLEVEL: "debug"
|
||||
PUPPETDB_CERT: "/opt/puppetboard/ssl/puppetboard.pem"
|
||||
LOGLEVEL: "info"
|
||||
PUPPETDB_TIMEOUT: "20"
|
||||
UNRESPONSIVE_HOURS: "3"
|
||||
ENABLE_CATALOG: "False"
|
||||
|
||||
@@ -17,7 +17,4 @@ data:
|
||||
OPENVOXDB_POSTGRES_HOSTNAME: "puppet-postgres-pooler"
|
||||
OPENVOXDB_POSTGRES_DATABASE: "puppetdb"
|
||||
OPENVOXDB_POSTGRES_PORT: "5432"
|
||||
OPENVOXDB_READ_POSTGRES_HOSTNAME: "puppet-postgres-pooler-ro"
|
||||
OPENVOXDB_READ_POSTGRES_DATABASE: "puppetdb"
|
||||
OPENVOXDB_READ_POSTGRES_PORT: "5432"
|
||||
PUPPETDB_JAVA_ARGS: ""
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb-read-database-conf
|
||||
namespace: puppet
|
||||
data:
|
||||
read-database.conf: |
|
||||
read-database: {
|
||||
subname: "//"${OPENVOXDB_READ_POSTGRES_HOSTNAME}":"${OPENVOXDB_READ_POSTGRES_PORT}"/"${OPENVOXDB_READ_POSTGRES_DATABASE}
|
||||
username: ${OPENVOXDB_READ_POSTGRES_USER}
|
||||
password: ${OPENVOXDB_READ_POSTGRES_PASSWORD}
|
||||
}
|
||||
@@ -11,7 +11,7 @@ metadata:
|
||||
namespace: puppet
|
||||
data:
|
||||
OPENVOXSERVER_PORT: "8140"
|
||||
DNS_ALT_NAMES: "puppetserver-compiler,puppet,puppet.k8s.syd1.au.unkin.net"
|
||||
DNS_ALT_NAMES: "puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppet,puppet.k8s.syd1.au.unkin.net"
|
||||
OPENVOXDB_SERVER_URLS: "https://puppetdb:8081"
|
||||
CA_ENABLED: "false"
|
||||
CA_HOSTNAME: "puppetca"
|
||||
|
||||
@@ -26,6 +26,38 @@ spec:
|
||||
spec:
|
||||
hostname: g10k-code
|
||||
imagePullSecrets: null
|
||||
initContainers:
|
||||
- name: fetch-config
|
||||
image: alpine/git:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
echo "Cloning r10k config repository..."
|
||||
git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
|
||||
cp /tmp/config/r10k.yaml /shared/r10k.yaml
|
||||
echo "r10k.yaml fetched successfully"
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
runAsGroup: 999
|
||||
runAsNonRoot: true
|
||||
runAsUser: 999
|
||||
volumeMounts:
|
||||
- mountPath: /shared
|
||||
name: shared-config
|
||||
containers:
|
||||
- name: g10k-code
|
||||
image: git.unkin.net/unkin/almalinux9-g10k:20260308
|
||||
@@ -37,16 +69,11 @@ spec:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
echo "Cloning r10k config repository..."
|
||||
git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/r10k-config
|
||||
echo "Running g10k..."
|
||||
/usr/bin/g10k -config /tmp/r10k-config/r10k.yaml
|
||||
- -config
|
||||
- /shared/r10k.yaml
|
||||
command:
|
||||
- /usr/bin/g10k
|
||||
envFrom: null
|
||||
env: []
|
||||
securityContext:
|
||||
@@ -60,6 +87,8 @@ spec:
|
||||
volumeMounts:
|
||||
- mountPath: /etc/puppetlabs/code/
|
||||
name: puppet-code-volume
|
||||
- mountPath: /shared
|
||||
name: shared-config
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
@@ -67,3 +96,6 @@ spec:
|
||||
- name: puppet-code-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-code-shared
|
||||
- name: shared-config
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-shared-config
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: generate-types
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: generate-types
|
||||
namespace: puppet
|
||||
spec:
|
||||
schedule: "*/5 * * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: generate-types
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
spec:
|
||||
hostname: generate-types
|
||||
imagePullSecrets: null
|
||||
containers:
|
||||
- name: generate-types
|
||||
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
/opt/puppetlabs/puppet/bin/gem install deep_merge ipaddr hiera-eyaml toml
|
||||
find /etc/puppetlabs/code/environments -mindepth 1 -maxdepth 1 -type d | while read -r envdir; do
|
||||
env="$(basename "$envdir")"
|
||||
echo "Generating types for $env"
|
||||
puppet generate types --environment "$env"
|
||||
done
|
||||
env: []
|
||||
resources:
|
||||
limits:
|
||||
cpu: 300m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsNonRoot: false
|
||||
capabilities:
|
||||
add:
|
||||
- CAP_CHOWN
|
||||
- CAP_SETUID
|
||||
- CAP_SETGID
|
||||
- CAP_DAC_OVERRIDE
|
||||
- CAP_AUDIT_WRITE
|
||||
- CAP_FOWNER
|
||||
- CHOWN
|
||||
- SETUID
|
||||
- SETGID
|
||||
- DAC_OVERRIDE
|
||||
- AUDIT_WRITE
|
||||
- FOWNER
|
||||
drop:
|
||||
- all
|
||||
volumeMounts:
|
||||
- mountPath: /etc/puppetlabs/code/
|
||||
name: puppet-code-volume
|
||||
- mountPath: /etc/puppetlabs/puppet/
|
||||
name: puppet-puppet-volume
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
volumes:
|
||||
- name: puppet-code-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-code-shared
|
||||
- name: puppet-puppet-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-compiler-config-shared
|
||||
@@ -59,16 +59,6 @@ spec:
|
||||
secretKeyRef:
|
||||
key: username
|
||||
name: postgres-credentials
|
||||
- name: OPENVOXDB_READ_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: postgres-read-credentials
|
||||
- name: OPENVOXDB_READ_POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: username
|
||||
name: postgres-read-credentials
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
@@ -88,17 +78,18 @@ spec:
|
||||
volumeMounts:
|
||||
- mountPath: /opt/puppetlabs/server/data/puppetdb
|
||||
name: puppetdb-storage
|
||||
- mountPath: /etc/puppetlabs/puppetdb/conf.d/read-database.conf
|
||||
name: puppetdb-read-database-conf
|
||||
subPath: read-database.conf
|
||||
initContainers:
|
||||
- name: create-log-dir
|
||||
image: docker.io/busybox:1.37
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- mkdir -p /opt/puppetlabs/server/data/puppetdb/logs && chown 999:999 /opt/puppetlabs/server/data/puppetdb/logs
|
||||
volumeMounts:
|
||||
- mountPath: /opt/puppetlabs/server/data/puppetdb
|
||||
name: puppetdb-storage
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources:
|
||||
limits:
|
||||
cpu: 20m
|
||||
@@ -106,25 +97,18 @@ spec:
|
||||
requests:
|
||||
cpu: 20m
|
||||
memory: 32Mi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- mountPath: /opt/puppetlabs/server/data/puppetdb
|
||||
name: puppetdb-storage
|
||||
|
||||
- name: pgchecker
|
||||
image: docker.io/busybox:1.37
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
echo 'Waiting for PostgreSQL to become ready...'
|
||||
until printf "." && nc -z -w 2 puppet-postgres-pooler 5432; do
|
||||
sleep 2;
|
||||
done;
|
||||
echo 'PostgreSQL OK ✓'
|
||||
image: docker.io/busybox:1.37
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: pgchecker
|
||||
resources:
|
||||
limits:
|
||||
cpu: 20m
|
||||
@@ -133,24 +117,22 @@ spec:
|
||||
cpu: 20m
|
||||
memory: 32Mi
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
- name: wait-puppetserver
|
||||
image: curlimages/curl:8.11.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
runAsUser: 1000
|
||||
- command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
echo 'Waiting for puppetserver to become ready...'
|
||||
until printf "." && curl --silent --fail --insecure 'https://puppetca:8140/status/v1/simple' | grep -q '^running$'; do
|
||||
sleep 2;
|
||||
done;
|
||||
echo 'Puppetserver OK ✓'
|
||||
image: curlimages/curl:8.11.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: wait-puppetserver
|
||||
resources:
|
||||
limits:
|
||||
cpu: 20m
|
||||
@@ -159,14 +141,11 @@ spec:
|
||||
cpu: 20m
|
||||
memory: 32Mi
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
allowPrivilegeEscalation: false
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
runAsUser: 1000
|
||||
volumes:
|
||||
- name: puppetdb-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-puppetdb-claim
|
||||
- name: puppetdb-read-database-conf
|
||||
configMap:
|
||||
name: puppetdb-read-database-conf
|
||||
|
||||
@@ -93,34 +93,28 @@ spec:
|
||||
- mountPath: /var/lib/puppet/keys/
|
||||
name: eyaml-keys
|
||||
readOnly: true
|
||||
- mountPath: /opt/bin/
|
||||
name: puppet-shared-bins
|
||||
- mountPath: /opt/vault-ca-cert.crt
|
||||
name: vault-ca-cert
|
||||
subPath: ca.crt
|
||||
initContainers:
|
||||
- name: perms-and-dirs
|
||||
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
||||
imagePullPolicy: IfNotPresent
|
||||
- args:
|
||||
- mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
|
||||
cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh;
|
||||
chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh;
|
||||
chmod +x /etc/puppetlabs/puppet/check_for_masters.sh;
|
||||
bash /etc/puppetlabs/puppet/check_for_masters.sh;
|
||||
mkdir -p /etc/puppetlabs/code/environments;
|
||||
mkdir -p /etc/puppetlabs/puppet/manifests;
|
||||
chown -R puppet:puppet /etc/puppetlabs;
|
||||
mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
|
||||
touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
|
||||
chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
mkdir -p /etc/puppetlabs/puppet/eyaml/keys
|
||||
cp /tmp/puppet/configmap/check_for_masters.sh /etc/puppetlabs/puppet/check_for_masters.sh
|
||||
chown puppet:puppet /etc/puppetlabs/puppet/check_for_masters.sh
|
||||
chmod +x /etc/puppetlabs/puppet/check_for_masters.sh
|
||||
bash /etc/puppetlabs/puppet/check_for_masters.sh
|
||||
mkdir -p /etc/puppetlabs/code/environments
|
||||
mkdir -p /etc/puppetlabs/puppet/manifests
|
||||
chown -R puppet:puppet /etc/puppetlabs
|
||||
mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/
|
||||
touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde
|
||||
chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: puppetserver-init-config
|
||||
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: perms-and-dirs
|
||||
resources:
|
||||
limits:
|
||||
cpu: 300m
|
||||
@@ -129,8 +123,6 @@ spec:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsNonRoot: false
|
||||
capabilities:
|
||||
add:
|
||||
- CAP_CHOWN
|
||||
@@ -147,6 +139,8 @@ spec:
|
||||
- FOWNER
|
||||
drop:
|
||||
- all
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- mountPath: /etc/puppetlabs/puppet/
|
||||
name: puppet-puppet-storage
|
||||
@@ -169,9 +163,3 @@ spec:
|
||||
secret:
|
||||
secretName: eyaml-keys
|
||||
defaultMode: 0600
|
||||
- name: puppet-shared-bins
|
||||
persistentVolumeClaim:
|
||||
claimName: puppet-shared-bins
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard
|
||||
namespace: puppet
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
name: http
|
||||
port: 80
|
||||
protocol: HTTP
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: puppetboard-tls
|
||||
mode: Terminate
|
||||
@@ -1,34 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.4
|
||||
labels:
|
||||
traefik.io/instance: internal
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
gatewayClassName: traefik-internal
|
||||
listeners:
|
||||
- allowedRoutes:
|
||||
namespaces:
|
||||
from: Same
|
||||
hostname: puppetdb.k8s.syd1.au.unkin.net
|
||||
name: https
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
tls:
|
||||
certificateRefs:
|
||||
- group: ""
|
||||
kind: Secret
|
||||
name: puppetdb-tls
|
||||
mode: Terminate
|
||||
@@ -11,7 +11,7 @@ metadata:
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
kind: StatefulSet
|
||||
name: puppetserver-compiler
|
||||
minReplicas: 2
|
||||
maxReplicas: 5
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard-http-redirect
|
||||
namespace: puppet
|
||||
spec:
|
||||
hostnames:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetboard
|
||||
sectionName: http
|
||||
rules:
|
||||
- filters:
|
||||
- type: RequestRedirect
|
||||
requestRedirect:
|
||||
scheme: https
|
||||
statusCode: 301
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard
|
||||
namespace: puppet
|
||||
spec:
|
||||
hostnames:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetboard
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: puppetboard
|
||||
port: 80
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -1,30 +0,0 @@
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
hostnames:
|
||||
- puppetdb.k8s.syd1.au.unkin.net
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: puppetdb
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: puppetdb
|
||||
port: 8080
|
||||
weight: 1
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetboard
|
||||
namespace: puppet
|
||||
spec:
|
||||
rules:
|
||||
- host: puppetboard.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: puppetboard
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- puppetboard.k8s.syd1.au.unkin.net
|
||||
secretName: puppetboard-tls
|
||||
@@ -0,0 +1,34 @@
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
|
||||
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
||||
cert-manager.io/cluster-issuer: vault-issuer
|
||||
cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
|
||||
cert-manager.io/private-key-size: "4096"
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetdb
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
rules:
|
||||
- host: puppetdb.k8s.syd1.au.unkin.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: puppetdb
|
||||
port:
|
||||
number: 8080
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- puppetdb.k8s.syd1.au.unkin.net
|
||||
secretName: puppetdb-tls
|
||||
@@ -7,13 +7,11 @@ resources:
|
||||
- cnpg_cluster.yaml
|
||||
- cnpg_pooler.yaml
|
||||
- cronjob_g10k-code.yaml
|
||||
- cronjob_generate-types.yaml
|
||||
- persistentvolumeclaims.yaml
|
||||
- vaultauth.yaml
|
||||
- vaultstaticsecret.yaml
|
||||
- configmap_puppetboard-config.yaml
|
||||
- configmap_puppetdb-config.yaml
|
||||
- configmap_puppetdb-read-database.yaml
|
||||
- configmap_puppetserver-compiler-config.yaml
|
||||
- configmap_puppetserver-init-config.yaml
|
||||
- configmap_puppetserver-init-masters-config.yaml
|
||||
@@ -25,41 +23,12 @@ resources:
|
||||
- horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
|
||||
- horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
|
||||
- horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
|
||||
- gateway_puppetboard.yaml
|
||||
- httproute_puppetboard.yaml
|
||||
- gateway_puppetdb.yaml
|
||||
- httproute_puppetdb.yaml
|
||||
- ingress_puppetboard.yaml
|
||||
- ingress_puppetdb.yaml
|
||||
- service_puppetserver-agents-to-puppet.yaml
|
||||
- service_puppet-headless.yaml
|
||||
- service_puppet.yaml
|
||||
- service_puppetca.yaml
|
||||
- service_puppetboard.yaml
|
||||
- service_puppetdb.yaml
|
||||
- deployment_puppetserver-compiler.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: compiler-autosign.conf
|
||||
files:
|
||||
- resources/compiler/autosign.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: compiler-puppet.conf
|
||||
files:
|
||||
- resources/compiler/puppet.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: compiler-puppetdb.conf
|
||||
files:
|
||||
- resources/compiler/puppetdb.conf
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: puppet-cobbler-enc
|
||||
files:
|
||||
- resources/cobbler-enc
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- name: additional-ruby-gems
|
||||
files:
|
||||
- resources/additional-ruby-gems.sh
|
||||
options:
|
||||
disableNameSuffixHash: true
|
||||
- statefulset_puppetserver-compiler.yaml
|
||||
|
||||
@@ -73,6 +73,24 @@ spec:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: r10k-shared-config
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetserver-shared-config
|
||||
namespace: puppet
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: cephrbd-fast-delete
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetboard
|
||||
@@ -88,39 +106,3 @@ spec:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: cephfs-raid6-delete
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppetserver-compilers
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 8.8.0
|
||||
name: puppetserver-compiler-config-shared
|
||||
namespace: puppet
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
storageClassName: cephfs-raid6-delete
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: puppet-shared-bins
|
||||
app.kubernetes.io/instance: puppetserver
|
||||
app.kubernetes.io/name: puppetserver
|
||||
app.kubernetes.io/version: 0.9.20
|
||||
name: puppet-shared-bins
|
||||
namespace: puppet
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
storageClassName: cephfs-raid6-delete
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
echo "Installing additional Ruby gems..."
|
||||
/opt/puppetlabs/puppet/bin/gem install deep_merge
|
||||
/opt/puppetlabs/puppet/bin/gem install ipaddr
|
||||
/opt/puppetlabs/puppet/bin/gem install hiera-eyaml
|
||||
/opt/puppetlabs/puppet/bin/gem install toml
|
||||
echo "Additional Ruby gems installed successfully"
|
||||
@@ -1,50 +0,0 @@
|
||||
#!/usr/bin/env -S /opt/bin/uv run --quiet --cache-dir /opt/bin/.cache/uv --script
|
||||
# /// script
|
||||
# requires-python = ">=3.11"
|
||||
# dependencies = ['pyyaml','requests']
|
||||
# ///
|
||||
"""
|
||||
External Node Classifier (ENC) for Puppet.
|
||||
|
||||
If the environment specified in the YAML file is 'testing',
|
||||
the environment is not included in the output.
|
||||
"""
|
||||
|
||||
import sys
|
||||
import yaml
|
||||
import requests
|
||||
|
||||
def fetch_enc_data(cobbler_url: str, hostname: str) -> str:
|
||||
"""
|
||||
Fetches and modifies ENC data from a given URL to ensure classes are in list format.
|
||||
"""
|
||||
url = f"{cobbler_url}/cblr/svc/op/puppet/hostname/{hostname}"
|
||||
try:
|
||||
response = requests.get(url, verify='/opt/vault-ca-cert.crt')
|
||||
response.raise_for_status()
|
||||
except requests.RequestException as e:
|
||||
sys.exit(f"Request failed: {e}")
|
||||
|
||||
data = yaml.safe_load(response.text)
|
||||
data["parameters"] = data.get("parameters", {})
|
||||
|
||||
# Ensure 'classes' is in the desired list format
|
||||
if "classes" in data:
|
||||
if isinstance(data["classes"], dict):
|
||||
data["parameters"]["enc_role"] = list(data["classes"].keys())
|
||||
data["classes"] = list(data["classes"].keys())
|
||||
else:
|
||||
data["parameters"]["enc_role"] = list(data["classes"])
|
||||
data["classes"] = list(data["classes"])
|
||||
|
||||
if "environment" in data:
|
||||
data["parameters"]["enc_env"] = data["environment"]
|
||||
if data["environment"] == "testing":
|
||||
del data["environment"]
|
||||
|
||||
return yaml.dump(data)
|
||||
|
||||
if __name__ == "__main__":
|
||||
if len(sys.argv) != 2:
|
||||
sys.exit(f"Usage: {sys.argv[0]} <hostname>")
|
||||
print(fetch_enc_data("https://cobbler.main.unkin.net", sys.argv[1]))
|
||||
@@ -1,15 +0,0 @@
|
||||
# Autosign all nodes from these subnets
|
||||
198.18.13.0/24
|
||||
198.18.14.0/24
|
||||
198.18.15.0/24
|
||||
198.18.16.0/24
|
||||
198.18.17.0/24
|
||||
198.18.20.0/24
|
||||
198.18.24.0/24
|
||||
198.18.25.0/24
|
||||
198.18.26.0/24
|
||||
198.18.27.0/24
|
||||
198.18.28.0/24
|
||||
198.18.29.0/24
|
||||
# Autosign all nodes from these domains
|
||||
*.main.unkin.net
|
||||
@@ -1,23 +0,0 @@
|
||||
[main]
|
||||
server = puppetserver-compiler
|
||||
serverport = 8140
|
||||
dns_alt_names = puppetserver-compiler,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net
|
||||
codedir = /etc/puppetlabs/code
|
||||
environmentpath = /etc/puppetlabs/code/environments
|
||||
|
||||
[server]
|
||||
vardir = /opt/puppetlabs/server/data/puppetserver
|
||||
logdir = /var/log/puppetlabs/puppetserver
|
||||
rundir = /var/run/puppetlabs/puppetserver
|
||||
pidfile = /var/run/puppetlabs/puppetserver/puppetserver.pid
|
||||
node_terminus = exec
|
||||
external_nodes = /opt/bin/cobbler-enc
|
||||
autosign = /etc/puppetlabs/puppet/autosign.conf
|
||||
storeconfigs = true
|
||||
storeconfigs_backend = puppetdb
|
||||
reports = puppetdb
|
||||
usecacheonfailure = false
|
||||
|
||||
[user]
|
||||
default_manifest = /etc/puppetlabs/code/environments/develop/manifests
|
||||
default_environment = develop
|
||||
@@ -1,3 +0,0 @@
|
||||
[main]
|
||||
server_urls = https://puppetdb.k8s.syd1.au.unkin.net
|
||||
soft_write_failure = true
|
||||
@@ -9,6 +9,7 @@ metadata:
|
||||
name: puppetdb
|
||||
namespace: puppet
|
||||
spec:
|
||||
clusterIP: null
|
||||
ports:
|
||||
- name: pdb-http
|
||||
port: 8080
|
||||
|
||||
+45
-109
@@ -1,5 +1,5 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
annotations:
|
||||
reloader.stakater.com/auto: "true"
|
||||
@@ -11,10 +11,12 @@ metadata:
|
||||
name: puppetserver-compiler
|
||||
namespace: puppet
|
||||
spec:
|
||||
podManagementPolicy: OrderedReady
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: puppetserver-compilers
|
||||
app.kubernetes.io/name: puppetserver
|
||||
serviceName: puppet-headless
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
@@ -39,14 +41,26 @@ spec:
|
||||
ports:
|
||||
- containerPort: 8140
|
||||
name: puppetserver
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: puppetserver-compiler-config
|
||||
envFrom: null
|
||||
env:
|
||||
- name: OPENVOXSERVER_HOSTNAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: OPENVOXSERVER_PORT
|
||||
value: "8140"
|
||||
- name: DNS_ALT_NAMES
|
||||
value: puppetserver-compiler-0,puppetserver-compiler-1,puppetserver-compiler-2,puppetserver-compiler-3,puppetserver-compiler-4,puppet-headless,puppet,puppet.k8s.syd1.au.unkin.net
|
||||
- name: OPENVOXDB_SERVER_URLS
|
||||
value: https://puppetdb:8081
|
||||
- name: CA_ENABLED
|
||||
value: "false"
|
||||
- name: CA_HOSTNAME
|
||||
value: puppetca
|
||||
- name: CA_PORT
|
||||
value: "8140"
|
||||
- name: PUPPETSERVER_JAVA_ARGS
|
||||
value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
periodSeconds: 30
|
||||
@@ -94,60 +108,26 @@ spec:
|
||||
- mountPath: /var/lib/puppet/keys/
|
||||
name: eyaml-keys
|
||||
readOnly: true
|
||||
- mountPath: /opt/bin/
|
||||
name: puppet-shared-bins
|
||||
- mountPath: /opt/vault-ca-cert.crt
|
||||
name: vault-ca-cert
|
||||
subPath: ca.crt
|
||||
- mountPath: /docker-custom-entrypoint.d/post-startup/additional-ruby-gems.sh
|
||||
name: additional-ruby-gems
|
||||
subPath: additional-ruby-gems.sh
|
||||
initContainers:
|
||||
- name: copy-configmaps
|
||||
image: busybox:1.35
|
||||
- args:
|
||||
- mkdir -p /etc/puppetlabs/puppet/eyaml/keys;
|
||||
mkdir -p /etc/puppetlabs/code/environments;
|
||||
mkdir -p /etc/puppetlabs/puppet/manifests;
|
||||
chown -R puppet:puppet /etc/puppetlabs;
|
||||
chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml;
|
||||
mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
|
||||
touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
|
||||
chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
echo "Copying configmap files to shared volume..."
|
||||
mkdir -p /etc/puppetlabs/puppet
|
||||
cp /configmaps/puppet.conf /etc/puppetlabs/puppet/puppet.conf
|
||||
cp /configmaps/puppetdb.conf /etc/puppetlabs/puppet/puppetdb.conf
|
||||
cp /configmaps/autosign.conf /etc/puppetlabs/puppet/autosign.conf
|
||||
echo "Configmap files copied successfully"
|
||||
volumeMounts:
|
||||
- mountPath: /etc/puppetlabs/puppet/
|
||||
name: puppet-puppet-volume
|
||||
- mountPath: /configmaps/puppet.conf
|
||||
name: compiler-puppet-conf
|
||||
subPath: puppet.conf
|
||||
- mountPath: /configmaps/puppetdb.conf
|
||||
name: compiler-puppetdb-conf
|
||||
subPath: puppetdb.conf
|
||||
- mountPath: /configmaps/autosign.conf
|
||||
name: compiler-autosign-conf
|
||||
subPath: autosign.conf
|
||||
|
||||
- name: perms-and-dirs
|
||||
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
mkdir -p /etc/puppetlabs/puppet/eyaml/keys
|
||||
mkdir -p /etc/puppetlabs/code/environments
|
||||
mkdir -p /etc/puppetlabs/puppet/manifests
|
||||
chown -R puppet:puppet /etc/puppetlabs
|
||||
chown puppet:puppet /etc/puppetlabs/puppet/r10k.yaml
|
||||
mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/
|
||||
touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde
|
||||
chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/
|
||||
env:
|
||||
- name: PUPPETSERVER_JAVA_ARGS
|
||||
value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
|
||||
envFrom: null
|
||||
image: ghcr.io/openvoxproject/openvoxserver:8.8.0-main
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: perms-and-dirs
|
||||
resources:
|
||||
limits:
|
||||
cpu: 300m
|
||||
@@ -156,8 +136,6 @@ spec:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsNonRoot: false
|
||||
capabilities:
|
||||
add:
|
||||
- CAP_CHOWN
|
||||
@@ -174,75 +152,33 @@ spec:
|
||||
- FOWNER
|
||||
drop:
|
||||
- all
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- mountPath: /etc/puppetlabs/code/
|
||||
name: puppet-code-volume
|
||||
- mountPath: /etc/puppetlabs/puppet/
|
||||
name: puppet-puppet-volume
|
||||
|
||||
- name: setup-shared-bins
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260308
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
args:
|
||||
- |
|
||||
echo "Setting up shared binaries..."
|
||||
mkdir -p /opt/bin
|
||||
mkdir -p /opt/bin/.cache/uv
|
||||
|
||||
# Copy cobbler to shared bin volume
|
||||
cp /configmaps/cobbler-enc /opt/bin/cobbler-enc
|
||||
chmod +x /opt/bin/cobbler-enc
|
||||
|
||||
# Install uv to shared bin volume
|
||||
cd /tmp
|
||||
wget -O uv-x86_64-unknown-linux-gnu.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/astral-sh/uv/releases/download/0.9.20/uv-x86_64-unknown-linux-gnu.tar.gz
|
||||
tar xf uv-x86_64-unknown-linux-gnu.tar.gz
|
||||
cp uv-x86_64-unknown-linux-gnu/uv /opt/bin/uv
|
||||
chmod +x /opt/bin/uv
|
||||
|
||||
echo "Shared binaries setup completed"
|
||||
volumeMounts:
|
||||
- mountPath: /opt/bin/
|
||||
name: puppet-shared-bins
|
||||
- mountPath: /configmaps/cobbler-enc
|
||||
name: puppet-cobbler-enc
|
||||
subPath: cobbler-enc
|
||||
securityContext:
|
||||
fsGroup: 999
|
||||
volumes:
|
||||
- name: puppet-code-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-code-shared
|
||||
- name: puppet-puppet-volume
|
||||
persistentVolumeClaim:
|
||||
claimName: puppetserver-compiler-config-shared
|
||||
- name: eyaml-keys
|
||||
secret:
|
||||
secretName: eyaml-keys
|
||||
defaultMode: 0600
|
||||
- name: compiler-puppet-conf
|
||||
configMap:
|
||||
name: compiler-puppet.conf
|
||||
- name: compiler-puppetdb-conf
|
||||
configMap:
|
||||
name: compiler-puppetdb.conf
|
||||
- name: compiler-autosign-conf
|
||||
configMap:
|
||||
name: compiler-autosign.conf
|
||||
- name: puppet-cobbler-enc
|
||||
configMap:
|
||||
name: puppet-cobbler-enc
|
||||
- name: puppet-shared-bins
|
||||
persistentVolumeClaim:
|
||||
claimName: puppet-shared-bins
|
||||
- name: vault-ca-cert
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
- name: additional-ruby-gems
|
||||
configMap:
|
||||
name: additional-ruby-gems
|
||||
defaultMode: 0755
|
||||
strategy:
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
annotations: null
|
||||
name: puppet-puppet-volume
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: cephrbd-fast-delete
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user