update kube-forge concept and add ability to change data dir for containerd
This commit is contained in:
173
.gitlab-ci.yml
173
.gitlab-ci.yml
@@ -1,173 +0,0 @@
|
||||
variables:
|
||||
DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge
|
||||
|
||||
KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug
|
||||
KANIKO_CONTEXT: ${CI_PROJECT_DIR}
|
||||
RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0
|
||||
CICD_MULTITOOL: harbor.kvazaric.ru/postgres-tasks/cicd-multitool:2.4
|
||||
BINARY_BUILDER_IMAGE: harbor.kvazaric.ru/mirror/library/golang:alpine
|
||||
|
||||
PREPARE_RELEASE:
|
||||
options:
|
||||
- "No"
|
||||
- "Yes"
|
||||
value: "No"
|
||||
description: Create release from this build?
|
||||
|
||||
WITHOUT_BUILD:
|
||||
options:
|
||||
- "No"
|
||||
- "Yes"
|
||||
value: "Yes"
|
||||
description: Create release without building?
|
||||
|
||||
stages:
|
||||
- prepare
|
||||
- build
|
||||
- release
|
||||
|
||||
make-version-name:
|
||||
stage: prepare
|
||||
image:
|
||||
name: ${CICD_MULTITOOL}
|
||||
entrypoint: [""]
|
||||
allow_failure: false
|
||||
tags:
|
||||
- build
|
||||
- docker
|
||||
script:
|
||||
- echo "VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)" > version.env
|
||||
artifacts:
|
||||
reports:
|
||||
dotenv: version.env
|
||||
|
||||
build-docker:
|
||||
variables:
|
||||
DOCKERFILE_PATH: Dockerfile
|
||||
IMAGE_DESTINATION: image
|
||||
stage: build
|
||||
image:
|
||||
name: ${KANIKO_IMAGE}
|
||||
entrypoint: [""]
|
||||
allow_failure: false
|
||||
tags:
|
||||
- build
|
||||
- docker
|
||||
before_script:
|
||||
- mkdir -p /kaniko/.docker
|
||||
- echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json
|
||||
script:
|
||||
- |
|
||||
/kaniko/executor --context "${KANIKO_CONTEXT}" \
|
||||
--dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \
|
||||
--destination "${DOCKER_IMAGE}:${VERSION}-${CI_COMMIT_SHORT_SHA}"
|
||||
dependencies:
|
||||
- make-version-name
|
||||
needs:
|
||||
- make-version-name
|
||||
rules:
|
||||
- if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
|
||||
when: never
|
||||
- changes:
|
||||
- build/docker/**/*
|
||||
- cmd/**/*
|
||||
- internal/**/*
|
||||
- kubespray/**/*
|
||||
- go.sum
|
||||
- go.mod
|
||||
- requirements.txt
|
||||
- ansible.cfg
|
||||
if: $CI_COMMIT_REF_NAME =~ /^(master)$/
|
||||
when: always
|
||||
|
||||
build-binary:
|
||||
stage: build
|
||||
image:
|
||||
name: ${BINARY_BUILDER_IMAGE}
|
||||
entrypoint: [""]
|
||||
allow_failure: false
|
||||
tags:
|
||||
- build
|
||||
- docker
|
||||
script:
|
||||
- CGO_ENABLED=0 GOOS=linux go build -v -o kube-forge ./cmd/main/main.go
|
||||
artifacts:
|
||||
paths:
|
||||
- ${CI_PROJECT_DIR}/kube-forge
|
||||
rules:
|
||||
- if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
|
||||
when: never
|
||||
- changes:
|
||||
- build/docker/**/*
|
||||
- cmd/**/*
|
||||
- internal/**/*
|
||||
- kubespray/**/*
|
||||
- go.sum
|
||||
- go.mod
|
||||
- requirements.txt
|
||||
- ansible.cfg
|
||||
if: $CI_COMMIT_REF_NAME =~ /^(master)$/
|
||||
when: always
|
||||
|
||||
prepare-tarball:
|
||||
stage: build
|
||||
image: ${CICD_MULTITOOL}
|
||||
allow_failure: false
|
||||
tags:
|
||||
- build
|
||||
- docker
|
||||
script:
|
||||
- mkdir archive
|
||||
- cp kube-forge archive
|
||||
- cp requirements.txt archive
|
||||
- cp -R kubespray archive
|
||||
- tar zcvf kube-forge-${VERSION}-${CI_COMMIT_SHORT_SHA}.tar.gz archive
|
||||
dependencies:
|
||||
- make-version-name
|
||||
- build-binary
|
||||
needs:
|
||||
- make-version-name
|
||||
- build-binary
|
||||
artifacts:
|
||||
paths:
|
||||
- ${CI_PROJECT_DIR}/kube-forge-${VERSION}-${CI_COMMIT_SHORT_SHA}.tar.gz
|
||||
rules:
|
||||
- if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
|
||||
when: never
|
||||
- changes:
|
||||
- build/docker/**/*
|
||||
- cmd/**/*
|
||||
- internal/**/*
|
||||
- kubespray/**/*
|
||||
- go.sum
|
||||
- go.mod
|
||||
- requirements.txt
|
||||
- ansible.cfg
|
||||
if: $CI_COMMIT_REF_NAME =~ /^(master)$/
|
||||
when: always
|
||||
|
||||
make-release:
|
||||
stage: release
|
||||
image: ${RELEASE_CLI_IMAGE}
|
||||
dependencies:
|
||||
- make-version-name
|
||||
needs:
|
||||
- make-version-name
|
||||
tags:
|
||||
- build
|
||||
- docker
|
||||
rules:
|
||||
- if: $PREPARE_RELEASE == "Yes"
|
||||
script:
|
||||
- VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)
|
||||
- echo "Preparing release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
|
||||
release: # See https://docs.gitlab.com/ee/ci/yaml/#release for available properties
|
||||
name: kube-forge:${VERSION}-${CI_COMMIT_SHORT_SHA}
|
||||
tag_name: "${VERSION}-${CI_COMMIT_SHORT_SHA}"
|
||||
description: "Kube-forge release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
|
||||
assets:
|
||||
links:
|
||||
- name: "Docker image"
|
||||
url: "https://harbor.kvazaric.ru/harbor/projects/4/repositories/kube-forge/artifacts-tab"
|
||||
link_type: "image"
|
||||
when: on_success
|
||||
@@ -8,12 +8,10 @@
|
||||
|
||||
```shell
|
||||
touch k8s-admin.conf
|
||||
touch vault-keys.json
|
||||
|
||||
docker run -v $(pwd)/config.yaml:/application/config.yaml \
|
||||
-v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \
|
||||
--mount type=bind,source=$(pwd)/k8s-admin.conf,target=/application/k8s-admin.conf \
|
||||
--mount type=bind,source=$(pwd)/vault-keys.json,target=/application/vault-keys.json \
|
||||
harbor.kvazaric.ru/kube-forge/kube-forge:1.1-f84c27e6 apply
|
||||
```
|
||||
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
## Сборка Docker
|
||||
|
||||
## Сборка Linux
|
||||
|
||||
### Debian
|
||||
@@ -1,5 +0,0 @@
|
||||
Package: kube-forge
|
||||
Version: 1.0
|
||||
Architecture: amd64
|
||||
Maintainer: Kvazaric <kvazaric.official@gmail.com>
|
||||
Description: A program to install Kubernetes-based platform to facilitate the development, desting and dperation of Ccntainerized applications
|
||||
@@ -1 +0,0 @@
|
||||
1.1
|
||||
@@ -3,14 +3,10 @@ package main
|
||||
import (
|
||||
"flag"
|
||||
"kube-forge/internal/additional"
|
||||
"kube-forge/internal/cicd"
|
||||
"kube-forge/internal/config"
|
||||
"kube-forge/internal/csi"
|
||||
"kube-forge/internal/kubespray"
|
||||
"kube-forge/internal/logging"
|
||||
"kube-forge/internal/observability"
|
||||
"kube-forge/internal/registry"
|
||||
"kube-forge/internal/secrets_storage"
|
||||
"kube-forge/internal/templates"
|
||||
"os"
|
||||
)
|
||||
@@ -18,10 +14,6 @@ import (
|
||||
func installAndConfigureModules() {
|
||||
csi.ApplyCharts()
|
||||
additional.ApplyCharts()
|
||||
registry.ApplyCharts()
|
||||
secrets_storage.ApplyCharts()
|
||||
cicd.ApplyCharts()
|
||||
observability.ApplyCharts()
|
||||
}
|
||||
|
||||
func main() {
|
||||
@@ -53,7 +45,10 @@ func main() {
|
||||
case "scale":
|
||||
kubespray.ScaleCluster()
|
||||
return
|
||||
case "reset":
|
||||
kubespray.ResetCluster()
|
||||
return
|
||||
}
|
||||
}
|
||||
logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
|
||||
logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale, reset")
|
||||
}
|
||||
|
||||
@@ -1,23 +1,36 @@
|
||||
credentials:
|
||||
user: sre-admin
|
||||
ask_sudo_password: false
|
||||
private_key_file: /home/sre-admin/.ssh/id_rsa
|
||||
private_key_file: /Users/georgest/.ssh/id_rsa_bastion_ift
|
||||
|
||||
hosts:
|
||||
- hostname: vbox-prod-k8s-master-01
|
||||
ip: "10.250.50.22"
|
||||
- hostname: t1-disk-lt-k8s-test-master-01
|
||||
ip: "10.100.20.49"
|
||||
roles: [control_plane, etcd]
|
||||
- hostname: vbox-prod-k8s-slave-01
|
||||
ip: "10.250.50.23"
|
||||
|
||||
- hostname: t1-disk-lt-k8s-test-slave-01
|
||||
ip: "10.100.20.48"
|
||||
roles: [node]
|
||||
- hostname: vbox-prod-k8s-slave-02
|
||||
ip: "10.250.50.21"
|
||||
|
||||
- hostname: t1-disk-lt-k8s-test-slave-02
|
||||
ip: "10.100.20.47"
|
||||
roles: [node]
|
||||
|
||||
orchestrator:
|
||||
version: v1.29.0
|
||||
cluster_name: cluster.local
|
||||
kubelet_dir: "/var/lib/kubelet"
|
||||
container_engine:
|
||||
install: true
|
||||
type: "containerd"
|
||||
data_dir: "/var/lib/containerd"
|
||||
state_dir: "/run/containerd"
|
||||
dns:
|
||||
servers:
|
||||
- 8.8.8.8
|
||||
- 8.8.4.4
|
||||
- 1.1.1.1
|
||||
disable_host_nameservers: false
|
||||
ping_access_ip: true
|
||||
auto_renew_certificates: true
|
||||
pod_security_policy_enabled: true
|
||||
@@ -28,103 +41,12 @@ orchestrator:
|
||||
skip_verify: false
|
||||
|
||||
modules:
|
||||
admin_password: changeit
|
||||
observability:
|
||||
enabled: true
|
||||
logging:
|
||||
enabled: true
|
||||
events:
|
||||
enabled: true
|
||||
tracing:
|
||||
enabled: true
|
||||
monitoring:
|
||||
enabled: true
|
||||
alert_manager:
|
||||
enabled: true
|
||||
route:
|
||||
receiver: kvazaric_notifications
|
||||
group_wait: 1s
|
||||
repeat_interval: 180m
|
||||
routes:
|
||||
- receiver: "kvazaric_notifications"
|
||||
group_by: ["alertname"]
|
||||
group_wait: 1s
|
||||
repeat_interval: 8737h
|
||||
matchers:
|
||||
- fireOnce=true
|
||||
receivers:
|
||||
- name: kvazaric_notifications
|
||||
telegram_configs:
|
||||
- send_resolved: true
|
||||
api_url: https://api.telegram.org
|
||||
bot_token: bot_token
|
||||
chat_id: -10000
|
||||
parse_mode: HTML
|
||||
message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
|
||||
http_config:
|
||||
follow_redirects: true
|
||||
enable_http2: false
|
||||
blackbox:
|
||||
enabled: true
|
||||
kube_state:
|
||||
enabled: true
|
||||
node:
|
||||
enabled: true
|
||||
visualization:
|
||||
enabled: true
|
||||
grafana:
|
||||
enabled: true
|
||||
expose:
|
||||
type: ingress # ingress or NodePort
|
||||
domain: grafana.disk.lt.t1.cloud
|
||||
# path: "/grafana"
|
||||
tls:
|
||||
enabled: true
|
||||
|
||||
cicd:
|
||||
enabled: true
|
||||
argo_cd:
|
||||
expose:
|
||||
type: ingress # ingress or NodePort
|
||||
domain: argocd.disk.lt.t1.cloud
|
||||
# path: "/cicd"
|
||||
tls:
|
||||
enabled: true
|
||||
rollouts:
|
||||
enabled: true
|
||||
updates_operator:
|
||||
enabled: true
|
||||
|
||||
secrets_storage:
|
||||
enabled: true
|
||||
key_shares: 5
|
||||
key_threshold: 3
|
||||
expose:
|
||||
type: ingress # ingress or NodePort
|
||||
domain: vault.disk.lt.t1.cloud
|
||||
tls:
|
||||
enabled: true
|
||||
csi_integration:
|
||||
enabled: true
|
||||
|
||||
registry:
|
||||
enabled: true
|
||||
expose:
|
||||
type: ingress # ingress or nodePort
|
||||
domain: harbor.disk.lt.t1.cloud
|
||||
tls:
|
||||
enabled: true
|
||||
enabled_scanner: true
|
||||
|
||||
additional:
|
||||
cert_manager:
|
||||
enabled: true
|
||||
account_email: adminmail@gmail.com
|
||||
ingress:
|
||||
enabled: true
|
||||
host_network: true
|
||||
account_email: g.stykalin@rockitsoft.ru
|
||||
storage:
|
||||
longhorn:
|
||||
enabled: true
|
||||
enabled: false
|
||||
secrets_store_csi_driver:
|
||||
enabled: true
|
||||
enabled: false
|
||||
|
||||
2
go.mod
2
go.mod
@@ -8,7 +8,7 @@ require (
|
||||
github.com/BurntSushi/toml v1.3.2
|
||||
github.com/Masterminds/sprig/v3 v3.2.3
|
||||
github.com/apenella/go-ansible v1.3.0
|
||||
github.com/apenella/go-ansible/v2 v2.0.0
|
||||
github.com/apenella/go-ansible/v2 v2.0.1
|
||||
github.com/ilyakaznacheev/cleanenv v1.5.0
|
||||
github.com/mittwald/go-helm-client v0.12.9
|
||||
github.com/sirupsen/logrus v1.9.3
|
||||
|
||||
4
go.sum
4
go.sum
@@ -28,8 +28,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
|
||||
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
|
||||
github.com/apenella/go-ansible v1.3.0 h1:INNaVzrgQMNIO9Yvnly6lA5KfN/pY3m1Z37gpmlUzPM=
|
||||
github.com/apenella/go-ansible v1.3.0/go.mod h1:qiLWolQqLkCoqFlPvdsKhxk7O0qjIBCPNhUKpH/vjaU=
|
||||
github.com/apenella/go-ansible/v2 v2.0.0 h1:9aZkU8dQ2fVITYX5V1CiQ3VX4PnNPBTgv31wJFd2Ito=
|
||||
github.com/apenella/go-ansible/v2 v2.0.0/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
|
||||
github.com/apenella/go-ansible/v2 v2.0.1 h1:9o3805u4NAIMf1px5EKpRS2LEa2aeQbMtHB7vilt7XE=
|
||||
github.com/apenella/go-ansible/v2 v2.0.1/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
|
||||
github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df h1:sEikY2P+NZK/7VZUwIsnXIGElhsuFDSxh1bZYwHxdcI=
|
||||
github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df/go.mod h1:cLVL6GjUiKG/WyBzX+KD6h/XRV/HnNZIZbMNNiBgQ9o=
|
||||
github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df h1:SvlYbjlsSQDS7hbVT1h012/zdgvcwWJ+Yd9XRiiY/8s=
|
||||
|
||||
@@ -1,108 +0,0 @@
|
||||
package cicd
|
||||
|
||||
import (
|
||||
"kube-forge/internal/config"
|
||||
"kube-forge/internal/helm_client"
|
||||
"kube-forge/internal/templates"
|
||||
"time"
|
||||
|
||||
go_helm_client "github.com/mittwald/go-helm-client"
|
||||
)
|
||||
|
||||
var HELM_REPOS = [...]config.RepoSettings{
|
||||
{
|
||||
Name: "kube-forge",
|
||||
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
|
||||
},
|
||||
}
|
||||
|
||||
func getArgoCdSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "argo-cd",
|
||||
ChartName: appConfig.Modules.Cicd.ArgoCd.ChartRef,
|
||||
Version: appConfig.Modules.Cicd.ArgoCd.ChartVersion,
|
||||
Namespace: appConfig.Modules.Cicd.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getArgoRolloutsSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "argo-rollouts",
|
||||
ChartName: appConfig.Modules.Cicd.Rollouts.ChartRef,
|
||||
Version: appConfig.Modules.Cicd.Rollouts.ChartVersion,
|
||||
Namespace: appConfig.Modules.Cicd.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getKeelSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "keel",
|
||||
ChartName: appConfig.Modules.Cicd.UpdatesOperator.ChartRef,
|
||||
Version: appConfig.Modules.Cicd.UpdatesOperator.ChartVersion,
|
||||
Namespace: appConfig.Modules.Cicd.UpdatesOperator.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getArgoCdIngressSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "argo-cd-ingress",
|
||||
ChartName: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef,
|
||||
Version: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion,
|
||||
Namespace: appConfig.Modules.Cicd.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func addCicdHelmRepos() {
|
||||
appConfig := config.GetConfig()
|
||||
for _, repoSettings := range HELM_REPOS {
|
||||
helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings)
|
||||
}
|
||||
}
|
||||
|
||||
func ApplyCharts() {
|
||||
addCicdHelmRepos()
|
||||
appConfig := config.GetConfig()
|
||||
if appConfig.Modules.Cicd.Enabled {
|
||||
helm_client.InstallChart(getArgoCdSpec())
|
||||
if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" {
|
||||
helm_client.InstallChart(getArgoCdIngressSpec())
|
||||
} else {
|
||||
helm_client.DeleteChart(getArgoCdIngressSpec())
|
||||
}
|
||||
if appConfig.Modules.Cicd.Rollouts.Enabled {
|
||||
helm_client.InstallChart(getArgoRolloutsSpec())
|
||||
} else {
|
||||
helm_client.DeleteChart(getArgoRolloutsSpec())
|
||||
}
|
||||
if appConfig.Modules.Cicd.UpdatesOperator.Enabled {
|
||||
helm_client.InstallChart(getKeelSpec())
|
||||
} else {
|
||||
helm_client.DeleteChart(getKeelSpec())
|
||||
}
|
||||
} else {
|
||||
helm_client.DeleteChart(getArgoCdIngressSpec())
|
||||
helm_client.DeleteChart(getArgoCdSpec())
|
||||
helm_client.DeleteChart(getArgoRolloutsSpec())
|
||||
helm_client.DeleteChart(getKeelSpec())
|
||||
}
|
||||
}
|
||||
@@ -30,13 +30,7 @@ type Config struct {
|
||||
Orchestrator Orchestrator `yaml:"orchestrator"`
|
||||
|
||||
Modules struct {
|
||||
AdminPassword string `yaml:"admin_password"`
|
||||
AdditionalRepositories interface{} `yaml:"additional_repositories"`
|
||||
Additional Additional `yaml:"additional"`
|
||||
Observability Observability `yaml:"observability"`
|
||||
Registry Registry `yaml:"registry"`
|
||||
Cicd Cicd `yaml:"cicd"`
|
||||
SecretsStorage SecretsStorage `yaml:"secrets_storage"`
|
||||
Additional Additional `yaml:"additional"`
|
||||
} `yaml:"modules"`
|
||||
}
|
||||
|
||||
@@ -54,9 +48,6 @@ func CreateConfig(configPath string, workDir string, password string) *Config {
|
||||
if password != "" {
|
||||
instance.Credentials.Password = password
|
||||
}
|
||||
|
||||
generateCreds(instance)
|
||||
|
||||
return instance
|
||||
}
|
||||
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
package config
|
||||
|
||||
type Cicd struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Namespace string `yaml:"namespace" env-default:"cicd"`
|
||||
ArgoCd struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"6.7.10"`
|
||||
AdminPassword string
|
||||
Ha struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Autoscaling bool `yaml:"autoscaling"`
|
||||
} `yaml:"ha"`
|
||||
Expose struct {
|
||||
Type string `yaml:"type"`
|
||||
Domain string `yaml:"domain"`
|
||||
Path string `yaml:"path" env-default:"/"`
|
||||
NodePortHttp int `yaml:"node_port_http" env-default:"30005"`
|
||||
NodePortHttps int `yaml:"node_port_https" env-default:"30006"`
|
||||
Tls struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
} `yaml:"tls"`
|
||||
} `yaml:"expose"`
|
||||
Repositories interface{} `yaml:"repositories"`
|
||||
Rbac struct {
|
||||
AdditionalPolicies string `yaml:"additional_policies"`
|
||||
} `yaml:"argo_cd"`
|
||||
ServiceIngress struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
|
||||
} `yaml:"service_ingress"`
|
||||
Global struct {
|
||||
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"global"`
|
||||
Server struct {
|
||||
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"server"`
|
||||
Redis struct {
|
||||
Image string `yaml:"image" env-default:"public.ecr.aws/docker/library/redis"`
|
||||
Tag string `yaml:"tag" env-default:"7.2.4-alpine"`
|
||||
Exporter struct {
|
||||
Image string `yaml:"image" env-default:"public.ecr.aws/bitnami/redis-exporter"`
|
||||
Tag string `yaml:"tag" env-default:"1.58.0"`
|
||||
} `yaml:"exporter"`
|
||||
} `yaml:"redis"`
|
||||
ApplicationSet struct {
|
||||
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"application_set"`
|
||||
Dex struct {
|
||||
Image string `yaml:"image" env-default:"ghcr.io/dexidp/dex"`
|
||||
Tag string `yaml:"tag" env-default:"v2.38.0"`
|
||||
} `yaml:"dex"`
|
||||
RepoServer struct {
|
||||
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"repo_server"`
|
||||
Notifications struct {
|
||||
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"notifications"`
|
||||
Controller struct {
|
||||
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"controller"`
|
||||
} `yaml:"argo_cd"`
|
||||
UpdatesOperator struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Namespace string `yaml:"namespace" env-default:"kube-system"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
} `yaml:"updates_operator"`
|
||||
Rollouts struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Registry string `yaml:"registry" env-default:"quay.io"`
|
||||
Repository string `yaml:"repository" env-default:"argoproj/argo-rollouts"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
Ha struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
} `yaml:"ha"`
|
||||
Expose struct {
|
||||
Type string `yaml:"type"`
|
||||
NodePort int `yaml:"node_port" env-default:"30010"`
|
||||
} `yaml:"expose"`
|
||||
Controller struct {
|
||||
} `yaml:"controller"`
|
||||
Dashboard struct {
|
||||
} `yaml:"dashboard"`
|
||||
} `yaml:"rollouts"`
|
||||
}
|
||||
@@ -1,179 +0,0 @@
|
||||
package config
|
||||
|
||||
type Observability struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/observability"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Logging Logging `yaml:"logging"`
|
||||
Tracing Tracing `yaml:"tracing"`
|
||||
Monitoring Monitoring `yaml:"monitoring"`
|
||||
Visualization Visualization `yaml:"visualization"`
|
||||
Namespace string `yaml:"namespace" env-default:"observability"`
|
||||
}
|
||||
|
||||
type Logging struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Operator struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/fluent-operator"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"2.7.0"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"`
|
||||
Tag string `yaml:"tag" env-default:"v2.7.0"`
|
||||
Namespace string `yaml:"namespace" env-default:"observability"`
|
||||
InitContainer struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"`
|
||||
Tag string `yaml:"tag" env-default:"20.10"`
|
||||
} `yaml:"initcontainer"`
|
||||
} `yaml:"operator"`
|
||||
Fluentd struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluentd"`
|
||||
Tag string `yaml:"tag" env-default:"v1.15.3"`
|
||||
} `yaml:"fluentd"`
|
||||
FluentBit struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-bit"`
|
||||
Tag string `yaml:"tag" env-default:"v2.2.2"`
|
||||
} `yaml:"fluent_bit"`
|
||||
Loki struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/loki"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"5.47.2"`
|
||||
Registry string `yaml:"registry" env-default:"harbor.kvazaric.ru"`
|
||||
Image string `yaml:"image" env-default:"kube-forge/grafana/loki"`
|
||||
Tag string `yaml:"tag" env-default:"latest"`
|
||||
Namespace string `yaml:"namespace" env-default:"observability"`
|
||||
Persistence struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
StorageSize string `yaml:"storage_size" env-default:"10Gi"`
|
||||
Retention string `yaml:"retention" env-default:"168h"`
|
||||
} `yaml:"persistence"`
|
||||
AlertManagerUrl string `yaml:"alert_manager_u rl" env-default:"http://observability-alert-manager:9093"`
|
||||
AdditionalRulesGroups string `yaml:"additional_rules_groups" env-default:""`
|
||||
} `yaml:"loki"`
|
||||
Events struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Exporter struct {
|
||||
Image string `yaml:"image" env-default:"ghcr.io/resmoio/kubernetes-event-exporter"`
|
||||
Tag string `yaml:"tag" env-default:"v1.4"`
|
||||
} `yaml:"exporter"`
|
||||
Cron struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kubectl"`
|
||||
Tag string `yaml:"tag" env-default:"1.27.5-debian-11-r8"`
|
||||
Schedule string `yaml:"schedule" env-default:"*/2 * * * *"`
|
||||
} `yaml:"cron"`
|
||||
} `yaml:"events"`
|
||||
}
|
||||
|
||||
type Tracing struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Operator struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/opentelemetry-operator"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
|
||||
Image string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
|
||||
Tag string `yaml:"tag" env-default:""`
|
||||
Namespace string `yaml:"namespace" env-default:"observability"`
|
||||
} `yaml:"operator"`
|
||||
Collector struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"`
|
||||
Tag string `yaml:"tag" env-default:"0.95.0"`
|
||||
} `yaml:"collector"`
|
||||
Tempo struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/tempo"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"`
|
||||
Tag string `yaml:"tag" env-default:"2.3.1"`
|
||||
Namespace string `yaml:"namespace" env-default:"observability"`
|
||||
Retention string `yaml:"retention" env-default:"24h"`
|
||||
ListenPort int `yaml:"listen_port" env-default:"3100"`
|
||||
Persistence struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
StorageSize string `yaml:"storage_size" env-default:"10Gi"`
|
||||
} `yaml:"persistence"`
|
||||
TempoQuery struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo-query"`
|
||||
Tag string `yaml:"tag" env-default:"2.3.1"`
|
||||
ListenPort int `yaml:"listen_port" env-default:"16686"`
|
||||
} `yaml:"tempo_query"`
|
||||
} `yaml:"tempo"`
|
||||
}
|
||||
|
||||
type Monitoring struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Prometheus struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/prometheus"`
|
||||
Tag string `yaml:"tag" env-default:"v2.45.0"`
|
||||
ScrapeInterval string `yaml:"scrape_interval" env-default:"15s"`
|
||||
Persistence struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
StorageSize string `yaml:"storage_size" env-default:"3Gi"`
|
||||
Retention string `yaml:"retention" env-default:"7d"`
|
||||
} `yaml:"persistence"`
|
||||
Operator struct {
|
||||
Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-operator"`
|
||||
Tag string `yaml:"tag" env-default:"v0.65.2"`
|
||||
ConfigReloader struct {
|
||||
Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-config-reloader"`
|
||||
Tag string `yaml:"tag" env-default:"v0.65.2"`
|
||||
} `yaml:"config_reloader"`
|
||||
KubeRbacProxy struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-rbac-proxy"`
|
||||
Tag string `yaml:"tag" env-default:"0.14.1"`
|
||||
} `yaml:"kube_rbac_proxy"`
|
||||
} `yaml:"operator"`
|
||||
} `yaml:"prometheus"`
|
||||
AlertManager struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/alertmanager"`
|
||||
Tag string `yaml:"tag" env-default:"v0.26.0"`
|
||||
AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"`
|
||||
Route interface{} `yaml:"route"`
|
||||
Receivers interface{} `yaml:"receivers"`
|
||||
} `yaml:"alert_manager"`
|
||||
Blackbox struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/blackbox-exporter"`
|
||||
Tag string `yaml:"tag" env-default:"v0.24.0"`
|
||||
AdditionalModules string `yaml:"routes" env-default:""`
|
||||
} `yaml:"blackbox"`
|
||||
KubeState struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-state-metrics"`
|
||||
Tag string `yaml:"tag" env-default:"2.9.2"`
|
||||
} `yaml:"kube_state"`
|
||||
Node struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/node-exporter"`
|
||||
Tag string `yaml:"tag" env-default:"v1.5.0"`
|
||||
} `yaml:"node"`
|
||||
MetricsServer struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
|
||||
Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
|
||||
Tag string `yaml:"tag" env-default:""`
|
||||
Namespace string `yaml:"namespace" env-default:"kube-system"`
|
||||
}
|
||||
}
|
||||
|
||||
type Visualization struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Grafana struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana"`
|
||||
Tag string `yaml:"tag" env-default:"10.4.1-v2"`
|
||||
Expose struct {
|
||||
Type string `yaml:"type" env-default:"ingress"`
|
||||
Domain string `yaml:"domain" env-default:""`
|
||||
Path string `yaml:"path" env-default:"/"`
|
||||
NodePortHttp int `yaml:"node_port_http" env-default:"30007"`
|
||||
Tls struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
}
|
||||
} `yaml:"expose"`
|
||||
Persistence struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
StorageSize string `yaml:"storage_size" env-default:"2Gi"`
|
||||
} `yaml:"persistence"`
|
||||
Config struct {
|
||||
Auth string `yaml:"auth" env-default:""`
|
||||
AuthGenericAuth string `yaml:"auth_generic_auth" env-default:""`
|
||||
AdditionalDatasources interface{} `yaml:"additional_datasources"`
|
||||
} `yaml:"config"`
|
||||
} `yaml:"grafana"`
|
||||
}
|
||||
@@ -1,66 +0,0 @@
|
||||
package config
|
||||
|
||||
type Registry struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/harbor"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"1.14.2"`
|
||||
Enabled bool `yaml:"enabled"`
|
||||
AdminPassword string
|
||||
Namespace string `yaml:"namespace" env-default:"registry"`
|
||||
Expose struct {
|
||||
Type string `yaml:"type" env-default:"nodePort"`
|
||||
Domain string `yaml:"domain" env-default:""`
|
||||
Path string `yaml:"path" env-default:"/"`
|
||||
NodePortHttp int `yaml:"node_port_http" env-default:"30002"`
|
||||
NodePortHttps int `yaml:"node_port_https" env-default:"30003"`
|
||||
} `yaml:"expose"`
|
||||
Tls struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
CertificateGenerator struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/certificate-generator"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
|
||||
} `yaml:"certificate_generator"`
|
||||
} `yaml:"tls"`
|
||||
Persistence struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
RegistrySize string `yaml:"registry_size" env-default:"10Gi"`
|
||||
JobserviceSize string `yaml:"jobservice_size" env-default:"1Gi"`
|
||||
DatabaseSize string `yaml:"database_size" env-default:"2Gi"`
|
||||
RedisSize string `yaml:"redis_size" env-default:"1Gi"`
|
||||
TrivySize string `yaml:"trivy_size" env-default:"5Gi"`
|
||||
} `yaml:"persistence"`
|
||||
EnabledScanner bool `yaml:"enabled_scanner"`
|
||||
Portal struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"portal"`
|
||||
Core struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-core"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"core"`
|
||||
Jobservice struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"jobservice"`
|
||||
Registry struct {
|
||||
Registry struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/registry-photon"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"registry"`
|
||||
Controller struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"controller"`
|
||||
} `yaml:"registry"`
|
||||
Trivy struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"trivy"`
|
||||
Database struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-db"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"database"`
|
||||
Redis struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/redis-photon"`
|
||||
Tag string `yaml:"tag" env-default:"v2.10.1"`
|
||||
} `yaml:"redis"`
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
package config
|
||||
|
||||
type SecretsStorage struct {
|
||||
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/vault"`
|
||||
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
|
||||
Namespace string `yaml:"namespace" env-default:"secrets-storage"`
|
||||
Enabled bool `yaml:"enabled"`
|
||||
KeyShares int `yaml:"key_shares" env-default:"5"`
|
||||
KeyThreshold int `yaml:"key_threshold" env-default:"3"`
|
||||
UnsealKeys []string `yaml:"unseal_keys" env-default:"[]"`
|
||||
AuthToken string `yaml:"auth_token" env-default:""`
|
||||
Expose struct {
|
||||
Type string `yaml:"type"`
|
||||
Domain string `yaml:"domain"`
|
||||
Path string `yaml:"path" env-default:"/"`
|
||||
NodePort int `yaml:"node_port"`
|
||||
Tls struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
} `yaml:"tls"`
|
||||
} `yaml:"expose"`
|
||||
CsiIntegration struct {
|
||||
Enabled bool `yaml:"enabled"`
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-csi-provider"`
|
||||
Tag string `yaml:"tag" env-default:"1.4.1"`
|
||||
} `yaml:"csi_integration"`
|
||||
Injector struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-k8s"`
|
||||
Tag string `yaml:"tag" env-default:"1.3.1"`
|
||||
} `yaml:"injector"`
|
||||
Server struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"`
|
||||
Tag string `yaml:"tag" env-default:"1.16.0"`
|
||||
Persistence struct {
|
||||
DataStorage struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
Size string `yaml:"size" env-default:"10Gi"`
|
||||
} `yaml:"data_storage"`
|
||||
AuditStorage struct {
|
||||
StorageClass string `yaml:"storage_class" env-default:"local-path"`
|
||||
Size string `yaml:"size" env-default:"10Gi"`
|
||||
} `yaml:"audit_storage"`
|
||||
} `yaml:"persistence"`
|
||||
} `yaml:"server"`
|
||||
Agent struct {
|
||||
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"`
|
||||
Tag string `yaml:"tag" env-default:"1.16.0"`
|
||||
} `yaml:"agent"`
|
||||
}
|
||||
@@ -12,16 +12,19 @@ type RegistryMirror struct {
|
||||
|
||||
type Orchestrator struct {
|
||||
Version string `yaml:"version" env-default:"v1.29.0"`
|
||||
ClusterName string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
|
||||
ClusterName string `yaml:"cluster_name" env-default:"cluster.local"`
|
||||
BinDir string `yaml:"bin_dir" env-default:"/usr/local/bin"`
|
||||
SysctlFilePath string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
|
||||
LoadbalancerApiserverPort int `yaml:"loadbalancer_apiserver_port" env-default:"6443"`
|
||||
Dns Dns `yaml:"dns"`
|
||||
CloudProvider string `yaml:"cloud_provider"`
|
||||
ExgernalCloudProvider string `yaml:"external_cloud_provider"`
|
||||
KubeletDir string `yaml:"kubelet_dir" env-default:"/var/lib/kubelet"`
|
||||
ContainerEngine struct {
|
||||
Type string `yaml:"type" env-default:"containerd"`
|
||||
Install bool `yaml:"install"`
|
||||
Type string `yaml:"type" env-default:"containerd"`
|
||||
Install bool `yaml:"install"`
|
||||
DataDir string `yaml:"data_dir" env-default:"/var/lib/containerd"`
|
||||
StateDir string `yaml:"state_dir" env-default:"/run/containerd"`
|
||||
} `yaml:"container_engine"`
|
||||
PingAccessIp bool `yaml:"ping_access_ip"`
|
||||
AutoRenewCertificates bool `yaml:"auto_renew_certificates"`
|
||||
|
||||
@@ -11,8 +11,3 @@ func getBcryptHash(input string) string {
|
||||
}
|
||||
return string(hashedPassword)
|
||||
}
|
||||
|
||||
func generateCreds(config *Config) {
|
||||
config.Modules.Cicd.ArgoCd.AdminPassword = getBcryptHash(config.Modules.AdminPassword)
|
||||
config.Modules.Registry.AdminPassword = config.Modules.AdminPassword
|
||||
}
|
||||
|
||||
@@ -21,3 +21,9 @@ func ScaleCluster() {
|
||||
runPlaybook("kubespray/project/scale.yml", "")
|
||||
CopyK8SAdminConfig(appConfig.KubeconfigFile)
|
||||
}
|
||||
|
||||
func ResetCluster() {
|
||||
appConfig := config.GetConfig()
|
||||
runPlaybook("kubespray/project/reset.yml", "")
|
||||
CopyK8SAdminConfig(appConfig.KubeconfigFile)
|
||||
}
|
||||
|
||||
@@ -1,122 +0,0 @@
|
||||
package observability
|
||||
|
||||
import (
|
||||
"kube-forge/internal/config"
|
||||
"kube-forge/internal/helm_client"
|
||||
"kube-forge/internal/templates"
|
||||
"time"
|
||||
|
||||
go_helm_client "github.com/mittwald/go-helm-client"
|
||||
)
|
||||
|
||||
var HELM_REPOS = []config.RepoSettings{
|
||||
{
|
||||
Name: "kube-forge",
|
||||
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
|
||||
},
|
||||
}
|
||||
|
||||
func getFluentOperatorSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "fluent-operator",
|
||||
ChartName: appConfig.Modules.Observability.Logging.Operator.ChartRef,
|
||||
Version: appConfig.Modules.Observability.Logging.Operator.ChartVersion,
|
||||
Namespace: appConfig.Modules.Observability.Logging.Operator.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
UpgradeCRDs: true,
|
||||
Timeout: time.Second * 60,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "opentelemetry-operator",
|
||||
ChartName: appConfig.Modules.Observability.Tracing.Operator.ChartRef,
|
||||
Version: appConfig.Modules.Observability.Tracing.Operator.ChartVersion,
|
||||
Namespace: appConfig.Modules.Observability.Tracing.Operator.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
UpgradeCRDs: true,
|
||||
Timeout: time.Second * 60,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getMetricsServerSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "metrics-server",
|
||||
ChartName: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef,
|
||||
Version: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion,
|
||||
Namespace: appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 60,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getTempoSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "tempo",
|
||||
ChartName: appConfig.Modules.Observability.Tracing.Tempo.ChartRef,
|
||||
Version: appConfig.Modules.Observability.Tracing.Tempo.ChartVersion,
|
||||
Namespace: appConfig.Modules.Observability.Tracing.Tempo.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 60,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getLokiSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "loki",
|
||||
ChartName: appConfig.Modules.Observability.Logging.Loki.ChartRef,
|
||||
Version: appConfig.Modules.Observability.Logging.Loki.ChartVersion,
|
||||
Namespace: appConfig.Modules.Observability.Logging.Loki.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 60,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getObservabilitySpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "observability",
|
||||
ChartName: appConfig.Modules.Observability.ChartRef,
|
||||
Version: appConfig.Modules.Observability.ChartVersion,
|
||||
Namespace: appConfig.Modules.Observability.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func ApplyCharts() {
|
||||
appConfig := config.GetConfig()
|
||||
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
|
||||
if appConfig.Modules.Observability.Enabled {
|
||||
if appConfig.Modules.Observability.Logging.Enabled {
|
||||
helm_client.InstallChart(getFluentOperatorSpec())
|
||||
helm_client.InstallChart(getLokiSpec())
|
||||
}
|
||||
if appConfig.Modules.Observability.Tracing.Enabled {
|
||||
helm_client.InstallChart(getOpenTelemetryOperatorSpec())
|
||||
helm_client.InstallChart(getTempoSpec())
|
||||
}
|
||||
if appConfig.Modules.Observability.Monitoring.Enabled {
|
||||
helm_client.InstallChart(getMetricsServerSpec())
|
||||
}
|
||||
helm_client.InstallChart(getObservabilitySpec())
|
||||
}
|
||||
}
|
||||
@@ -1,61 +0,0 @@
|
||||
package registry
|
||||
|
||||
import (
|
||||
"kube-forge/internal/config"
|
||||
"kube-forge/internal/helm_client"
|
||||
"kube-forge/internal/templates"
|
||||
"time"
|
||||
|
||||
go_helm_client "github.com/mittwald/go-helm-client"
|
||||
)
|
||||
|
||||
var HELM_REPOS = []config.RepoSettings{
|
||||
{
|
||||
Name: "kube-forge",
|
||||
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
|
||||
},
|
||||
}
|
||||
|
||||
func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "harbor-certificate-generator",
|
||||
ChartName: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef,
|
||||
Version: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion,
|
||||
Namespace: appConfig.Modules.Registry.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 60,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func getHarborSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "harbor",
|
||||
ChartName: appConfig.Modules.Registry.ChartRef,
|
||||
Version: appConfig.Modules.Registry.ChartVersion,
|
||||
Namespace: appConfig.Modules.Registry.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func ApplyCharts() {
|
||||
appConfig := config.GetConfig()
|
||||
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
|
||||
if appConfig.Modules.Registry.Enabled {
|
||||
if appConfig.Modules.Registry.Expose.Type == "ingress" {
|
||||
helm_client.InstallChart(getHarborCertificateGeneratorSpec())
|
||||
} else {
|
||||
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
|
||||
}
|
||||
helm_client.InstallChart(getHarborSpec())
|
||||
} else {
|
||||
helm_client.DeleteChart(getHarborSpec())
|
||||
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,24 +0,0 @@
|
||||
services:
|
||||
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
|
||||
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
|
||||
address: argo-cd-argocd-server
|
||||
port: 80
|
||||
secretName: argo-cd-server-tls
|
||||
|
||||
ingress:
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- end }}
|
||||
tls:
|
||||
enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
|
||||
useCertManager: true
|
||||
|
||||
# used if "useCertManager" is false
|
||||
crt: ""
|
||||
key: ""
|
||||
@@ -1,170 +0,0 @@
|
||||
crds:
|
||||
install: true
|
||||
|
||||
global:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
|
||||
|
||||
server:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
|
||||
certificateSecret:
|
||||
enabled: false
|
||||
{{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
|
||||
service:
|
||||
type: "NodePort"
|
||||
nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
|
||||
nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
|
||||
{{- end }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
{{- else }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
redis:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
|
||||
exporter:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
controller:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
|
||||
replicas: 1
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
applicationSet:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
dex:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
## check later
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
|
||||
repoServer:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
{{- else }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
notifications:
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
|
||||
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
configs:
|
||||
params:
|
||||
server.insecure: true
|
||||
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
|
||||
server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
|
||||
{{- end }}
|
||||
|
||||
secret:
|
||||
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
|
||||
|
||||
repositories:
|
||||
# add default helm-repository from harbor
|
||||
{{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
|
||||
|
||||
cm:
|
||||
create: true
|
||||
url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
|
||||
|
||||
accounts.developer: login
|
||||
accounts.guest: login
|
||||
|
||||
# oidc.config: ""
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
policy.csv: |
|
||||
p, role:admin, applications, create, */*, allow
|
||||
p, role:admin, applications, update, */*, allow
|
||||
p, role:admin, applications, delete, */*, allow
|
||||
p, role:admin, applications, sync, */*, allow
|
||||
p, role:admin, applications, override, */*, allow
|
||||
p, role:admin, applications, action/*, */*, allow
|
||||
p, role:admin, applicationsets, get, */*, allow
|
||||
p, role:admin, applicationsets, create, */*, allow
|
||||
p, role:admin, applicationsets, update, */*, allow
|
||||
p, role:admin, applicationsets, delete, */*, allow
|
||||
p, role:admin, certificates, create, *, allow
|
||||
p, role:admin, certificates, update, *, allow
|
||||
p, role:admin, certificates, delete, *, allow
|
||||
p, role:admin, clusters, create, *, allow
|
||||
p, role:admin, clusters, update, *, allow
|
||||
p, role:admin, clusters, delete, *, allow
|
||||
p, role:admin, repositories, create, *, allow
|
||||
p, role:admin, repositories, update, *, allow
|
||||
p, role:admin, repositories, delete, *, allow
|
||||
p, role:admin, projects, create, *, allow
|
||||
p, role:admin, projects, update, *, allow
|
||||
p, role:admin, projects, delete, *, allow
|
||||
p, role:admin, accounts, update, *, allow
|
||||
p, role:admin, gpgkeys, create, *, allow
|
||||
p, role:admin, gpgkeys, delete, *, allow
|
||||
p, role:admin, exec, create, */*, allow
|
||||
|
||||
{{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
|
||||
|
||||
|
||||
policy.default: role:''
|
||||
# scopes: "[roles,email,groups]"
|
||||
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
redis-ha:
|
||||
enabled: true
|
||||
{{- end }}
|
||||
@@ -1,424 +0,0 @@
|
||||
installCRDs: true
|
||||
keepCRDs: false
|
||||
clusterInstall: true
|
||||
createClusterAggregateRoles: true
|
||||
|
||||
apiVersionOverrides:
|
||||
# -- String to override apiVersion of ingresses rendered by this helm chart
|
||||
ingress: "" # networking.k8s.io/v1beta1
|
||||
|
||||
# -- Override the Kubernetes version, which is used to evaluate certain manifests
|
||||
kubeVersionOverride: ""
|
||||
|
||||
# -- Additional manifests to deploy within the chart. A list of objects.
|
||||
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
|
||||
extraObjects: []
|
||||
# - apiVersion: v1
|
||||
# kind: Secret
|
||||
# metadata:
|
||||
# name: datadog
|
||||
# type: Opaque
|
||||
# data:
|
||||
# address: https://api.datadoghq.com
|
||||
# api-key: <datadog-api-key>
|
||||
# app-key: <datadog-app-key>
|
||||
|
||||
global:
|
||||
# -- Annotations for all deployed Deployments
|
||||
deploymentAnnotations: {}
|
||||
|
||||
controller:
|
||||
# -- Value of label `app.kubernetes.io/component`
|
||||
component: rollouts-controller
|
||||
# -- Annotations to be added to the controller deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- Annotations to be added to application controller pods
|
||||
podAnnotations: {}
|
||||
# -- [Node selector]
|
||||
nodeSelector: {}
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules to the deployment
|
||||
affinity: {}
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the klog logging level
|
||||
kloglevel: "0"
|
||||
# -- Set the logging format (one of: `text`, `json`)
|
||||
format: "text"
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the controller
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- [priorityClassName] for the controller
|
||||
priorityClassName: ""
|
||||
# -- The number of controller pods to run
|
||||
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
|
||||
replicas: 3
|
||||
{{- else }}
|
||||
replicas: 1
|
||||
{{- end }}
|
||||
image:
|
||||
# -- Registry to use
|
||||
registry: {{ .Modules.Cicd.Rollouts.Registry }}
|
||||
# -- Repository to use
|
||||
repository: {{ .Modules.Cicd.Rollouts.Repository }}
|
||||
# -- Overrides the image tag (default is the chart appVersion)
|
||||
tag: {{ .Modules.Cicd.Rollouts.Tag }}
|
||||
# -- Image pull policy
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# -- flag to enable creation of cluster controller role (requires cluster RBAC)
|
||||
createClusterRole: true
|
||||
|
||||
# Controller container ports
|
||||
containerPorts:
|
||||
# -- Metrics container port
|
||||
metrics: 8090
|
||||
# -- Healthz container port
|
||||
healthz: 8080
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
metrics:
|
||||
# -- Deploy metrics service
|
||||
enabled: true
|
||||
service:
|
||||
# -- Metrics service port name
|
||||
portName: metrics
|
||||
# -- Metrics service port
|
||||
port: 8090
|
||||
# -- Service annotations
|
||||
annotations: {}
|
||||
serviceMonitor:
|
||||
# -- Enable a prometheus ServiceMonitor
|
||||
enabled: true
|
||||
# -- Namespace to be used for the ServiceMonitor
|
||||
namespace: ""
|
||||
# -- Labels to be added to the ServiceMonitor
|
||||
additionalLabels: {}
|
||||
# -- Annotations to be added to the ServiceMonitor
|
||||
additionalAnnotations: {}
|
||||
# -- RelabelConfigs to apply to samples before scraping
|
||||
relabelings: []
|
||||
# -- MetricRelabelConfigs to apply to samples before ingestion
|
||||
metricRelabelings: []
|
||||
{{- end }}
|
||||
|
||||
# -- Configure liveness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 20
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
|
||||
# -- Configure readiness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: metrics
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 4
|
||||
|
||||
## Configure Pod Disruption Budget for the controller
|
||||
pdb:
|
||||
# -- Labels to be added to controller [Pod Disruption Budget]
|
||||
labels: {}
|
||||
# -- Annotations to be added to controller [Pod Disruption Budget]
|
||||
annotations: {}
|
||||
# -- Deploy a [Pod Disruption Budget] for the controller
|
||||
enabled: false
|
||||
# -- Minimum number / percentage of pods that should remain scheduled
|
||||
minAvailable: # 1
|
||||
# -- Maximum number / percentage of pods that may be made unavailable
|
||||
maxUnavailable: # 0
|
||||
|
||||
# -- Additional volumes to add to the controller pod
|
||||
volumes: []
|
||||
# - configMap:
|
||||
# name: my-certs-cm
|
||||
# name: my-certs
|
||||
|
||||
# -- Additional volumeMounts to add to the controller container
|
||||
volumeMounts: []
|
||||
# - mountPath: /etc/ssl/certs
|
||||
# name: my-certs
|
||||
|
||||
# -- Configures 3rd party metric providers for controller
|
||||
## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
|
||||
metricProviderPlugins: {}
|
||||
# metricProviderPlugins: |-
|
||||
# - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
|
||||
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
|
||||
|
||||
# -- Configures 3rd party traffic router plugins for controller
|
||||
## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
|
||||
trafficRouterPlugins: {}
|
||||
# trafficRouterPlugins: |-
|
||||
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
|
||||
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
# -- Annotations to be added to all CRDs
|
||||
crdAnnotations: {}
|
||||
|
||||
# -- Annotations for the all deployed pods
|
||||
podAnnotations: {}
|
||||
|
||||
# -- Security Context to set on pod level
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
# -- Security Context to set on container level
|
||||
containerSecurityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
# -- Annotations to be added to the Rollout service
|
||||
serviceAnnotations: {}
|
||||
|
||||
# -- Labels to be added to the Rollout pods
|
||||
podLabels: {}
|
||||
|
||||
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
|
||||
imagePullSecrets: []
|
||||
# - name: argo-pull-secret
|
||||
|
||||
providerRBAC:
|
||||
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
|
||||
enabled: true
|
||||
# providerRBAC.enabled must be true in order to toggle the individual providers
|
||||
providers:
|
||||
# -- Adds RBAC rules for the Istio provider
|
||||
istio: true
|
||||
# -- Adds RBAC rules for the SMI provider
|
||||
smi: true
|
||||
# -- Adds RBAC rules for the Ambassador provider
|
||||
ambassador: true
|
||||
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
|
||||
awsLoadBalancerController: true
|
||||
# -- Adds RBAC rules for the AWS App Mesh provider
|
||||
awsAppMesh: true
|
||||
# -- Adds RBAC rules for the Traefik provider
|
||||
traefik: true
|
||||
# -- Adds RBAC rules for the Apisix provider
|
||||
apisix: true
|
||||
# -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
|
||||
contour: true
|
||||
# -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
|
||||
glooPlatform: true
|
||||
# -- Additional RBAC rules for others providers
|
||||
additionalRules: []
|
||||
|
||||
dashboard:
|
||||
# -- Deploy dashboard server
|
||||
enabled: true
|
||||
# -- Set cluster role to readonly
|
||||
readonly: false
|
||||
# -- Value of label `app.kubernetes.io/component`
|
||||
component: rollouts-dashboard
|
||||
# -- Annotations to be added to the dashboard deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- Annotations to be added to application dashboard pods
|
||||
podAnnotations: {}
|
||||
# -- [Node selector]
|
||||
nodeSelector: {}
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules to the deployment
|
||||
affinity: {}
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the klog logging level
|
||||
kloglevel: "0"
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- [priorityClassName] for the dashboard server
|
||||
priorityClassName: ""
|
||||
|
||||
# -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
|
||||
createClusterRole: true
|
||||
|
||||
# -- The number of dashboard pods to run
|
||||
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
|
||||
replicas: 3
|
||||
{{- else }}
|
||||
replicas: 1
|
||||
{{- end }}
|
||||
image:
|
||||
# -- Registry to use
|
||||
registry: quay.io
|
||||
# -- Repository to use
|
||||
repository: argoproj/kubectl-argo-rollouts
|
||||
# -- Overrides the image tag (default is the chart appVersion)
|
||||
tag: ""
|
||||
# -- Image pull policy
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
|
||||
extraArgs: []
|
||||
# -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
|
||||
extraEnv: []
|
||||
# - name: FOO
|
||||
# value: bar
|
||||
# -- Resource limits and requests for the dashboard pods.
|
||||
resources: {}
|
||||
# -- Security Context to set on pod level
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
# -- Security Context to set on container level
|
||||
containerSecurityContext: {}
|
||||
service:
|
||||
# -- Sets the type of the Service
|
||||
{{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
|
||||
type: NodePort
|
||||
nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
|
||||
{{- else }}
|
||||
type: ClusterIP
|
||||
nodePort:
|
||||
{{- end }}
|
||||
# -- LoadBalancer will get created with the IP specified in this field
|
||||
loadBalancerIP: ""
|
||||
# -- Source IP ranges to allow access to service from
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Dashboard service external IPs
|
||||
externalIPs: []
|
||||
# -- Service annotations
|
||||
annotations: {}
|
||||
# -- Service labels
|
||||
labels: {}
|
||||
# -- Service port name
|
||||
portName: dashboard
|
||||
# -- Service port
|
||||
port: 3100
|
||||
# -- Service target port
|
||||
targetPort: 3100
|
||||
# -- (int) Service nodePort
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a dashboard service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the dashboard service account
|
||||
annotations: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
## Configure Pod Disruption Budget for the dashboard
|
||||
pdb:
|
||||
# -- Labels to be added to dashboard [Pod Disruption Budget]
|
||||
labels: {}
|
||||
# -- Annotations to be added to dashboard [Pod Disruption Budget]
|
||||
annotations: {}
|
||||
# -- Deploy a [Pod Disruption Budget] for the dashboard
|
||||
enabled: false
|
||||
# -- Minimum number / percentage of pods that should remain scheduled
|
||||
minAvailable: # 1
|
||||
# -- Maximum number / percentage of pods that may be made unavailable
|
||||
maxUnavailable: # 0
|
||||
|
||||
## Ingress configuration.
|
||||
## ref: https://kubernetes.io/docs/user-guide/ingress/
|
||||
##
|
||||
ingress:
|
||||
# -- Enable dashboard ingress support
|
||||
enabled: false
|
||||
# -- Dashboard ingress annotations
|
||||
annotations: {}
|
||||
# -- Dashboard ingress labels
|
||||
labels: {}
|
||||
# -- Dashboard ingress class name
|
||||
ingressClassName: ""
|
||||
|
||||
# -- Dashboard ingress hosts
|
||||
## Argo Rollouts Dashboard Ingress.
|
||||
## Hostnames must be provided if Ingress is enabled.
|
||||
## Secrets must be manually created in the namespace
|
||||
hosts: []
|
||||
# - argorollouts.example.com
|
||||
|
||||
# -- Dashboard ingress paths
|
||||
paths:
|
||||
- /
|
||||
# -- Dashboard ingress path type
|
||||
pathType: Prefix
|
||||
# -- Dashboard ingress extra paths
|
||||
extraPaths: []
|
||||
# - path: /*
|
||||
# backend:
|
||||
# serviceName: ssl-redirect
|
||||
# servicePort: use-annotation
|
||||
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
|
||||
# - path: /*
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service
|
||||
# name: ssl-redirect
|
||||
# port:
|
||||
# name: use-annotation
|
||||
|
||||
# -- Dashboard ingress tls
|
||||
tls: []
|
||||
# - secretName: argorollouts-example-tls
|
||||
# hosts:
|
||||
# - argorollouts.example.com
|
||||
|
||||
# -- Additional volumes to add to the dashboard pod
|
||||
volumes: []
|
||||
|
||||
# -- Additional volumeMounts to add to the dashboard container
|
||||
volumeMounts: []
|
||||
|
||||
notifications:
|
||||
secret:
|
||||
# -- Whether to create notifications secret
|
||||
create: false
|
||||
# -- Generic key:value pairs to be inserted into the notifications secret
|
||||
items: {}
|
||||
# slack-token:
|
||||
|
||||
# -- Configures notification services
|
||||
notifiers: {}
|
||||
# service.slack: |
|
||||
# token: $slack-token
|
||||
|
||||
# -- Notification templates
|
||||
templates: {}
|
||||
|
||||
# -- The trigger defines the condition when the notification should be sent
|
||||
triggers: {}
|
||||
# trigger.on-purple: |
|
||||
# - send: [my-purple-template]
|
||||
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
|
||||
@@ -1,245 +0,0 @@
|
||||
image:
|
||||
repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
|
||||
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
|
||||
pullPolicy: Always
|
||||
|
||||
# Enable insecure registries
|
||||
insecureRegistry: false
|
||||
|
||||
# Polling is enabled by default,
|
||||
# you can disable it setting value below to false
|
||||
polling:
|
||||
enabled: true
|
||||
defaultSchedule: "@every 1m"
|
||||
|
||||
# Extra Containers to run alongside Keel
|
||||
# extraContainers:
|
||||
# - name: busybox
|
||||
# image: busybox
|
||||
# imagePullPolicy: IfNotPresent
|
||||
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
|
||||
|
||||
# Helm provider support
|
||||
helmProvider:
|
||||
enabled: true
|
||||
# set to version "v3" for Helm v3
|
||||
version: "v2"
|
||||
tillerNamespace: "kube-system"
|
||||
# optional Tiller address (if portforwarder tunnel doesn't work),
|
||||
# if you are using default configuration, setting it to
|
||||
# 'tiller-deploy:44134' is usually fine
|
||||
tillerAddress: 'tiller-deploy:44134'
|
||||
# helmDriver: ''
|
||||
# helmDriverSqlConnectionString: ''
|
||||
|
||||
# Google Container Registry
|
||||
# GCP Project ID
|
||||
gcr:
|
||||
enabled: false
|
||||
projectId: ""
|
||||
gcpServiceAccount: ""
|
||||
clusterName: ""
|
||||
pubSub:
|
||||
enabled: false
|
||||
|
||||
# Notification level (debug, info, success, warn, error, fatal)
|
||||
notificationLevel: info
|
||||
|
||||
# AWS Elastic Container Registry
|
||||
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
|
||||
ecr:
|
||||
enabled: false
|
||||
roleArn: ""
|
||||
accessKeyId: ""
|
||||
secretAccessKey: ""
|
||||
region: ""
|
||||
|
||||
# Webhook Notification
|
||||
# Remote webhook endpoint for notification delivery
|
||||
webhook:
|
||||
enabled: false
|
||||
endpoint: ""
|
||||
|
||||
# Slack Notification
|
||||
# bot name (default keel) must exist!
|
||||
slack:
|
||||
enabled: false
|
||||
botName: ""
|
||||
token: ""
|
||||
channel: ""
|
||||
approvalsChannel: ""
|
||||
|
||||
# Hipchat notification and approvals
|
||||
hipchat:
|
||||
enabled: false
|
||||
token: ""
|
||||
channel: ""
|
||||
approvalsChannel: ""
|
||||
botName: ""
|
||||
userName: ""
|
||||
password: ""
|
||||
|
||||
# Mattermost notifications
|
||||
mattermost:
|
||||
enabled: false
|
||||
endpoint: ""
|
||||
|
||||
# MS Teams notifications
|
||||
teams:
|
||||
enabled: false
|
||||
webhookUrl: ""
|
||||
|
||||
# Discord notifications
|
||||
discord:
|
||||
enabled: false
|
||||
webhookUrl: ""
|
||||
|
||||
# Mail notifications
|
||||
mail:
|
||||
enabled: false
|
||||
from: ""
|
||||
to: ""
|
||||
smtp:
|
||||
server: ""
|
||||
port: 25
|
||||
user: ""
|
||||
pass: ""
|
||||
|
||||
# Basic auth on approvals
|
||||
basicauth:
|
||||
enabled: true
|
||||
user: "admin"
|
||||
password: "{{ .Modules.AdminPassword }}"
|
||||
|
||||
# Keel service
|
||||
# Enable to receive webhooks from Docker registries
|
||||
service:
|
||||
enabled: false
|
||||
type: LoadBalancer
|
||||
externalPort: 9300
|
||||
clusterIP: ""
|
||||
|
||||
# Webhook Relay service
|
||||
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
|
||||
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
|
||||
webhookRelay:
|
||||
enabled: false
|
||||
bucket: ""
|
||||
# webhookrelay.com credentials
|
||||
# Set the key and secret values here to create the keel-webhookrelay secret with this
|
||||
# chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
|
||||
key: ""
|
||||
secret: ""
|
||||
# webhookrelay docker image
|
||||
image:
|
||||
repository: webhookrelay/webhookrelayd
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Use a secret file to define passwords and tokens of third parties.
|
||||
secret:
|
||||
# Leave blank to use `keel.fullname`
|
||||
name: ""
|
||||
# Set to false to manage your own secret file, with terraform for example.
|
||||
create: true
|
||||
|
||||
# Keel self-update
|
||||
# uncomment lines below if you want Keel to automaticly
|
||||
# self-update to the latest release version
|
||||
# keel:
|
||||
# # keel policy (all/major/minor/patch/force)
|
||||
# policy: patch
|
||||
# # trigger type, defaults to events such as pubsub, webhooks
|
||||
# trigger: poll
|
||||
# # polling schedule
|
||||
# pollSchedule: "@every 3m"
|
||||
# # images to track and update
|
||||
# images:
|
||||
# - repository: image.repository
|
||||
# tag: image.tag
|
||||
|
||||
# RBAC manifests management
|
||||
rbac:
|
||||
enabled: true
|
||||
serviceAccount:
|
||||
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
|
||||
# name:
|
||||
# Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
|
||||
# If rbac.serviceAccount.name is not set, a new name for the service account is generated
|
||||
create: true
|
||||
|
||||
# Resources
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
|
||||
# NodeSelector
|
||||
nodeSelector: {}
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: {}
|
||||
|
||||
# base64 encoded json of GCP service account
|
||||
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
|
||||
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
|
||||
googleApplicationCredentials: ""
|
||||
|
||||
# Enable DEBUG logging
|
||||
debug: false
|
||||
|
||||
# This is used by the static manifest generator in order to create a static
|
||||
# namespace manifest for the namespace that keel is being installed
|
||||
# within. It should **not** be used if you are using Helm for deployment.
|
||||
createNamespaceResource: false
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
serviceAnnotations: {}
|
||||
# Useful for making the load balancer internal
|
||||
# serviceAnnotations:
|
||||
# cloud.google.com/load-balancer-type: Internal
|
||||
|
||||
aws:
|
||||
region: null
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
maxUnavailable: 1
|
||||
minAvailable: null
|
||||
|
||||
# Google Cloud Certificates
|
||||
gcloud:
|
||||
managedCertificates:
|
||||
enabled: false
|
||||
domains:
|
||||
- ""
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
labels: {}
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
hosts: []
|
||||
# - host: chart-example.local
|
||||
# paths:
|
||||
# - /
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
dockerRegistry:
|
||||
enabled: false
|
||||
name: ""
|
||||
key: ""
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
storageClass: "-"
|
||||
size: 1Gi
|
||||
@@ -1,55 +0,0 @@
|
||||
# Set this to containerd or crio if you want to collect CRI format logs
|
||||
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
|
||||
Kubernetes: false
|
||||
|
||||
operator:
|
||||
initcontainer:
|
||||
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
container:
|
||||
repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 60Mi
|
||||
imagePullSecrets: []
|
||||
labels: {}
|
||||
logPath:
|
||||
# The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
|
||||
# crio: /var/log
|
||||
containerd: /var/log
|
||||
disableComponentControllers: ""
|
||||
|
||||
fluentbit:
|
||||
crdsEnable: true
|
||||
enable: false
|
||||
|
||||
fluentd:
|
||||
crdsEnable: true
|
||||
enable: false
|
||||
name: fluentd
|
||||
# Valid modes include "collector" and "agent".
|
||||
# The "collector" mode will deploy Fluentd as a StatefulSet as before.
|
||||
# The new "agent" mode will deploy Fluentd as a DaemonSet.
|
||||
mode: "agent"
|
||||
port: 24224
|
||||
image:
|
||||
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
namespaceOverride: ""
|
||||
@@ -1,188 +0,0 @@
|
||||
loki:
|
||||
image:
|
||||
registry: {{ .Modules.Observability.Logging.Loki.Registry }}
|
||||
repository: {{ .Modules.Observability.Logging.Loki.Image }}
|
||||
tag: {{ .Modules.Observability.Logging.Loki.Tag }}
|
||||
podAnnotations:
|
||||
app.kubernetes.io/component: "loki"
|
||||
auth_enabled: false
|
||||
commonConfig:
|
||||
replication_factor: 1
|
||||
storage:
|
||||
type: 'filesystem'
|
||||
|
||||
frontend:
|
||||
max_outstanding_per_tenant: 10000
|
||||
|
||||
limits_config:
|
||||
reject_old_samples: false
|
||||
split_queries_by_interval: 15m
|
||||
max_query_parallelism: 32
|
||||
max_query_series: 10000
|
||||
retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
|
||||
|
||||
compactor:
|
||||
compaction_interval: 10m
|
||||
retention_enabled: true
|
||||
retention_delete_delay: 2h
|
||||
|
||||
querier:
|
||||
max_concurrent: 2048
|
||||
|
||||
query_scheduler:
|
||||
max_outstanding_requests_per_tenant: 10000
|
||||
|
||||
rulerConfig:
|
||||
storage:
|
||||
type: local
|
||||
local:
|
||||
directory: /var/loki/rules
|
||||
rule_path: /tmp/rules
|
||||
|
||||
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
|
||||
|
||||
|
||||
singleBinary:
|
||||
replicas: 1
|
||||
|
||||
extraVolumes:
|
||||
- name: loki-default-rules
|
||||
configMap:
|
||||
name: loki-default-alerting-rules
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: loki-default-rules
|
||||
mountPath: /var/loki/rules
|
||||
|
||||
|
||||
write:
|
||||
persistence:
|
||||
volumeClaimsEnabled: true
|
||||
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
|
||||
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
|
||||
|
||||
test:
|
||||
enabled: false
|
||||
|
||||
gateway:
|
||||
enabled: false
|
||||
|
||||
monitoring:
|
||||
selfMonitoring:
|
||||
enabled: false
|
||||
grafanaAgent:
|
||||
installOperator: false
|
||||
lokiCanary:
|
||||
enabled: false
|
||||
rules:
|
||||
enabled: true
|
||||
alerting: true
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: loki-default-alerting-rules
|
||||
labels:
|
||||
loki_rule: ""
|
||||
|
||||
data:
|
||||
loki-default-alerting-rules.yaml: |-
|
||||
groups:
|
||||
{{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
|
||||
- name: kube-events-alerts
|
||||
rules:
|
||||
- alert: FailedEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: FailedEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: Failed events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: OOMKilledEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: OOMKilledEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: OOMKilled events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: EvictedEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: EvictedEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: Evicted events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: ImagePullBackOffEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: ImagePullBackOffEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: ImagePullBackOff events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: BackOffEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: BackOffEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: BackOff events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
sidecar:
|
||||
rules:
|
||||
enabled: true
|
||||
# -- Label that the configmaps/secrets with rules will be marked with.
|
||||
label: loki_rule
|
||||
# -- Label value that the configmaps/secrets with rules will be set to.
|
||||
labelValue: ""
|
||||
# -- Folder into which the rules will be placed.
|
||||
folder: /var/loki/rules
|
||||
# -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
|
||||
# Otherwise the namespace in which the sidecar is running will be used.
|
||||
# It's also possible to specify 'ALL' to search in all namespaces.
|
||||
searchNamespace: 'ALL'
|
||||
# -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
|
||||
watchMethod: WATCH
|
||||
# -- Search in configmap, secret, or both.
|
||||
resource: both
|
||||
# -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
|
||||
script: null
|
||||
# -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
|
||||
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
|
||||
watchServerTimeout: 60
|
||||
#
|
||||
# -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
|
||||
# If you have a network outage dropping all packets with no RST/FIN,
|
||||
# this is how long your client waits before realizing & dropping the connection.
|
||||
# Defaults to 66sec.
|
||||
watchClientTimeout: 60
|
||||
# -- Log level of the sidecar container.
|
||||
logLevel: INFO
|
||||
@@ -1,192 +0,0 @@
|
||||
image:
|
||||
repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
# - name: registrySecretName
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
# The list of secrets mountable by this service account.
|
||||
# See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
|
||||
secrets: []
|
||||
|
||||
rbac:
|
||||
# Specifies whether RBAC resources should be created
|
||||
create: true
|
||||
pspEnabled: false
|
||||
|
||||
apiService:
|
||||
create: true
|
||||
# Annotations to add to the API service
|
||||
annotations: {}
|
||||
# Specifies whether to skip TLS verification
|
||||
insecureSkipTLSVerify: true
|
||||
# The PEM encoded CA bundle for TLS verification
|
||||
caBundle: ""
|
||||
|
||||
commonLabels: {}
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "metrics-server"
|
||||
podAnnotations: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
priorityClassName: system-cluster-critical
|
||||
|
||||
containerPort: 10250
|
||||
|
||||
hostNetwork:
|
||||
# Specifies if metrics-server should be started in hostNetwork mode.
|
||||
#
|
||||
# You would require this enabled if you use alternate overlay networking for pods and
|
||||
# API server unable to communicate with metrics-server. As an example, this is required
|
||||
# if you use Weave network on EKS
|
||||
enabled: false
|
||||
|
||||
replicas: 1
|
||||
|
||||
revisionHistoryLimit:
|
||||
|
||||
updateStrategy: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxSurge: 0
|
||||
# maxUnavailable: 1
|
||||
|
||||
podDisruptionBudget:
|
||||
# https://kubernetes.io/docs/tasks/run-application/configure-pdb/
|
||||
enabled: false
|
||||
minAvailable:
|
||||
maxUnavailable:
|
||||
|
||||
defaultArgs:
|
||||
- --cert-dir=/tmp
|
||||
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
|
||||
- --kubelet-use-node-status-port
|
||||
- --metric-resolution=15s
|
||||
- --kubelet-insecure-tls
|
||||
|
||||
args: []
|
||||
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: https
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: https
|
||||
scheme: HTTPS
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
labels: {}
|
||||
# Add these labels to have metrics-server show up in `kubectl cluster-info`
|
||||
# kubernetes.io/cluster-service: "true"
|
||||
# kubernetes.io/name: "Metrics-server"
|
||||
|
||||
addonResizer:
|
||||
enabled: false
|
||||
image:
|
||||
repository: registry.k8s.io/autoscaling/addon-resizer
|
||||
tag: 1.8.20
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 40m
|
||||
memory: 25Mi
|
||||
limits:
|
||||
cpu: 40m
|
||||
memory: 25Mi
|
||||
nanny:
|
||||
cpu: 0m
|
||||
extraCpu: 1m
|
||||
memory: 0Mi
|
||||
extraMemory: 2Mi
|
||||
minClusterSize: 100
|
||||
pollPeriod: 300000
|
||||
threshold: 5
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
additionalLabels: {}
|
||||
interval: 1m
|
||||
scrapeTimeout: 10s
|
||||
metricRelabelings: []
|
||||
relabelings: []
|
||||
|
||||
# See https://github.com/kubernetes-sigs/metrics-server#scaling
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 200Mi
|
||||
# limits:
|
||||
# cpu:
|
||||
# memory:
|
||||
|
||||
extraVolumeMounts: []
|
||||
|
||||
extraVolumes: []
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
dnsConfig: {}
|
||||
|
||||
# Annotations to add to the deployment
|
||||
deploymentAnnotations: {}
|
||||
|
||||
schedulerName: ""
|
||||
|
||||
tmpVolume:
|
||||
emptyDir: {}
|
||||
|
||||
@@ -1,391 +0,0 @@
|
||||
prometheus:
|
||||
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor: true
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
clustering:
|
||||
enabled: false
|
||||
replicas: 3
|
||||
shards: 1
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
|
||||
storageResources:
|
||||
requests:
|
||||
storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
|
||||
|
||||
scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
|
||||
retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
|
||||
# serviceNodePort: 30008
|
||||
|
||||
additionalConfigs: |
|
||||
- job_name: "kubelet"
|
||||
scheme: https
|
||||
metrics_path: /metrics/cadvisor
|
||||
tls_config:
|
||||
insecure_skip_verify: true
|
||||
authorization:
|
||||
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
kubernetes_sd_configs:
|
||||
- role: node
|
||||
relabel_configs:
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_node_label_(.+)
|
||||
|
||||
- job_name: "kubernetes-apiservers"
|
||||
kubernetes_sd_configs:
|
||||
- role: endpoints
|
||||
scheme: https
|
||||
tls_config:
|
||||
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
authorization:
|
||||
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
relabel_configs:
|
||||
- source_labels:
|
||||
[
|
||||
__meta_kubernetes_namespace,
|
||||
__meta_kubernetes_service_name,
|
||||
__meta_kubernetes_endpoint_port_name,
|
||||
]
|
||||
action: keep
|
||||
regex: default;kubernetes;https
|
||||
|
||||
- job_name: "coredns"
|
||||
kubernetes_sd_configs:
|
||||
- role: endpoints
|
||||
scheme: http
|
||||
relabel_configs:
|
||||
- source_labels:
|
||||
[
|
||||
__meta_kubernetes_namespace,
|
||||
__meta_kubernetes_service_name,
|
||||
__meta_kubernetes_endpoint_port_name,
|
||||
]
|
||||
action: keep
|
||||
regex: kube-system;.*dns.*;metrics
|
||||
|
||||
{{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
|
||||
- job_name: 'ingress-endpoints'
|
||||
metrics_path: /probe
|
||||
params:
|
||||
module: [https_ok]
|
||||
kubernetes_sd_configs:
|
||||
- role: ingress
|
||||
relabel_configs:
|
||||
- source_labels: [__address__]
|
||||
target_label: __param_target
|
||||
- source_labels: [__param_target]
|
||||
target_label: instance
|
||||
- source_labels:
|
||||
[
|
||||
__meta_kubernetes_ingress_scheme,
|
||||
__address__,
|
||||
__meta_kubernetes_ingress_path,
|
||||
]
|
||||
regex: (.+);(.+);(.+)
|
||||
replacement: https://${2}${3}/
|
||||
target_label: __param_target
|
||||
- target_label: __address__
|
||||
replacement: observability-blackbox-exporter:9115
|
||||
{{- end }}
|
||||
|
||||
alertManager:
|
||||
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
|
||||
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
enableDefaultRules: true
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# serviceNodePort: 30009
|
||||
|
||||
configPath: /etc/alertmanager
|
||||
{{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
|
||||
additionalMessageTemplates:
|
||||
{{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Modules.Observability.Monitoring.AlertManager.Route }}
|
||||
route:
|
||||
{{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
|
||||
receivers:
|
||||
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
blackboxExporter:
|
||||
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
|
||||
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# serviceNodePort: 30012
|
||||
|
||||
configPath: /etc/blackbox_exporter
|
||||
additionalModules:
|
||||
|
||||
|
||||
kubeStateMetrics:
|
||||
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 30m
|
||||
memory: 120Mi
|
||||
limits:
|
||||
memory: 240Mi
|
||||
cpu: 60m
|
||||
|
||||
prometheusOperator:
|
||||
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
prometheusConfigReloader:
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
kubeRbacProxy:
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
nodeExporter:
|
||||
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Node.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
kubeEventsExporter:
|
||||
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
|
||||
tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
lokiAddress: http://loki.observability.svc.cluster.local:3100
|
||||
logLevel: warn
|
||||
logFormat: json
|
||||
kubeQPS: 100
|
||||
kubeBurst: 500
|
||||
maxEventAgeSeconds: 120
|
||||
metricsNamePrefix: event_exporter_
|
||||
|
||||
cron:
|
||||
restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
|
||||
tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
additionalRoutes:
|
||||
additionalReceivers:
|
||||
|
||||
grafana:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
|
||||
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
|
||||
path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
|
||||
{{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
|
||||
serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
|
||||
{{- end }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
|
||||
tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
|
||||
storageResources:
|
||||
requests:
|
||||
storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
|
||||
|
||||
config:
|
||||
server: |
|
||||
enable_gzip = true
|
||||
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
|
||||
{{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }}
|
||||
serve_from_sub_path = true
|
||||
{{- end }}
|
||||
|
||||
security: |
|
||||
admin_user = admin
|
||||
admin_password = {{ .Modules.AdminPassword }}
|
||||
|
||||
auth: |
|
||||
{{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
|
||||
|
||||
authGenericAuth: |
|
||||
{{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
|
||||
|
||||
additionalDatasources:
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
|
||||
- name: Kube-loki
|
||||
type: loki
|
||||
uid: P2895588539814C92
|
||||
access: proxy
|
||||
url: http://loki:3100
|
||||
editable: false
|
||||
basicAuth: false
|
||||
isDefault: false
|
||||
jsonData:
|
||||
maxLines: 1000
|
||||
{{- end }}
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
- name: Kube-jaeger-query
|
||||
type: jaeger
|
||||
access: proxy
|
||||
url: http://tempo:16686
|
||||
editable: false
|
||||
basicAuth: false
|
||||
isDefault: false
|
||||
{{- end }}
|
||||
{{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
|
||||
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
|
||||
{{- end }}
|
||||
|
||||
opentelemetryCollector:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
serviceMonitor: true
|
||||
config: |
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
grpc:
|
||||
http:
|
||||
exporters:
|
||||
otlphttp:
|
||||
endpoint: http://tempo:4318
|
||||
service:
|
||||
telemetry:
|
||||
logs:
|
||||
level: "debug"
|
||||
pipelines:
|
||||
traces:
|
||||
receivers: [otlp]
|
||||
exporters: [otlphttp]
|
||||
|
||||
ingress:
|
||||
{{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
|
||||
enabled: true
|
||||
{{- else }}
|
||||
enabled: false
|
||||
{{- end }}
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
{{- end }}
|
||||
tls:
|
||||
{{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
hosts:
|
||||
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
|
||||
secretName: grafana-tls
|
||||
|
||||
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
|
||||
|
||||
fluentbit:
|
||||
enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
|
||||
serviceMonitor: true
|
||||
image:
|
||||
repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/edge
|
||||
operator: DoesNotExist
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
|
||||
input:
|
||||
tail:
|
||||
enable: true
|
||||
refreshIntervalSeconds: 10
|
||||
memBufLimit: 100MB
|
||||
bufferMaxSize: ""
|
||||
path: "/var/log/containers/*.log"
|
||||
skipLongLines: true
|
||||
readFromHead: false
|
||||
storageType: memory
|
||||
pauseOnChunksOverlimit: "off"
|
||||
systemd:
|
||||
enable: true
|
||||
systemdFilter:
|
||||
enable: true
|
||||
filters: []
|
||||
path: "/var/log/journal"
|
||||
includeKubelet: true
|
||||
stripUnderscores: "off"
|
||||
storageType: memory
|
||||
pauseOnChunksOverlimit: "off"
|
||||
|
||||
nodeExporterMetrics: {}
|
||||
fluentBitMetrics: {}
|
||||
|
||||
output:
|
||||
es:
|
||||
enable: false
|
||||
host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
|
||||
port: 9200
|
||||
logstashPrefix: ks-logstash-log
|
||||
bufferSize: 20MB
|
||||
traceError: true
|
||||
kafka:
|
||||
enable: false
|
||||
brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
|
||||
topics: ks-log
|
||||
opentelemetry: {}
|
||||
opensearch:
|
||||
enable: false
|
||||
stdout:
|
||||
enable: false
|
||||
loki:
|
||||
enable: true
|
||||
host: loki
|
||||
port: 3100
|
||||
|
||||
stackdriver: {}
|
||||
|
||||
service:
|
||||
storage: {}
|
||||
|
||||
filter:
|
||||
kubernetes:
|
||||
enable: true
|
||||
labels: true
|
||||
annotations: true
|
||||
containerd:
|
||||
enable: true
|
||||
systemd:
|
||||
enable: true
|
||||
|
||||
kubeedge:
|
||||
enable: false
|
||||
prometheusRemoteWrite:
|
||||
# Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
|
||||
host: "<cloud-prometheus-service-host>"
|
||||
# Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
|
||||
port: "<cloud-prometheus-service-port>"
|
||||
@@ -1,134 +0,0 @@
|
||||
replicaCount: 1
|
||||
nameOverride: ""
|
||||
imagePullSecrets: []
|
||||
pdb:
|
||||
create: false
|
||||
minAvailable: 1
|
||||
maxUnavailable: ""
|
||||
|
||||
manager:
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Tracing.Operator.Image }}
|
||||
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
|
||||
collectorImage:
|
||||
repository: {{ .Modules.Observability.Tracing.Collector.Image }}
|
||||
tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
|
||||
|
||||
featureGates: ""
|
||||
ports:
|
||||
metricsPort: 8080
|
||||
webhookPort: 9443
|
||||
healthzPort: 8081
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
env:
|
||||
ENABLE_WEBHOOKS: "true"
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
metricsEndpoints:
|
||||
- port: metrics
|
||||
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
groups: []
|
||||
defaultRules:
|
||||
enabled: true
|
||||
|
||||
extraArgs: []
|
||||
|
||||
leaderElection:
|
||||
enabled: true
|
||||
|
||||
verticalPodAutoscaler:
|
||||
enabled: false
|
||||
controlledResources: []
|
||||
maxAllowed: {}
|
||||
minAllowed: {}
|
||||
|
||||
updatePolicy:
|
||||
updateMode: Auto
|
||||
minReplicas: 2
|
||||
rolling: false
|
||||
|
||||
securityContext: {}
|
||||
|
||||
kubeRBACProxy:
|
||||
enabled: true
|
||||
image:
|
||||
repository: quay.io/brancz/kube-rbac-proxy
|
||||
tag: v0.15.0
|
||||
ports:
|
||||
proxyPort: 8443
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
|
||||
extraArgs: []
|
||||
|
||||
securityContext: {}
|
||||
|
||||
admissionWebhooks:
|
||||
create: true
|
||||
servicePort: 443
|
||||
failurePolicy: Fail
|
||||
secretName: ""
|
||||
pods:
|
||||
failurePolicy: Ignore
|
||||
|
||||
namePrefix: ""
|
||||
|
||||
timeoutSeconds: 10
|
||||
|
||||
namespaceSelector: {}
|
||||
objectSelector: {}
|
||||
certManager:
|
||||
enabled: true
|
||||
issuerRef: {}
|
||||
certificateAnnotations: {}
|
||||
issuerAnnotations: {}
|
||||
|
||||
autoGenerateCert:
|
||||
enabled: true
|
||||
recreate: true
|
||||
|
||||
secretAnnotations: {}
|
||||
secretLabels: {}
|
||||
|
||||
role:
|
||||
create: true
|
||||
|
||||
clusterRole:
|
||||
create: true
|
||||
|
||||
affinity: {}
|
||||
tolerations: []
|
||||
nodeSelector: {}
|
||||
topologySpreadConstraints: []
|
||||
hostNetwork: false
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
securityContext:
|
||||
runAsGroup: 65532
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
fsGroup: 65532
|
||||
|
||||
testFramework:
|
||||
image:
|
||||
repository: busybox
|
||||
tag: latest
|
||||
@@ -1,68 +0,0 @@
|
||||
replicas: 1
|
||||
|
||||
tempo:
|
||||
repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
|
||||
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
memBallastSizeMbs: 1024
|
||||
multitenancyEnabled: false
|
||||
reportingEnabled: false
|
||||
|
||||
metricsGenerator:
|
||||
enabled: false
|
||||
remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
|
||||
retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
|
||||
global_overrides:
|
||||
per_tenant_override_config: /conf/overrides.yaml
|
||||
|
||||
server:
|
||||
http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
|
||||
storage:
|
||||
trace:
|
||||
backend: local
|
||||
local:
|
||||
path: /var/tempo/traces
|
||||
wal:
|
||||
path: /var/tempo/wal
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
grpc:
|
||||
endpoint: "0.0.0.0:4317"
|
||||
http:
|
||||
endpoint: "0.0.0.0:4318"
|
||||
|
||||
tempoQuery:
|
||||
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
|
||||
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
automountServiceAccountToken: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
|
||||
|
||||
priorityClassName: null
|
||||
@@ -1,6 +0,0 @@
|
||||
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
|
||||
|
||||
certificates:
|
||||
- name: harbor-tls
|
||||
domain: {{ .Modules.Registry.Expose.Domain }}
|
||||
@@ -1,371 +0,0 @@
|
||||
expose:
|
||||
type: {{ .Modules.Registry.Expose.Type }}
|
||||
tls:
|
||||
enabled: {{ .Modules.Registry.Tls.Enabled }}
|
||||
certSource: secret
|
||||
secret:
|
||||
secretName: harbor-tls
|
||||
ingress:
|
||||
hosts:
|
||||
core: {{ .Modules.Registry.Expose.Domain }}
|
||||
controller: default
|
||||
kubeVersionOverride: ""
|
||||
className: "{{ .Modules.Additional.Ingress.Type }}"
|
||||
annotations:
|
||||
ingress.kubernetes.io/ssl-redirect: "true"
|
||||
ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- end }}
|
||||
labels: {}
|
||||
|
||||
nodePort:
|
||||
name: harbor
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
|
||||
https:
|
||||
port: 443
|
||||
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
|
||||
|
||||
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
|
||||
persistence:
|
||||
resourcePolicy: "keep"
|
||||
persistentVolumeClaim:
|
||||
registry:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.RegistrySize }}
|
||||
annotations: {}
|
||||
jobservice:
|
||||
jobLog:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.JobserviceSize }}
|
||||
annotations: {}
|
||||
database:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.DatabaseSize }}
|
||||
annotations: {}
|
||||
redis:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.RedisSize }}
|
||||
annotations: {}
|
||||
trivy:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.TrivySize }}
|
||||
annotations: {}
|
||||
|
||||
imageChartStorage:
|
||||
disableredirect: false
|
||||
|
||||
type: filesystem
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
#maxthreads: 100
|
||||
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
|
||||
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
|
||||
|
||||
logLevel: info
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
core:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
registry:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
jobservice:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
exporter:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
trace:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
provider: otel
|
||||
sample_rate: 1
|
||||
attributes:
|
||||
application: harbor
|
||||
jaeger:
|
||||
endpoint: http://hostname:14268/api/traces
|
||||
otel:
|
||||
endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
|
||||
url_path: /v1/traces
|
||||
compression: false
|
||||
insecure: true
|
||||
timeout: 10
|
||||
|
||||
portal:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Portal.Image }}
|
||||
tag: {{ .Modules.Registry.Portal.Tag }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-portal"
|
||||
priorityClassName:
|
||||
|
||||
core:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Core.Image }}
|
||||
tag: {{ .Modules.Registry.Portal.Tag }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
startupProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
extraEnvVars: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
topologySpreadConstraints: []
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-core"
|
||||
serviceAnnotations: {}
|
||||
priorityClassName:
|
||||
configureUserSettings:
|
||||
quotaUpdateProvider: db # Or redis
|
||||
secret: ""
|
||||
existingSecret: ""
|
||||
secretName: ""
|
||||
tokenKey: ""
|
||||
|
||||
tokenCert: ""
|
||||
|
||||
xsrfKey: ""
|
||||
existingXsrfSecret: ""
|
||||
existingXsrfSecretKey: CSRF_KEY
|
||||
artifactPullAsyncFlushDuration:
|
||||
gdpr:
|
||||
deleteUser: false
|
||||
auditLogsCompliant: false
|
||||
|
||||
|
||||
jobservice:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Jobservice.Image }}
|
||||
tag: {{ .Modules.Registry.Jobservice.Tag }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
topologySpreadConstraints:
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-jobservice"
|
||||
priorityClassName:
|
||||
maxJobWorkers: 10
|
||||
jobLoggers:
|
||||
- file
|
||||
# - database
|
||||
# - stdout
|
||||
loggerSweeperDuration: 14 #days
|
||||
notification:
|
||||
webhook_job_max_retry: 3
|
||||
webhook_job_http_client_timeout: 3 # in seconds
|
||||
reaper:
|
||||
max_update_hours: 24
|
||||
max_dangling_hours: 168
|
||||
secret: ""
|
||||
existingSecret: ""
|
||||
existingSecretKey: JOBSERVICE_SECRET
|
||||
|
||||
registry:
|
||||
registry:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Registry.Registry.Image }}
|
||||
tag: {{ .Modules.Registry.Registry.Registry.Tag }}
|
||||
extraEnvVars: []
|
||||
controller:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Registry.Controller.Image }}
|
||||
tag: {{ .Modules.Registry.Registry.Controller.Tag }}
|
||||
extraEnvVars: []
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
topologySpreadConstraints: []
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-registry"
|
||||
priorityClassName:
|
||||
secret: ""
|
||||
existingSecret: ""
|
||||
existingSecretKey: REGISTRY_HTTP_SECRET
|
||||
relativeurls: false
|
||||
credentials:
|
||||
# If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
|
||||
existingSecret: ""
|
||||
# Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
|
||||
# htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
|
||||
# htpasswdString: ""
|
||||
middleware:
|
||||
enabled: false
|
||||
type: cloudFront
|
||||
cloudFront:
|
||||
baseurl: example.cloudfront.net
|
||||
keypairid: KEYPAIRID
|
||||
duration: 3000s
|
||||
ipfilteredby: none
|
||||
# The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
|
||||
# that allows access to CloudFront
|
||||
privateKeySecret: "my-secret"
|
||||
# enable purge _upload directories
|
||||
upload_purging:
|
||||
enabled: true
|
||||
# remove files in _upload directories which exist for a period of time, default is one week.
|
||||
age: 168h
|
||||
# the interval of the purge operations
|
||||
interval: 24h
|
||||
dryrun: false
|
||||
|
||||
trivy:
|
||||
enabled: {{ .Modules.Registry.EnabledScanner }}
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Trivy.Image }}
|
||||
tag: {{ .Modules.Registry.Trivy.Tag }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1Gi
|
||||
|
||||
|
||||
database:
|
||||
# if external database is used, set "type" to "external"
|
||||
# and fill the connection information in "external" section
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Database.Image }}
|
||||
tag: {{ .Modules.Registry.Database.Tag }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
livenessProbe:
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
timeoutSeconds: 1
|
||||
priorityClassName:
|
||||
# The initial superuser password for internal database
|
||||
# password: "changeit"
|
||||
# The size limit for Shared memory, pgSQL use it for shared_buffer
|
||||
# More details see:
|
||||
# https://github.com/goharbor/harbor/issues/15034
|
||||
shmSizeLimit: 512Mi
|
||||
initContainer:
|
||||
migrator: {}
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 128Mi
|
||||
# cpu: 100m
|
||||
permissions: {}
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 128Mi
|
||||
# cpu: 100m
|
||||
external:
|
||||
host: "192.168.0.1"
|
||||
port: "5432"
|
||||
username: "user"
|
||||
password: "password"
|
||||
coreDatabase: "registry"
|
||||
# if using existing secret, the key must be "password"
|
||||
existingSecret: ""
|
||||
# "disable" - No SSL
|
||||
# "require" - Always SSL (skip verification)
|
||||
# "verify-ca" - Always SSL (verify that the certificate presented by the
|
||||
# server was signed by a trusted CA)
|
||||
# "verify-full" - Always SSL (verify that the certification presented by the
|
||||
# server was signed by a trusted CA and the server host name matches the one
|
||||
# in the certificate)
|
||||
sslmode: "disable"
|
||||
# The maximum number of connections in the idle connection pool per pod (core+exporter).
|
||||
# If it <=0, no idle connections are retained.
|
||||
maxIdleConns: 100
|
||||
# The maximum number of open connections to the database per pod (core+exporter).
|
||||
# If it <= 0, then there is no limit on the number of open connections.
|
||||
# Note: the default number of connections is 1024 for postgre of harbor.
|
||||
maxOpenConns: 900
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Additional deployment labels
|
||||
podLabels: {}
|
||||
|
||||
|
||||
redis:
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: {{ .Modules.Registry.Redis.Image }}
|
||||
tag: {{ .Modules.Registry.Redis.Tag }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
extraEnvVars: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
priorityClassName:
|
||||
jobserviceDatabaseIndex: "1"
|
||||
registryDatabaseIndex: "2"
|
||||
trivyAdapterIndex: "5"
|
||||
# harborDatabaseIndex: "6"
|
||||
# cacheLayerDatabaseIndex: "7"
|
||||
external:
|
||||
# support redis, redis+sentinel
|
||||
# addr for redis: <host_redis>:<port_redis>
|
||||
# addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
|
||||
addr: "192.168.0.2:6379"
|
||||
# The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
|
||||
sentinelMasterSet: ""
|
||||
# The "coreDatabaseIndex" must be "0" as the library Harbor
|
||||
# used doesn't support configuring it
|
||||
# harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
|
||||
# cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
|
||||
coreDatabaseIndex: "0"
|
||||
jobserviceDatabaseIndex: "1"
|
||||
registryDatabaseIndex: "2"
|
||||
trivyAdapterIndex: "5"
|
||||
# harborDatabaseIndex: "6"
|
||||
# cacheLayerDatabaseIndex: "7"
|
||||
# username field can be an empty string, and it will be authenticated against the default user
|
||||
username: ""
|
||||
password: ""
|
||||
existingSecret: ""
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
@@ -1,873 +0,0 @@
|
||||
global:
|
||||
enabled: true
|
||||
|
||||
imagePullSecrets: []
|
||||
tlsDisable: true
|
||||
|
||||
externalVaultAddr: ""
|
||||
|
||||
openshift: false
|
||||
|
||||
# Create PodSecurityPolicy for pods
|
||||
psp:
|
||||
enable: false
|
||||
# Annotation for PodSecurityPolicy.
|
||||
# This is a multi-line templated string map, and can also be set as YAML.
|
||||
annotations: |
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
||||
|
||||
serverTelemetry:
|
||||
# Enable integration with the Prometheus Operator
|
||||
# See the top level serverTelemetry section below before enabling this feature.
|
||||
prometheusOperator: false
|
||||
|
||||
injector:
|
||||
enabled: true
|
||||
|
||||
replicas: 1
|
||||
|
||||
# Configures the port the injector should listen on
|
||||
port: 8080
|
||||
|
||||
# If multiple replicas are specified, by default a leader will be determined
|
||||
# so that only one injector attempts to create TLS certificates.
|
||||
leaderElector:
|
||||
enabled: true
|
||||
|
||||
# If true, will enable a node exporter metrics endpoint at /metrics.
|
||||
metrics:
|
||||
enabled: false
|
||||
|
||||
# Deprecated: Please use global.externalVaultAddr instead.
|
||||
externalVaultAddr: ""
|
||||
|
||||
# image sets the repo and tag of the vault-k8s image to use for the injector.
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.Injector.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Injector.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# agentImage sets the repo and tag of the Vault image to use for the Vault Agent
|
||||
# containers. This should be set to the official Vault image. Vault 1.3.1+ is
|
||||
# required.
|
||||
agentImage:
|
||||
repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
|
||||
agentDefaults:
|
||||
cpuLimit: "500m"
|
||||
cpuRequest: "250m"
|
||||
memLimit: "128Mi"
|
||||
memRequest: "64Mi"
|
||||
# ephemeralLimit: "128Mi"
|
||||
# ephemeralRequest: "64Mi"
|
||||
|
||||
# Default template type for secrets when no custom template is specified.
|
||||
# Possible values include: "json" and "map".
|
||||
template: "map"
|
||||
|
||||
# Default values within Agent's template_config stanza.
|
||||
templateConfig:
|
||||
exitOnRetryFailure: true
|
||||
staticSecretRenderInterval: ""
|
||||
|
||||
# Used to define custom livenessProbe settings
|
||||
livenessProbe:
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 2
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 5
|
||||
# Used to define custom readinessProbe settings
|
||||
readinessProbe:
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 2
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 5
|
||||
# Used to define custom startupProbe settings
|
||||
startupProbe:
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 12
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 5
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 5
|
||||
|
||||
# Mount Path of the Vault Kubernetes Auth Method.
|
||||
authPath: "auth/kubernetes"
|
||||
|
||||
# Configures the log verbosity of the injector.
|
||||
# Supported log levels include: trace, debug, info, warn, error
|
||||
logLevel: "info"
|
||||
|
||||
# Configures the log format of the injector. Supported log formats: "standard", "json".
|
||||
logFormat: "standard"
|
||||
|
||||
# Configures all Vault Agent sidecars to revoke their token when shutting down
|
||||
revokeOnShutdown: false
|
||||
|
||||
webhook:
|
||||
# Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
|
||||
# API Tag of the WebHook.
|
||||
# To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
|
||||
#
|
||||
failurePolicy: Ignore
|
||||
|
||||
# matchPolicy specifies the approach to accepting changes based on the rules of
|
||||
# the MutatingWebhookConfiguration.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
|
||||
# for more details.
|
||||
#
|
||||
matchPolicy: Exact
|
||||
|
||||
# timeoutSeconds is the amount of seconds before the webhook request will be ignored
|
||||
# or fails.
|
||||
# If it is ignored or fails depends on the failurePolicy
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
|
||||
# for more details.
|
||||
#
|
||||
timeoutSeconds: 30
|
||||
|
||||
# namespaceSelector is the selector for restricting the webhook to only
|
||||
# specific namespaces.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# sidecar-injector: enabled
|
||||
namespaceSelector: {}
|
||||
|
||||
# objectSelector is the selector for restricting the webhook to only
|
||||
# specific labels.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# objectSelector:
|
||||
# matchLabels:
|
||||
# vault-sidecar-injector: enabled
|
||||
|
||||
# Extra annotations to attach to the webhook
|
||||
annotations: {}
|
||||
|
||||
# Deprecated: please use 'webhook.failurePolicy' instead
|
||||
# Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
|
||||
# API Tag of the WebHook.
|
||||
# To block pod creation while webhook is unavailable, set the policy to `Fail` below.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
|
||||
#
|
||||
failurePolicy: Ignore
|
||||
|
||||
# Deprecated: please use 'webhook.namespaceSelector' instead
|
||||
# namespaceSelector is the selector for restricting the webhook to only
|
||||
# specific namespaces.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# sidecar-injector: enabled
|
||||
namespaceSelector: {}
|
||||
|
||||
# Deprecated: please use 'webhook.objectSelector' instead
|
||||
# objectSelector is the selector for restricting the webhook to only
|
||||
# specific labels.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# objectSelector:
|
||||
# matchLabels:
|
||||
# vault-sidecar-injector: enabled
|
||||
objectSelector: {}
|
||||
|
||||
# Deprecated: please use 'webhook.annotations' instead
|
||||
# Extra annotations to attach to the webhook
|
||||
webhookAnnotations: {}
|
||||
|
||||
certs:
|
||||
# secretName is the name of the secret that has the TLS certificate and
|
||||
# private key to serve the injector webhook. If this is null, then the
|
||||
# injector will default to its automatic management mode that will assign
|
||||
# a service account to the injector to generate its own certificates.
|
||||
secretName: null
|
||||
|
||||
# caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
|
||||
# that signed the TLS certificate that the webhook serves. This must be set
|
||||
# if secretName is non-null unless an external service like cert-manager is
|
||||
# keeping the caBundle updated.
|
||||
caBundle: ""
|
||||
|
||||
# certName and keyName are the names of the files within the secret for
|
||||
# the TLS cert and private key, respectively. These have reasonable
|
||||
# defaults but can be customized if necessary.
|
||||
certName: tls.crt
|
||||
keyName: tls.key
|
||||
|
||||
securityContext:
|
||||
pod: {}
|
||||
container: {}
|
||||
|
||||
resources: {}
|
||||
|
||||
# extraEnvironmentVars is a list of extra environment variables to set in the
|
||||
# injector deployment.
|
||||
extraEnvironmentVars: {}
|
||||
# KUBERNETES_SERVICE_HOST: kubernetes.default.svc
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
tolerations: []
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
annotations: {}
|
||||
|
||||
extraLabels: {}
|
||||
|
||||
hostNetwork: false
|
||||
|
||||
|
||||
service:
|
||||
# Extra annotations to attach to the injector service
|
||||
annotations: {}
|
||||
|
||||
# Injector serviceAccount specific config
|
||||
serviceAccount:
|
||||
# Extra annotations to attach to the injector serviceAccount
|
||||
annotations: {}
|
||||
|
||||
# A disruption budget limits the number of pods of a replicated application
|
||||
# that are down simultaneously from voluntary disruptions
|
||||
podDisruptionBudget: {}
|
||||
# podDisruptionBudget:
|
||||
# maxUnavailable: 1
|
||||
|
||||
# strategy for updating the deployment. This can be a multi-line string or a
|
||||
# YAML map.
|
||||
strategy: {}
|
||||
# strategy: |
|
||||
# rollingUpdate:
|
||||
# maxSurge: 25%
|
||||
# maxUnavailable: 25%
|
||||
# type: RollingUpdate
|
||||
|
||||
server:
|
||||
enabled: true
|
||||
enterpriseLicense:
|
||||
# The name of the Kubernetes secret that holds the enterprise license. The
|
||||
# secret must be in the same namespace that Vault is installed into.
|
||||
secretName: ""
|
||||
# The key within the Kubernetes secret that holds the enterprise license.
|
||||
secretKey: "license"
|
||||
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.Server.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Server.Tag }}"
|
||||
# Overrides the default Image Pull Policy
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
updateStrategyType: "RollingUpdate"
|
||||
|
||||
# Supported log levels include: trace, debug, info, warn, error
|
||||
logLevel: ""
|
||||
|
||||
# Supported log formats include: standard, json
|
||||
logFormat: ""
|
||||
|
||||
resources: {}
|
||||
|
||||
hostAliases: []
|
||||
# - ip: 127.0.0.1
|
||||
# hostnames:
|
||||
# - chart-example.local
|
||||
|
||||
route:
|
||||
enabled: false
|
||||
|
||||
# When HA mode is enabled and K8s service registration is being used,
|
||||
# configure the route to point to the Vault active service.
|
||||
activeService: true
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
host: chart-example.local
|
||||
# tls will be passed directly to the route's TLS config, which
|
||||
# can be used to configure other termination methods that terminate
|
||||
# TLS at the router
|
||||
tls:
|
||||
termination: passthrough
|
||||
|
||||
# authDelegator enables a cluster role binding to be attached to the service
|
||||
# account. This cluster role binding can be used to setup Kubernetes auth
|
||||
# method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
|
||||
authDelegator:
|
||||
enabled: true
|
||||
|
||||
extraInitContainers: null
|
||||
extraContainers: null
|
||||
shareProcessNamespace: false
|
||||
extraArgs: ""
|
||||
|
||||
extraPorts: null
|
||||
# - containerPort: 8300
|
||||
# name: http-monitoring
|
||||
|
||||
readinessProbe:
|
||||
enabled: false
|
||||
# If you need to use a http path instead of the default exec
|
||||
# path: /v1/sys/health?standbyok=true
|
||||
|
||||
# Port number on which readinessProbe will be checked.
|
||||
port: 8200
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 5
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 3
|
||||
# Used to enable a livenessProbe for the pods
|
||||
livenessProbe:
|
||||
enabled: false
|
||||
# Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
|
||||
execCommand: []
|
||||
# - /bin/sh
|
||||
# - -c
|
||||
# - /vault/userconfig/mylivenessscript/run.sh
|
||||
# Path for the livenessProbe to use httpGet as the livenessProbe handler
|
||||
path: "/v1/sys/health?standbyok=true"
|
||||
# Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
|
||||
port: 8200
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 60
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 5
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 3
|
||||
|
||||
terminationGracePeriodSeconds: 10
|
||||
|
||||
# Used to set the sleep time during the preStop step
|
||||
preStopSleepSeconds: 5
|
||||
|
||||
extraEnvironmentVars: {}
|
||||
|
||||
extraSecretEnvironmentVars: []
|
||||
|
||||
extraVolumes: []
|
||||
|
||||
volumes: null
|
||||
|
||||
volumeMounts: null
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
tolerations: []
|
||||
nodeSelector: {}
|
||||
|
||||
# Enables network policy for server pods
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
egress: []
|
||||
# egress:
|
||||
# - to:
|
||||
# - ipBlock:
|
||||
# cidr: 10.0.0.0/24
|
||||
# ports:
|
||||
# - protocol: TCP
|
||||
# port: 443
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector: {}
|
||||
ports:
|
||||
- port: 8200
|
||||
protocol: TCP
|
||||
- port: 8201
|
||||
protocol: TCP
|
||||
|
||||
priorityClassName: ""
|
||||
extraLabels: {}
|
||||
|
||||
annotations: {}
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
# Enable or disable the vault-active service, which selects Vault pods that
|
||||
# have labeled themselves as the cluster leader with `vault-active: "true"`.
|
||||
active:
|
||||
enabled: true
|
||||
# Extra annotations for the service definition. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the active service.
|
||||
annotations: {}
|
||||
# Enable or disable the vault-standby service, which selects Vault pods that
|
||||
# have labeled themselves as a cluster follower with `vault-active: "false"`.
|
||||
standby:
|
||||
enabled: true
|
||||
# Extra annotations for the service definition. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the standby service.
|
||||
annotations: {}
|
||||
# When disabled, services may select Vault pods not deployed from the chart.
|
||||
# Does not affect the headless vault-internal service with `ClusterIP: None`
|
||||
instanceSelector:
|
||||
enabled: true
|
||||
# clusterIP controls whether a Cluster IP address is attached to the
|
||||
# Vault service within Kubernetes. By default, the Vault service will
|
||||
# be given a Cluster IP address, set to None to disable. When disabled
|
||||
# Kubernetes will create a "headless" service. Headless services can be
|
||||
# used to communicate with pods directly through DNS instead of a round-robin
|
||||
# load balancer.
|
||||
# clusterIP: None
|
||||
|
||||
# Configures the service type for the main Vault service. Can be ClusterIP
|
||||
# or NodePort.
|
||||
#type: ClusterIP
|
||||
|
||||
# The IP family and IP families options are to set the behaviour in a dual-stack environment.
|
||||
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
|
||||
# should be.
|
||||
# These are only supported for kubernetes versions >=1.23.0
|
||||
#
|
||||
# Configures the service's supported IP family policy, can be either:
|
||||
# SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
|
||||
# PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
|
||||
# RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
|
||||
ipFamilyPolicy: ""
|
||||
|
||||
# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
|
||||
# Can be IPv4 and/or IPv6.
|
||||
ipFamilies: []
|
||||
|
||||
# Do not wait for pods to be ready before including them in the services'
|
||||
# targets. Does not apply to the headless service, which is used for
|
||||
# cluster-internal communication.
|
||||
publishNotReadyAddresses: true
|
||||
|
||||
# The externalTrafficPolicy can be set to either Cluster or Local
|
||||
# and is only valid for LoadBalancer and NodePort service types.
|
||||
# The default value is Cluster.
|
||||
# ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
|
||||
externalTrafficPolicy: Cluster
|
||||
|
||||
# If type is set to "NodePort", a specific nodePort value can be configured,
|
||||
# will be random if left blank.
|
||||
#nodePort: 30000
|
||||
|
||||
# When HA mode is enabled
|
||||
# If type is set to "NodePort", a specific nodePort value can be configured,
|
||||
# will be random if left blank.
|
||||
#activeNodePort: 30001
|
||||
|
||||
# When HA mode is enabled
|
||||
# If type is set to "NodePort", a specific nodePort value can be configured,
|
||||
# will be random if left blank.
|
||||
#standbyNodePort: 30002
|
||||
|
||||
# Port on which Vault server is listening
|
||||
port: 8200
|
||||
# Target port to which the service should be mapped to
|
||||
targetPort: 8200
|
||||
# Extra annotations for the service definition. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the service.
|
||||
annotations: {}
|
||||
|
||||
dataStorage:
|
||||
enabled: true
|
||||
size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }}
|
||||
mountPath: "/vault/data"
|
||||
storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }}
|
||||
accessMode: ReadWriteOnce
|
||||
annotations: {}
|
||||
labels: {}
|
||||
|
||||
persistentVolumeClaimRetentionPolicy: {}
|
||||
|
||||
# required for ha installation
|
||||
auditStorage:
|
||||
enabled: false
|
||||
# Size of the PVC created
|
||||
size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }}
|
||||
# Location where the PVC will be mounted.
|
||||
mountPath: "/vault/audit"
|
||||
# Name of the storage class to use. If null it will use the
|
||||
# configured default Storage Class.
|
||||
storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }}
|
||||
# Access Mode of the storage device being used for the PVC
|
||||
accessMode: ReadWriteOnce
|
||||
# Annotations to apply to the PVC
|
||||
annotations: {}
|
||||
# Labels to apply to the PVC
|
||||
labels: {}
|
||||
|
||||
dev:
|
||||
enabled: false
|
||||
|
||||
# Set VAULT_DEV_ROOT_TOKEN_ID value
|
||||
devRootToken: "root"
|
||||
|
||||
# Run Vault in "standalone" mode. This is the default mode that will deploy if
|
||||
# no arguments are given to helm. This requires a PVC for data storage to use
|
||||
# the "file" backend. This mode is not highly available and should not be scaled
|
||||
# past a single replica.
|
||||
standalone:
|
||||
enabled: "-"
|
||||
|
||||
# config is a raw string of default configuration when using a Stateful
|
||||
# deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
|
||||
# and store data there. This is only used when using a Replica count of 1, and
|
||||
# using a stateful set. This should be HCL.
|
||||
|
||||
# Note: Configuration files are stored in ConfigMaps so sensitive data
|
||||
# such as passwords should be either mounted through extraSecretEnvironmentVars
|
||||
# or through a Kube secret. For more information see:
|
||||
# https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
storage "file" {
|
||||
path = "/vault/data"
|
||||
}
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
prometheus_retention_time = "30s"
|
||||
disable_hostname = true
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
# Run Vault in "HA" mode. There are no storage requirements unless the audit log
|
||||
# persistence is required. In HA mode Vault will configure itself to use Consul
|
||||
# for its storage backend. The default configuration provided will work the Consul
|
||||
# Helm project by default. It is possible to manually configure Vault to use a
|
||||
# different HA backend.
|
||||
ha:
|
||||
enabled: false
|
||||
replicas: 3
|
||||
|
||||
# Set the api_addr configuration for Vault HA
|
||||
# See https://developer.hashicorp.com/vault/docs/configuration#api_addr
|
||||
# If set to null, this will be set to the Pod IP Address
|
||||
apiAddr: null
|
||||
|
||||
# Set the cluster_addr confuguration for Vault HA
|
||||
# See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
|
||||
clusterAddr: null
|
||||
|
||||
# Enables Vault's integrated Raft storage. Unlike the typical HA modes where
|
||||
# Vault's persistence is external (such as Consul), enabling Raft mode will create
|
||||
# persistent volumes for Vault to store data according to the configuration under server.dataStorage.
|
||||
# The Vault cluster will coordinate leader elections and failovers internally.
|
||||
raft:
|
||||
# Enables Raft integrated storage
|
||||
enabled: false
|
||||
# Set the Node Raft ID to the name of the pod
|
||||
setNodeId: false
|
||||
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/data"
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
# config is a raw string of default configuration when using a Stateful
|
||||
# deployment. Default is to use a Consul for its HA storage backend.
|
||||
# This should be HCL.
|
||||
|
||||
# Note: Configuration files are stored in ConfigMaps so sensitive data
|
||||
# such as passwords should be either mounted through extraSecretEnvironmentVars
|
||||
# or through a Kube secret. For more information see:
|
||||
# https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
storage "consul" {
|
||||
path = "vault"
|
||||
address = "HOST_IP:8500"
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
# Example configuration for using auto-unseal, using Google Cloud KMS. The
|
||||
# GKMS keys must already exist, and the cluster must have a service account
|
||||
# that is authorized to access GCP KMS.
|
||||
#seal "gcpckms" {
|
||||
# project = "vault-helm-dev-246514"
|
||||
# region = "global"
|
||||
# key_ring = "vault-helm-unseal-kr"
|
||||
# crypto_key = "vault-helm-unseal-key"
|
||||
#}
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
prometheus_retention_time = "30s"
|
||||
disable_hostname = true
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
# A disruption budget limits the number of pods of a replicated application
|
||||
# that are down simultaneously from voluntary disruptions
|
||||
disruptionBudget:
|
||||
enabled: true
|
||||
|
||||
# maxUnavailable will default to (n/2)-1 where n is the number of
|
||||
# replicas. If you'd like a custom value, you can specify an override here.
|
||||
maxUnavailable: null
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
createSecret: false
|
||||
annotations: {}
|
||||
extraLabels: {}
|
||||
serviceDiscovery:
|
||||
enabled: true
|
||||
|
||||
statefulSet:
|
||||
annotations: {}
|
||||
securityContext:
|
||||
pod: {}
|
||||
container: {}
|
||||
|
||||
hostNetwork: false
|
||||
|
||||
# Vault UI
|
||||
ui:
|
||||
enabled: true
|
||||
domain: {{ .Modules.SecretsStorage.Expose.Domain }}
|
||||
path: {{ .Modules.SecretsStorage.Expose.Path }}
|
||||
publishNotReadyAddresses: true
|
||||
# The service should only contain selectors for active Vault pod
|
||||
activeVaultPodOnly: false
|
||||
{{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }}
|
||||
serviceType: "NodePort"
|
||||
serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }}
|
||||
{{- else }}
|
||||
serviceType: "ClusterIP"
|
||||
serviceNodePort: null
|
||||
{{- end }}
|
||||
externalPort: 8200
|
||||
targetPort: 8200
|
||||
|
||||
serviceIPFamilyPolicy: ""
|
||||
|
||||
serviceIPFamilies: []
|
||||
|
||||
externalTrafficPolicy: Cluster
|
||||
|
||||
#loadBalancerSourceRanges:
|
||||
# - 10.0.0.0/16
|
||||
# - 1.78.23.3/32
|
||||
|
||||
# loadBalancerIP:
|
||||
|
||||
annotations: {}
|
||||
|
||||
csi:
|
||||
# True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
|
||||
#
|
||||
# Requires installing the secrets-store-csi-driver separately, see:
|
||||
# https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
|
||||
#
|
||||
# With the driver and provider installed, you can mount Vault secrets into volumes
|
||||
# similar to the Vault Agent injector, and you can also sync those secrets into
|
||||
# Kubernetes secrets.
|
||||
enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }}
|
||||
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
volumes: null
|
||||
|
||||
volumeMounts: null
|
||||
|
||||
resources: {}
|
||||
|
||||
# Override the default secret name for the CSI Provider's HMAC key used for
|
||||
# generating secret versions.
|
||||
hmacSecretName: ""
|
||||
|
||||
daemonSet:
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
maxUnavailable: ""
|
||||
# Extra annotations for the daemonSet. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the daemonSet.
|
||||
annotations: {}
|
||||
# Provider host path (must match the CSI provider's path)
|
||||
providersDir: "/etc/kubernetes/secrets-store-csi-providers"
|
||||
# Kubelet host path
|
||||
kubeletRootDir: "/var/lib/kubelet"
|
||||
# Extra labels to attach to the vault-csi-provider daemonSet
|
||||
# This should be a YAML map of the labels to apply to the csi provider daemonSet
|
||||
extraLabels: {}
|
||||
# security context for the pod template and container in the csi provider daemonSet
|
||||
securityContext:
|
||||
pod: {}
|
||||
container: {}
|
||||
|
||||
pod:
|
||||
annotations: {}
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
effect: NoSchedule
|
||||
nodeSelector: {}
|
||||
affinity: {}
|
||||
extraLabels: {}
|
||||
|
||||
agent:
|
||||
enabled: true
|
||||
extraArgs: []
|
||||
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
logFormat: standard
|
||||
logLevel: info
|
||||
|
||||
resources: {}
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
serviceAccount:
|
||||
annotations: {}
|
||||
extraLabels: {}
|
||||
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
failureThreshold: 2
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
|
||||
livenessProbe:
|
||||
failureThreshold: 2
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
|
||||
debug: false
|
||||
extraArgs: []
|
||||
|
||||
serverTelemetry:
|
||||
# Enable support for the Prometheus Operator. Currently, this chart does not support
|
||||
# authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
|
||||
# in the `listener "tcp"{}` stanza
|
||||
# telemetry {
|
||||
# unauthenticated_metrics_access = "true"
|
||||
# }
|
||||
#
|
||||
# See the `standalone.config` for a more complete example of this.
|
||||
#
|
||||
# In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
|
||||
#
|
||||
# example:
|
||||
# telemetry {
|
||||
# prometheus_retention_time = "30s"
|
||||
# disable_hostname = true
|
||||
# }
|
||||
#
|
||||
# Configuration for monitoring the Vault server.
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
selectors: {}
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
|
||||
prometheusRules:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
selectors: {}
|
||||
rules: []
|
||||
|
||||
ingress:
|
||||
{{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
{{- end }}
|
||||
tls:
|
||||
{{- if .Modules.SecretsStorage.Expose.Tls.Enabled }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
hosts:
|
||||
- host: {{ .Modules.SecretsStorage.Expose.Domain }}
|
||||
secretName: vault-tls
|
||||
@@ -135,7 +135,5 @@ unsafe_show_logs: false
|
||||
## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
|
||||
allow_unsupported_distribution_setup: false
|
||||
|
||||
## Containerd settings
|
||||
# containerd_metadata_root_dir: /app/lib/containerd
|
||||
# The state directory for containerd
|
||||
# containerd_state_dir: /app/run/containerd
|
||||
## Kubelet additional settings
|
||||
kubelet_custom_flags: "--root-dir={{ .Orchestrator.KubeletDir }}"
|
||||
|
||||
@@ -0,0 +1,60 @@
|
||||
---
|
||||
# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
|
||||
|
||||
containerd_storage_dir: {{ .Orchestrator.ContainerEngine.DataDir }}
|
||||
containerd_state_dir: {{ .Orchestrator.ContainerEngine.StateDir }}
|
||||
|
||||
# containerd_oom_score: 0
|
||||
|
||||
# containerd_default_runtime: "runc"
|
||||
# containerd_snapshotter: "native"
|
||||
|
||||
# containerd_runc_runtime:
|
||||
# name: runc
|
||||
# type: "io.containerd.runc.v2"
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
# containerd_additional_runtimes:
|
||||
# Example for Kata Containers as additional runtime:
|
||||
# - name: kata
|
||||
# type: "io.containerd.kata.v2"
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
# containerd_grpc_max_recv_message_size: 16777216
|
||||
# containerd_grpc_max_send_message_size: 16777216
|
||||
|
||||
# Containerd debug socket location: unix or tcp format
|
||||
# containerd_debug_address: ""
|
||||
|
||||
# Containerd log level
|
||||
# containerd_debug_level: "info"
|
||||
|
||||
# Containerd logs format, supported values: text, json
|
||||
# containerd_debug_format: ""
|
||||
|
||||
# Containerd debug socket UID
|
||||
# containerd_debug_uid: 0
|
||||
|
||||
# Containerd debug socket GID
|
||||
# containerd_debug_gid: 0
|
||||
|
||||
# containerd_metrics_address: ""
|
||||
|
||||
# containerd_metrics_grpc_histogram: false
|
||||
|
||||
# Registries defined within containerd.
|
||||
# containerd_registries_mirrors:
|
||||
# - prefix: docker.io
|
||||
# mirrors:
|
||||
# - host: https://registry-1.docker.io
|
||||
# capabilities: ["pull", "resolve"]
|
||||
# skip_verify: false
|
||||
|
||||
# containerd_max_container_log_line_size: -1
|
||||
|
||||
# containerd_registry_auth:
|
||||
# - registry: 10.0.0.2:5000
|
||||
# username: user
|
||||
# password: pass
|
||||
@@ -1,8 +0,0 @@
|
||||
{
|
||||
"keys": [
|
||||
{{- range $index, $key := .Modules.SecretsStorage.UnsealKeys }}
|
||||
"{{ $key }}",
|
||||
{{- end }}
|
||||
],
|
||||
"root_token": "{{ .Modules.SecretsStorage.AuthToken }}"
|
||||
}
|
||||
@@ -1,130 +0,0 @@
|
||||
package secrets_storage
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"kube-forge/internal/config"
|
||||
"kube-forge/internal/kubernetes_client"
|
||||
"kube-forge/internal/logging"
|
||||
"kube-forge/internal/templates"
|
||||
"regexp"
|
||||
"strings"
|
||||
)
|
||||
|
||||
func initVault() {
|
||||
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
||||
if err != nil {
|
||||
logging.Log.Error(err.Error())
|
||||
return
|
||||
}
|
||||
err = commandToInitVault()
|
||||
if err != nil {
|
||||
logging.Log.Warn(err.Error())
|
||||
return
|
||||
}
|
||||
logging.Log.Info("Vault initialized")
|
||||
templates.ApplyVaultInitKeysTemplate()
|
||||
}
|
||||
|
||||
func addKubernetesLocalIntegration() {
|
||||
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
||||
if err != nil {
|
||||
logging.Log.Error(err.Error())
|
||||
return
|
||||
}
|
||||
err = commandToAddKubernetesLocalIntegration()
|
||||
if err != nil {
|
||||
logging.Log.Error(err.Error())
|
||||
return
|
||||
}
|
||||
logging.Log.Info("Vault local Kubernetes integration added")
|
||||
}
|
||||
|
||||
func unsealVault() {
|
||||
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
||||
if err != nil {
|
||||
logging.Log.Error(err.Error())
|
||||
return
|
||||
}
|
||||
commandToUnsealVault()
|
||||
}
|
||||
|
||||
func commandToInitVault() error {
|
||||
config := config.GetConfig()
|
||||
commandArray := []string{
|
||||
"vault", "operator", "init",
|
||||
fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
|
||||
fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
|
||||
}
|
||||
output, err := kubernetes_client.ExecuteCommandInPodContainer(
|
||||
commandArray, "secrets-storage", "vault-0", "vault",
|
||||
)
|
||||
if err != nil && strings.Contains(output, "Vault is already initialized") {
|
||||
return VaultAlreadyInitialised
|
||||
}
|
||||
|
||||
unsealKeys, rootToken := parseVaultInitKeys(output)
|
||||
config.Modules.SecretsStorage.UnsealKeys = unsealKeys
|
||||
config.Modules.SecretsStorage.AuthToken = rootToken
|
||||
return nil
|
||||
}
|
||||
|
||||
func parseVaultInitKeys(input string) ([]string, string) {
|
||||
unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
|
||||
rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
|
||||
|
||||
unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
|
||||
var unsealKeys []string
|
||||
for _, match := range unsealKeysMatches {
|
||||
unsealKeys = append(unsealKeys, match[1])
|
||||
}
|
||||
|
||||
rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
|
||||
rootToken := rootTokenMatches[1]
|
||||
|
||||
return unsealKeys, rootToken
|
||||
}
|
||||
|
||||
func commandToUnsealVault() {
|
||||
config := config.GetConfig()
|
||||
|
||||
for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
|
||||
commandArray := []string{"vault", "operator", "unseal", unsealKey}
|
||||
kubernetes_client.ExecuteCommandInPodContainer(
|
||||
commandArray, "secrets-storage", "vault-0", "vault",
|
||||
)
|
||||
}
|
||||
logging.Log.Info("Vault unsealed")
|
||||
}
|
||||
|
||||
func commandToAddKubernetesLocalIntegration() error {
|
||||
config := config.GetConfig()
|
||||
|
||||
commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
|
||||
output, err := kubernetes_client.ExecuteCommandInPodContainer(
|
||||
commandArray, "secrets-storage", "vault-0", "vault",
|
||||
)
|
||||
if err != nil && strings.Contains(output, "permission denied") {
|
||||
return IncorrectCredentials
|
||||
}
|
||||
commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
|
||||
output, err = kubernetes_client.ExecuteCommandInPodContainer(
|
||||
commandArray, "secrets-storage", "vault-0", "vault",
|
||||
)
|
||||
kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
|
||||
"KUBERNETES_PORT_443_TCP_ADDR",
|
||||
"secrets-storage",
|
||||
"vault-0",
|
||||
"vault",
|
||||
)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
commandArray = []string{
|
||||
"vault", "write", "auth/kubernetes-local/config",
|
||||
fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
|
||||
}
|
||||
output, err = kubernetes_client.ExecuteCommandInPodContainer(
|
||||
commandArray, "secrets-storage", "vault-0", "vault",
|
||||
)
|
||||
return nil
|
||||
}
|
||||
@@ -1,6 +0,0 @@
|
||||
package secrets_storage
|
||||
|
||||
import "errors"
|
||||
|
||||
var VaultAlreadyInitialised = errors.New("Vault already initialised")
|
||||
var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!")
|
||||
@@ -1,44 +0,0 @@
|
||||
package secrets_storage
|
||||
|
||||
import (
|
||||
"kube-forge/internal/config"
|
||||
"kube-forge/internal/helm_client"
|
||||
"kube-forge/internal/templates"
|
||||
"time"
|
||||
|
||||
go_helm_client "github.com/mittwald/go-helm-client"
|
||||
)
|
||||
|
||||
var HELM_REPOS = []config.RepoSettings{
|
||||
{
|
||||
Name: "kube-forge",
|
||||
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
|
||||
},
|
||||
}
|
||||
|
||||
func getVaultSpec() go_helm_client.ChartSpec {
|
||||
appConfig := config.GetConfig()
|
||||
return go_helm_client.ChartSpec{
|
||||
ReleaseName: "vault",
|
||||
ChartName: appConfig.Modules.SecretsStorage.ChartRef,
|
||||
Version: appConfig.Modules.SecretsStorage.ChartVersion,
|
||||
Namespace: appConfig.Modules.SecretsStorage.Namespace,
|
||||
CreateNamespace: true,
|
||||
Atomic: true,
|
||||
Timeout: time.Second * 600,
|
||||
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"),
|
||||
}
|
||||
}
|
||||
|
||||
func ApplyCharts() {
|
||||
appConfig := config.GetConfig()
|
||||
helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS)
|
||||
if appConfig.Modules.SecretsStorage.Enabled {
|
||||
helm_client.InstallChart(getVaultSpec())
|
||||
initVault()
|
||||
unsealVault()
|
||||
addKubernetesLocalIntegration()
|
||||
} else {
|
||||
helm_client.DeleteChart(getVaultSpec())
|
||||
}
|
||||
}
|
||||
@@ -5,6 +5,7 @@ var K8S_TEMPLATES = [...][2]string{
|
||||
{"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"},
|
||||
{"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"},
|
||||
{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"},
|
||||
{"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"},
|
||||
}
|
||||
|
||||
func ApplyK8sTemplates() {
|
||||
|
||||
@@ -32,6 +32,7 @@ disable_host_nameservers: false
|
||||
upstream_dns_servers:
|
||||
- 8.8.8.8
|
||||
- 8.8.4.4
|
||||
- 1.1.1.1
|
||||
|
||||
## There are some changes specific to the cloud providers
|
||||
## for instance we need to encapsulate packets with some network plugins
|
||||
@@ -128,7 +129,5 @@ unsafe_show_logs: false
|
||||
## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
|
||||
allow_unsupported_distribution_setup: false
|
||||
|
||||
## Containerd settings
|
||||
# containerd_metadata_root_dir: /app/lib/containerd
|
||||
# The state directory for containerd
|
||||
# containerd_state_dir: /app/run/containerd
|
||||
## Kubelet additional settings
|
||||
kubelet_custom_flags: "--root-dir=/var/lib/kubelet"
|
||||
|
||||
60
kubespray/inventory/group_vars/all/containerd.yml
Normal file
60
kubespray/inventory/group_vars/all/containerd.yml
Normal file
@@ -0,0 +1,60 @@
|
||||
---
|
||||
# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
|
||||
|
||||
containerd_storage_dir: /var/lib/containerd
|
||||
containerd_state_dir: /run/containerd
|
||||
|
||||
# containerd_oom_score: 0
|
||||
|
||||
# containerd_default_runtime: "runc"
|
||||
# containerd_snapshotter: "native"
|
||||
|
||||
# containerd_runc_runtime:
|
||||
# name: runc
|
||||
# type: "io.containerd.runc.v2"
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
# containerd_additional_runtimes:
|
||||
# Example for Kata Containers as additional runtime:
|
||||
# - name: kata
|
||||
# type: "io.containerd.kata.v2"
|
||||
# engine: ""
|
||||
# root: ""
|
||||
|
||||
# containerd_grpc_max_recv_message_size: 16777216
|
||||
# containerd_grpc_max_send_message_size: 16777216
|
||||
|
||||
# Containerd debug socket location: unix or tcp format
|
||||
# containerd_debug_address: ""
|
||||
|
||||
# Containerd log level
|
||||
# containerd_debug_level: "info"
|
||||
|
||||
# Containerd logs format, supported values: text, json
|
||||
# containerd_debug_format: ""
|
||||
|
||||
# Containerd debug socket UID
|
||||
# containerd_debug_uid: 0
|
||||
|
||||
# Containerd debug socket GID
|
||||
# containerd_debug_gid: 0
|
||||
|
||||
# containerd_metrics_address: ""
|
||||
|
||||
# containerd_metrics_grpc_histogram: false
|
||||
|
||||
# Registries defined within containerd.
|
||||
# containerd_registries_mirrors:
|
||||
# - prefix: docker.io
|
||||
# mirrors:
|
||||
# - host: https://registry-1.docker.io
|
||||
# capabilities: ["pull", "resolve"]
|
||||
# skip_verify: false
|
||||
|
||||
# containerd_max_container_log_line_size: -1
|
||||
|
||||
# containerd_registry_auth:
|
||||
# - registry: 10.0.0.2:5000
|
||||
# username: user
|
||||
# password: pass
|
||||
@@ -157,7 +157,7 @@ kube_encrypt_secret_data: false
|
||||
|
||||
# DNS configuration.
|
||||
# Kubernetes cluster name, also will be used as DNS domain
|
||||
cluster_name: k8s-cluster.local
|
||||
cluster_name: cluster.local
|
||||
# Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
|
||||
ndots: 2
|
||||
# dns_timeout: 2
|
||||
|
||||
@@ -1,17 +1,17 @@
|
||||
|
||||
vbox-prod-k8s-master-01 ansible_host=10.250.50.22 ip=10.250.50.22
|
||||
vbox-prod-k8s-slave-01 ansible_host=10.250.50.23 ip=10.250.50.23
|
||||
vbox-prod-k8s-slave-02 ansible_host=10.250.50.21 ip=10.250.50.21
|
||||
t1-disk-lt-k8s-test-master-01 ansible_host=10.100.20.49 ip=10.100.20.49
|
||||
t1-disk-lt-k8s-test-slave-01 ansible_host=10.100.20.48 ip=10.100.20.48
|
||||
t1-disk-lt-k8s-test-slave-02 ansible_host=10.100.20.47 ip=10.100.20.47
|
||||
|
||||
[kube_control_plane]
|
||||
vbox-prod-k8s-master-01
|
||||
t1-disk-lt-k8s-test-master-01
|
||||
|
||||
[etcd]
|
||||
vbox-prod-k8s-master-01
|
||||
t1-disk-lt-k8s-test-master-01
|
||||
|
||||
[kube_node]
|
||||
vbox-prod-k8s-slave-01
|
||||
vbox-prod-k8s-slave-02
|
||||
t1-disk-lt-k8s-test-slave-01
|
||||
t1-disk-lt-k8s-test-slave-02
|
||||
|
||||
[k8s_cluster:children]
|
||||
kube_control_plane
|
||||
@@ -20,4 +20,4 @@ kube_node
|
||||
[all:vars]
|
||||
ansible_connection=ssh
|
||||
ansible_user=sre-admin
|
||||
ansible_ssh_private_key_file=/root/.ssh/id_rsa
|
||||
ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa_bastion_ift
|
||||
|
||||
Reference in New Issue
Block a user