unkinben
14e3946d4b
working towards a larger, redundant, autoscaling and simple puppet implementation in kubernetes. this was originally based on the openvox helm chart with several improvements (not all in this pr) - use of cnpg instead of single bitnamilegacy postgres container - use for g10k instead of r10k - run one instance of g10k per namespace, instead of per-pod - store only keep one copy of the environments/branches (instead of per-pod) - change g10k to native cronjob instead of hacky implementation - use vault secrets part one adds: - cnpg puppetdb pgsql cluster - cnpg puppetdb pgpooler - persistent volume claims for puppet, puppetdb, the code repository, etc Reviewed-on: #25
107 lines
3.3 KiB
YAML
107 lines
3.3 KiB
YAML
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: r10k-code
|
|
app.kubernetes.io/instance: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
app.kubernetes.io/version: 8.8.0
|
|
name: g10k-code
|
|
namespace: puppet
|
|
spec:
|
|
schedule: "*/1 * * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: g10k-code
|
|
app.kubernetes.io/instance: puppetserver
|
|
app.kubernetes.io/name: puppetserver
|
|
app.kubernetes.io/version: 8.8.0
|
|
spec:
|
|
hostname: g10k-code
|
|
imagePullSecrets: null
|
|
initContainers:
|
|
- name: fetch-config
|
|
image: alpine/git:latest
|
|
imagePullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
args:
|
|
- |
|
|
set -e
|
|
echo "Cloning r10k config repository..."
|
|
git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
|
|
cp /tmp/config/r10k.yaml /shared/r10k.yaml
|
|
echo "r10k.yaml fetched successfully"
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- all
|
|
runAsGroup: 999
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
volumeMounts:
|
|
- mountPath: /shared
|
|
name: shared-config
|
|
containers:
|
|
- name: g10k-code
|
|
image: git.unkin.net/unkin/almalinux9-g10k:20260308
|
|
imagePullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
args:
|
|
- -config
|
|
- /shared/r10k.yaml
|
|
command:
|
|
- /usr/bin/g10k
|
|
envFrom: null
|
|
env: []
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- all
|
|
runAsGroup: 999
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
volumeMounts:
|
|
- mountPath: /etc/puppetlabs/code/
|
|
name: puppet-code-volume
|
|
- mountPath: /opt/puppetlabs/cache/
|
|
name: puppet-cache-volume
|
|
- mountPath: /shared
|
|
name: shared-config
|
|
restartPolicy: OnFailure
|
|
securityContext:
|
|
fsGroup: 999
|
|
volumes:
|
|
- name: puppet-code-volume
|
|
persistentVolumeClaim:
|
|
claimName: puppetserver-code-shared
|
|
- name: puppet-cache-volume
|
|
persistentVolumeClaim:
|
|
claimName: puppetserver-cache
|
|
- name: shared-config
|
|
persistentVolumeClaim:
|
|
claimName: puppetserver-shared-config
|