unkin-agent
9616e0e2b3
rke2's `registries.yaml` already rewrites upstream image names to the artifactapi mirror, so manifests must carry canonical upstream names. Only in-house `artifactapi.k8s.syd1.au.unkin.net/docker-internal/...` images stay explicit. Changes: - Point the arrproxy migrate job at `docker.io/library/postgres:18-alpine`. - Point the arrproxy oauth2-proxy cert-combine init container at `docker.io/library/alpine:3`. - Point the arrstack ValkeyCluster at `docker.io/valkey/valkey:9.0.0`. Tags are unchanged. `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` differs from main only in those three image strings. No extra proxied refs found in these files (the oauth2-proxy image itself is already canonical `quay.io/...`). Reviewed-on: #427 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
48 lines
1.9 KiB
YAML
48 lines
1.9 KiB
YAML
---
|
|
# Single shared HA Valkey for the arr apps (sonarr/radarr/prowlarr), managed by
|
|
# valkey-operator. It activates the fork's #14 Redis features: the SignalR
|
|
# backplane, the cross-replica cache-invalidation bus, and the distributed rate
|
|
# limiter. One cluster is safe for all three because each fork namespaces its
|
|
# keys and pub/sub channels by a per-app prefix (sonarr:ratelimit: /
|
|
# radarr:ratelimit: / prowlarr:ratelimit:), so their state never collides.
|
|
#
|
|
# Modeled on jellyfin-valkey: shards:1 + replicas:2 is one primary with two
|
|
# replicas in a single shard group (three ValkeyNodes total); losing the primary
|
|
# triggers an automatic failover so a node/pod loss no longer drops the shared
|
|
# state the app replicas coordinate through. The operator runs Valkey
|
|
# cluster-mode-enabled with protected-mode off and leaves the built-in `default`
|
|
# user passwordless, so clients connect with no auth/TLS; StackExchange.Redis
|
|
# seeds off the single service and auto-discovers topology plus failovers.
|
|
# scheduling.node.spread.shard:Required keeps the three nodes on distinct hosts,
|
|
# so one host loss removes at most one node; podDisruptionBudget.mode:Cluster
|
|
# lets the operator manage a quorum-aware PDB. Persistence is omitted (/data is an
|
|
# emptyDir): the coordination state is ephemeral (short TTLs / transient pub/sub),
|
|
# replication+failover already provide redundancy, and an operator-managed PVC
|
|
# cannot carry the k8up.io/backup:"false" annotation the namespace k8up Schedule
|
|
# needs to skip in-use RWO volumes.
|
|
apiVersion: valkey.io/v1alpha1
|
|
kind: ValkeyCluster
|
|
metadata:
|
|
name: arrstack-valkey
|
|
namespace: arrstack
|
|
spec:
|
|
shards: 1
|
|
replicas: 2
|
|
image: docker.io/valkey/valkey:9.0.0
|
|
exporter:
|
|
enabled: false
|
|
scheduling:
|
|
node:
|
|
spread:
|
|
shard:
|
|
mode: Required
|
|
podDisruptionBudget:
|
|
mode: Cluster
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|