From 1c366bdb6b1df9603620dac3015c234bbadfefd1 Mon Sep 17 00:00:00 2001 From: George Stykalin Date: Sun, 24 Nov 2024 17:59:37 +0300 Subject: [PATCH] update kube-forge concept and add ability to change data dir for containerd --- .gitlab-ci.yml | 173 -- README.md | 2 - build/README.md | 5 - build/debian/DEBIAN/control | 5 - build/version.txt | 1 - cmd/main/main.go | 13 +- config.sample.yaml | 124 +- go.mod | 2 +- go.sum | 4 +- internal/cicd/helm.go | 108 - internal/config/config.go | 11 +- internal/config/modules_cicd.go | 96 - internal/config/modules_observability.go | 179 -- internal/config/modules_registry.go | 66 - internal/config/modules_secrets_storage.go | 48 - internal/config/orchestrator.go | 9 +- internal/config/utility.go | 5 - internal/kubespray/cluster.go | 6 + internal/observability/helm.go | 122 -- internal/registry/helm.go | 61 - .../ingress-contour.yml.tmpl | 1845 +++++++++++++++++ .../releases/authentication/keycloak.yml.tmpl | 0 .../releases/cicd/argo-cd-ingress.yml.tmpl | 24 - .../helm-apps/releases/cicd/argo-cd.yml.tmpl | 170 -- .../releases/cicd/argo-rollouts.yml.tmpl | 424 ---- .../helm-apps/releases/cicd/keel.yml.tmpl | 245 --- .../observability/fluent-operator.yml.tmpl | 55 - .../releases/observability/loki.yml.tmpl | 188 -- .../observability/metrics-server.yml.tmpl | 192 -- .../observability/observability.yml.tmpl | 391 ---- .../opentelemetry-operator.yml.tmpl | 134 -- .../releases/observability/tempo.yml.tmpl | 68 - .../harbor-certificate-generator.yml.tmpl | 6 - .../releases/registry/harbor.yml.tmpl | 371 ---- .../releases/secrets-storage/vault.yml.tmpl | 873 -------- .../inventory/group_vars/all.yml.tmpl | 6 +- .../group_vars/all/containerd.yml.tmpl | 60 + .../secrets-storage/vault-keys.json.tmpl | 8 - internal/secrets_storage/commands.go | 130 -- internal/secrets_storage/errors.go | 6 - internal/secrets_storage/helm.go | 44 - internal/templates/kubespray.go | 1 + kubespray/inventory/group_vars/all.yml | 7 +- .../inventory/group_vars/all/containerd.yml | 60 + .../group_vars/k8s_cluster/k8s-cluster.yml | 2 +- kubespray/inventory/hosts | 16 +- 46 files changed, 2023 insertions(+), 4343 deletions(-) delete mode 100644 .gitlab-ci.yml delete mode 100644 build/README.md delete mode 100644 build/debian/DEBIAN/control delete mode 100644 build/version.txt delete mode 100644 internal/cicd/helm.go delete mode 100644 internal/config/modules_cicd.go delete mode 100644 internal/config/modules_observability.go delete mode 100644 internal/config/modules_registry.go delete mode 100644 internal/config/modules_secrets_storage.go delete mode 100644 internal/observability/helm.go delete mode 100644 internal/registry/helm.go create mode 100644 internal/resources/templates/helm-apps/releases/additional-modules/ingress-contour.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl delete mode 100644 internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl create mode 100644 internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl delete mode 100644 internal/resources/templates/secrets-storage/vault-keys.json.tmpl delete mode 100644 internal/secrets_storage/commands.go delete mode 100644 internal/secrets_storage/errors.go delete mode 100644 internal/secrets_storage/helm.go create mode 100644 kubespray/inventory/group_vars/all/containerd.yml diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml deleted file mode 100644 index b161e6e..0000000 --- a/.gitlab-ci.yml +++ /dev/null @@ -1,173 +0,0 @@ -variables: - DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge - - KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug - KANIKO_CONTEXT: ${CI_PROJECT_DIR} - RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0 - CICD_MULTITOOL: harbor.kvazaric.ru/postgres-tasks/cicd-multitool:2.4 - BINARY_BUILDER_IMAGE: harbor.kvazaric.ru/mirror/library/golang:alpine - - PREPARE_RELEASE: - options: - - "No" - - "Yes" - value: "No" - description: Create release from this build? - - WITHOUT_BUILD: - options: - - "No" - - "Yes" - value: "Yes" - description: Create release without building? - -stages: - - prepare - - build - - release - -make-version-name: - stage: prepare - image: - name: ${CICD_MULTITOOL} - entrypoint: [""] - allow_failure: false - tags: - - build - - docker - script: - - echo "VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)" > version.env - artifacts: - reports: - dotenv: version.env - -build-docker: - variables: - DOCKERFILE_PATH: Dockerfile - IMAGE_DESTINATION: image - stage: build - image: - name: ${KANIKO_IMAGE} - entrypoint: [""] - allow_failure: false - tags: - - build - - docker - before_script: - - mkdir -p /kaniko/.docker - - echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json - script: - - | - /kaniko/executor --context "${KANIKO_CONTEXT}" \ - --dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \ - --destination "${DOCKER_IMAGE}:${VERSION}-${CI_COMMIT_SHORT_SHA}" - dependencies: - - make-version-name - needs: - - make-version-name - rules: - - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes" - when: never - - changes: - - build/docker/**/* - - cmd/**/* - - internal/**/* - - kubespray/**/* - - go.sum - - go.mod - - requirements.txt - - ansible.cfg - if: $CI_COMMIT_REF_NAME =~ /^(master)$/ - when: always - -build-binary: - stage: build - image: - name: ${BINARY_BUILDER_IMAGE} - entrypoint: [""] - allow_failure: false - tags: - - build - - docker - script: - - CGO_ENABLED=0 GOOS=linux go build -v -o kube-forge ./cmd/main/main.go - artifacts: - paths: - - ${CI_PROJECT_DIR}/kube-forge - rules: - - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes" - when: never - - changes: - - build/docker/**/* - - cmd/**/* - - internal/**/* - - kubespray/**/* - - go.sum - - go.mod - - requirements.txt - - ansible.cfg - if: $CI_COMMIT_REF_NAME =~ /^(master)$/ - when: always - -prepare-tarball: - stage: build - image: ${CICD_MULTITOOL} - allow_failure: false - tags: - - build - - docker - script: - - mkdir archive - - cp kube-forge archive - - cp requirements.txt archive - - cp -R kubespray archive - - tar zcvf kube-forge-${VERSION}-${CI_COMMIT_SHORT_SHA}.tar.gz archive - dependencies: - - make-version-name - - build-binary - needs: - - make-version-name - - build-binary - artifacts: - paths: - - ${CI_PROJECT_DIR}/kube-forge-${VERSION}-${CI_COMMIT_SHORT_SHA}.tar.gz - rules: - - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes" - when: never - - changes: - - build/docker/**/* - - cmd/**/* - - internal/**/* - - kubespray/**/* - - go.sum - - go.mod - - requirements.txt - - ansible.cfg - if: $CI_COMMIT_REF_NAME =~ /^(master)$/ - when: always - -make-release: - stage: release - image: ${RELEASE_CLI_IMAGE} - dependencies: - - make-version-name - needs: - - make-version-name - tags: - - build - - docker - rules: - - if: $PREPARE_RELEASE == "Yes" - script: - - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt) - - echo "Preparing release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}" - release: # See https://docs.gitlab.com/ee/ci/yaml/#release for available properties - name: kube-forge:${VERSION}-${CI_COMMIT_SHORT_SHA} - tag_name: "${VERSION}-${CI_COMMIT_SHORT_SHA}" - description: "Kube-forge release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}" - assets: - links: - - name: "Docker image" - url: "https://harbor.kvazaric.ru/harbor/projects/4/repositories/kube-forge/artifacts-tab" - link_type: "image" - when: on_success diff --git a/README.md b/README.md index d14c635..8c37975 100644 --- a/README.md +++ b/README.md @@ -8,12 +8,10 @@ ```shell touch k8s-admin.conf -touch vault-keys.json docker run -v $(pwd)/config.yaml:/application/config.yaml \ -v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \ --mount type=bind,source=$(pwd)/k8s-admin.conf,target=/application/k8s-admin.conf \ - --mount type=bind,source=$(pwd)/vault-keys.json,target=/application/vault-keys.json \ harbor.kvazaric.ru/kube-forge/kube-forge:1.1-f84c27e6 apply ``` diff --git a/build/README.md b/build/README.md deleted file mode 100644 index 343c925..0000000 --- a/build/README.md +++ /dev/null @@ -1,5 +0,0 @@ -## Сборка Docker - -## Сборка Linux - -### Debian diff --git a/build/debian/DEBIAN/control b/build/debian/DEBIAN/control deleted file mode 100644 index caaf13c..0000000 --- a/build/debian/DEBIAN/control +++ /dev/null @@ -1,5 +0,0 @@ -Package: kube-forge -Version: 1.0 -Architecture: amd64 -Maintainer: Kvazaric -Description: A program to install Kubernetes-based platform to facilitate the development, desting and dperation of Ccntainerized applications \ No newline at end of file diff --git a/build/version.txt b/build/version.txt deleted file mode 100644 index b123147..0000000 --- a/build/version.txt +++ /dev/null @@ -1 +0,0 @@ -1.1 \ No newline at end of file diff --git a/cmd/main/main.go b/cmd/main/main.go index 6425ab3..714a331 100644 --- a/cmd/main/main.go +++ b/cmd/main/main.go @@ -3,14 +3,10 @@ package main import ( "flag" "kube-forge/internal/additional" - "kube-forge/internal/cicd" "kube-forge/internal/config" "kube-forge/internal/csi" "kube-forge/internal/kubespray" "kube-forge/internal/logging" - "kube-forge/internal/observability" - "kube-forge/internal/registry" - "kube-forge/internal/secrets_storage" "kube-forge/internal/templates" "os" ) @@ -18,10 +14,6 @@ import ( func installAndConfigureModules() { csi.ApplyCharts() additional.ApplyCharts() - registry.ApplyCharts() - secrets_storage.ApplyCharts() - cicd.ApplyCharts() - observability.ApplyCharts() } func main() { @@ -53,7 +45,10 @@ func main() { case "scale": kubespray.ScaleCluster() return + case "reset": + kubespray.ResetCluster() + return } } - logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale") + logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale, reset") } diff --git a/config.sample.yaml b/config.sample.yaml index 1b77da8..155ceb6 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -1,23 +1,36 @@ credentials: user: sre-admin ask_sudo_password: false - private_key_file: /home/sre-admin/.ssh/id_rsa + private_key_file: /Users/georgest/.ssh/id_rsa_bastion_ift hosts: - - hostname: vbox-prod-k8s-master-01 - ip: "10.250.50.22" + - hostname: t1-disk-lt-k8s-test-master-01 + ip: "10.100.20.49" roles: [control_plane, etcd] - - hostname: vbox-prod-k8s-slave-01 - ip: "10.250.50.23" + + - hostname: t1-disk-lt-k8s-test-slave-01 + ip: "10.100.20.48" roles: [node] - - hostname: vbox-prod-k8s-slave-02 - ip: "10.250.50.21" + + - hostname: t1-disk-lt-k8s-test-slave-02 + ip: "10.100.20.47" roles: [node] orchestrator: version: v1.29.0 + cluster_name: cluster.local + kubelet_dir: "/var/lib/kubelet" container_engine: install: true + type: "containerd" + data_dir: "/var/lib/containerd" + state_dir: "/run/containerd" + dns: + servers: + - 8.8.8.8 + - 8.8.4.4 + - 1.1.1.1 + disable_host_nameservers: false ping_access_ip: true auto_renew_certificates: true pod_security_policy_enabled: true @@ -28,103 +41,12 @@ orchestrator: skip_verify: false modules: - admin_password: changeit - observability: - enabled: true - logging: - enabled: true - events: - enabled: true - tracing: - enabled: true - monitoring: - enabled: true - alert_manager: - enabled: true - route: - receiver: kvazaric_notifications - group_wait: 1s - repeat_interval: 180m - routes: - - receiver: "kvazaric_notifications" - group_by: ["alertname"] - group_wait: 1s - repeat_interval: 8737h - matchers: - - fireOnce=true - receivers: - - name: kvazaric_notifications - telegram_configs: - - send_resolved: true - api_url: https://api.telegram.org - bot_token: bot_token - chat_id: -10000 - parse_mode: HTML - message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}' - http_config: - follow_redirects: true - enable_http2: false - blackbox: - enabled: true - kube_state: - enabled: true - node: - enabled: true - visualization: - enabled: true - grafana: - enabled: true - expose: - type: ingress # ingress or NodePort - domain: grafana.disk.lt.t1.cloud - # path: "/grafana" - tls: - enabled: true - - cicd: - enabled: true - argo_cd: - expose: - type: ingress # ingress or NodePort - domain: argocd.disk.lt.t1.cloud - # path: "/cicd" - tls: - enabled: true - rollouts: - enabled: true - updates_operator: - enabled: true - - secrets_storage: - enabled: true - key_shares: 5 - key_threshold: 3 - expose: - type: ingress # ingress or NodePort - domain: vault.disk.lt.t1.cloud - tls: - enabled: true - csi_integration: - enabled: true - - registry: - enabled: true - expose: - type: ingress # ingress or nodePort - domain: harbor.disk.lt.t1.cloud - tls: - enabled: true - enabled_scanner: true - additional: cert_manager: enabled: true - account_email: adminmail@gmail.com - ingress: - enabled: true - host_network: true + account_email: g.stykalin@rockitsoft.ru storage: longhorn: - enabled: true + enabled: false secrets_store_csi_driver: - enabled: true + enabled: false diff --git a/go.mod b/go.mod index 8dcf71a..7197da1 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/BurntSushi/toml v1.3.2 github.com/Masterminds/sprig/v3 v3.2.3 github.com/apenella/go-ansible v1.3.0 - github.com/apenella/go-ansible/v2 v2.0.0 + github.com/apenella/go-ansible/v2 v2.0.1 github.com/ilyakaznacheev/cleanenv v1.5.0 github.com/mittwald/go-helm-client v0.12.9 github.com/sirupsen/logrus v1.9.3 diff --git a/go.sum b/go.sum index cb5664a..34c2f34 100644 --- a/go.sum +++ b/go.sum @@ -28,8 +28,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= github.com/apenella/go-ansible v1.3.0 h1:INNaVzrgQMNIO9Yvnly6lA5KfN/pY3m1Z37gpmlUzPM= github.com/apenella/go-ansible v1.3.0/go.mod h1:qiLWolQqLkCoqFlPvdsKhxk7O0qjIBCPNhUKpH/vjaU= -github.com/apenella/go-ansible/v2 v2.0.0 h1:9aZkU8dQ2fVITYX5V1CiQ3VX4PnNPBTgv31wJFd2Ito= -github.com/apenella/go-ansible/v2 v2.0.0/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ= +github.com/apenella/go-ansible/v2 v2.0.1 h1:9o3805u4NAIMf1px5EKpRS2LEa2aeQbMtHB7vilt7XE= +github.com/apenella/go-ansible/v2 v2.0.1/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ= github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df h1:sEikY2P+NZK/7VZUwIsnXIGElhsuFDSxh1bZYwHxdcI= github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df/go.mod h1:cLVL6GjUiKG/WyBzX+KD6h/XRV/HnNZIZbMNNiBgQ9o= github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df h1:SvlYbjlsSQDS7hbVT1h012/zdgvcwWJ+Yd9XRiiY/8s= diff --git a/internal/cicd/helm.go b/internal/cicd/helm.go deleted file mode 100644 index dcac936..0000000 --- a/internal/cicd/helm.go +++ /dev/null @@ -1,108 +0,0 @@ -package cicd - -import ( - "kube-forge/internal/config" - "kube-forge/internal/helm_client" - "kube-forge/internal/templates" - "time" - - go_helm_client "github.com/mittwald/go-helm-client" -) - -var HELM_REPOS = [...]config.RepoSettings{ - { - Name: "kube-forge", - URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable", - }, -} - -func getArgoCdSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "argo-cd", - ChartName: appConfig.Modules.Cicd.ArgoCd.ChartRef, - Version: appConfig.Modules.Cicd.ArgoCd.ChartVersion, - Namespace: appConfig.Modules.Cicd.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"), - } -} - -func getArgoRolloutsSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "argo-rollouts", - ChartName: appConfig.Modules.Cicd.Rollouts.ChartRef, - Version: appConfig.Modules.Cicd.Rollouts.ChartVersion, - Namespace: appConfig.Modules.Cicd.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"), - } -} - -func getKeelSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "keel", - ChartName: appConfig.Modules.Cicd.UpdatesOperator.ChartRef, - Version: appConfig.Modules.Cicd.UpdatesOperator.ChartVersion, - Namespace: appConfig.Modules.Cicd.UpdatesOperator.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"), - } -} - -func getArgoCdIngressSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "argo-cd-ingress", - ChartName: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef, - Version: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion, - Namespace: appConfig.Modules.Cicd.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"), - } -} - -func addCicdHelmRepos() { - appConfig := config.GetConfig() - for _, repoSettings := range HELM_REPOS { - helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings) - } -} - -func ApplyCharts() { - addCicdHelmRepos() - appConfig := config.GetConfig() - if appConfig.Modules.Cicd.Enabled { - helm_client.InstallChart(getArgoCdSpec()) - if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" { - helm_client.InstallChart(getArgoCdIngressSpec()) - } else { - helm_client.DeleteChart(getArgoCdIngressSpec()) - } - if appConfig.Modules.Cicd.Rollouts.Enabled { - helm_client.InstallChart(getArgoRolloutsSpec()) - } else { - helm_client.DeleteChart(getArgoRolloutsSpec()) - } - if appConfig.Modules.Cicd.UpdatesOperator.Enabled { - helm_client.InstallChart(getKeelSpec()) - } else { - helm_client.DeleteChart(getKeelSpec()) - } - } else { - helm_client.DeleteChart(getArgoCdIngressSpec()) - helm_client.DeleteChart(getArgoCdSpec()) - helm_client.DeleteChart(getArgoRolloutsSpec()) - helm_client.DeleteChart(getKeelSpec()) - } -} diff --git a/internal/config/config.go b/internal/config/config.go index a5950c2..d7bc9c2 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -30,13 +30,7 @@ type Config struct { Orchestrator Orchestrator `yaml:"orchestrator"` Modules struct { - AdminPassword string `yaml:"admin_password"` - AdditionalRepositories interface{} `yaml:"additional_repositories"` - Additional Additional `yaml:"additional"` - Observability Observability `yaml:"observability"` - Registry Registry `yaml:"registry"` - Cicd Cicd `yaml:"cicd"` - SecretsStorage SecretsStorage `yaml:"secrets_storage"` + Additional Additional `yaml:"additional"` } `yaml:"modules"` } @@ -54,9 +48,6 @@ func CreateConfig(configPath string, workDir string, password string) *Config { if password != "" { instance.Credentials.Password = password } - - generateCreds(instance) - return instance } diff --git a/internal/config/modules_cicd.go b/internal/config/modules_cicd.go deleted file mode 100644 index 3461389..0000000 --- a/internal/config/modules_cicd.go +++ /dev/null @@ -1,96 +0,0 @@ -package config - -type Cicd struct { - Enabled bool `yaml:"enabled"` - Namespace string `yaml:"namespace" env-default:"cicd"` - ArgoCd struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"` - ChartVersion string `yaml:"chart_version" env-default:"6.7.10"` - AdminPassword string - Ha struct { - Enabled bool `yaml:"enabled"` - Autoscaling bool `yaml:"autoscaling"` - } `yaml:"ha"` - Expose struct { - Type string `yaml:"type"` - Domain string `yaml:"domain"` - Path string `yaml:"path" env-default:"/"` - NodePortHttp int `yaml:"node_port_http" env-default:"30005"` - NodePortHttps int `yaml:"node_port_https" env-default:"30006"` - Tls struct { - Enabled bool `yaml:"enabled"` - } `yaml:"tls"` - } `yaml:"expose"` - Repositories interface{} `yaml:"repositories"` - Rbac struct { - AdditionalPolicies string `yaml:"additional_policies"` - } `yaml:"argo_cd"` - ServiceIngress struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"` - ChartVersion string `yaml:"chart_version" env-default:"0.1.0"` - } `yaml:"service_ingress"` - Global struct { - Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"global"` - Server struct { - Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"server"` - Redis struct { - Image string `yaml:"image" env-default:"public.ecr.aws/docker/library/redis"` - Tag string `yaml:"tag" env-default:"7.2.4-alpine"` - Exporter struct { - Image string `yaml:"image" env-default:"public.ecr.aws/bitnami/redis-exporter"` - Tag string `yaml:"tag" env-default:"1.58.0"` - } `yaml:"exporter"` - } `yaml:"redis"` - ApplicationSet struct { - Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"application_set"` - Dex struct { - Image string `yaml:"image" env-default:"ghcr.io/dexidp/dex"` - Tag string `yaml:"tag" env-default:"v2.38.0"` - } `yaml:"dex"` - RepoServer struct { - Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"repo_server"` - Notifications struct { - Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"notifications"` - Controller struct { - Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"controller"` - } `yaml:"argo_cd"` - UpdatesOperator struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"` - ChartVersion string `yaml:"chart_version" env-default:"1.0.3"` - Enabled bool `yaml:"enabled"` - Namespace string `yaml:"namespace" env-default:"kube-system"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"` - Tag string `yaml:"tag" env-default:"latest"` - } `yaml:"updates_operator"` - Rollouts struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"` - ChartVersion string `yaml:"chart_version" env-default:"2.35.1"` - Enabled bool `yaml:"enabled"` - Registry string `yaml:"registry" env-default:"quay.io"` - Repository string `yaml:"repository" env-default:"argoproj/argo-rollouts"` - Tag string `yaml:"tag" env-default:"latest"` - Ha struct { - Enabled bool `yaml:"enabled"` - } `yaml:"ha"` - Expose struct { - Type string `yaml:"type"` - NodePort int `yaml:"node_port" env-default:"30010"` - } `yaml:"expose"` - Controller struct { - } `yaml:"controller"` - Dashboard struct { - } `yaml:"dashboard"` - } `yaml:"rollouts"` -} diff --git a/internal/config/modules_observability.go b/internal/config/modules_observability.go deleted file mode 100644 index 06051c1..0000000 --- a/internal/config/modules_observability.go +++ /dev/null @@ -1,179 +0,0 @@ -package config - -type Observability struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/observability"` - ChartVersion string `yaml:"chart_version" env-default:"0.1.0"` - Enabled bool `yaml:"enabled"` - Logging Logging `yaml:"logging"` - Tracing Tracing `yaml:"tracing"` - Monitoring Monitoring `yaml:"monitoring"` - Visualization Visualization `yaml:"visualization"` - Namespace string `yaml:"namespace" env-default:"observability"` -} - -type Logging struct { - Enabled bool `yaml:"enabled"` - Operator struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/fluent-operator"` - ChartVersion string `yaml:"chart_version" env-default:"2.7.0"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"` - Tag string `yaml:"tag" env-default:"v2.7.0"` - Namespace string `yaml:"namespace" env-default:"observability"` - InitContainer struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"` - Tag string `yaml:"tag" env-default:"20.10"` - } `yaml:"initcontainer"` - } `yaml:"operator"` - Fluentd struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluentd"` - Tag string `yaml:"tag" env-default:"v1.15.3"` - } `yaml:"fluentd"` - FluentBit struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-bit"` - Tag string `yaml:"tag" env-default:"v2.2.2"` - } `yaml:"fluent_bit"` - Loki struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/loki"` - ChartVersion string `yaml:"chart_version" env-default:"5.47.2"` - Registry string `yaml:"registry" env-default:"harbor.kvazaric.ru"` - Image string `yaml:"image" env-default:"kube-forge/grafana/loki"` - Tag string `yaml:"tag" env-default:"latest"` - Namespace string `yaml:"namespace" env-default:"observability"` - Persistence struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - StorageSize string `yaml:"storage_size" env-default:"10Gi"` - Retention string `yaml:"retention" env-default:"168h"` - } `yaml:"persistence"` - AlertManagerUrl string `yaml:"alert_manager_u rl" env-default:"http://observability-alert-manager:9093"` - AdditionalRulesGroups string `yaml:"additional_rules_groups" env-default:""` - } `yaml:"loki"` - Events struct { - Enabled bool `yaml:"enabled"` - Exporter struct { - Image string `yaml:"image" env-default:"ghcr.io/resmoio/kubernetes-event-exporter"` - Tag string `yaml:"tag" env-default:"v1.4"` - } `yaml:"exporter"` - Cron struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kubectl"` - Tag string `yaml:"tag" env-default:"1.27.5-debian-11-r8"` - Schedule string `yaml:"schedule" env-default:"*/2 * * * *"` - } `yaml:"cron"` - } `yaml:"events"` -} - -type Tracing struct { - Enabled bool `yaml:"enabled"` - Operator struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/opentelemetry-operator"` - ChartVersion string `yaml:"chart_version" env-default:"0.55.0"` - Image string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"` - Tag string `yaml:"tag" env-default:""` - Namespace string `yaml:"namespace" env-default:"observability"` - } `yaml:"operator"` - Collector struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"` - Tag string `yaml:"tag" env-default:"0.95.0"` - } `yaml:"collector"` - Tempo struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/tempo"` - ChartVersion string `yaml:"chart_version" env-default:"1.7.2"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"` - Tag string `yaml:"tag" env-default:"2.3.1"` - Namespace string `yaml:"namespace" env-default:"observability"` - Retention string `yaml:"retention" env-default:"24h"` - ListenPort int `yaml:"listen_port" env-default:"3100"` - Persistence struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - StorageSize string `yaml:"storage_size" env-default:"10Gi"` - } `yaml:"persistence"` - TempoQuery struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo-query"` - Tag string `yaml:"tag" env-default:"2.3.1"` - ListenPort int `yaml:"listen_port" env-default:"16686"` - } `yaml:"tempo_query"` - } `yaml:"tempo"` -} - -type Monitoring struct { - Enabled bool `yaml:"enabled"` - Prometheus struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/prometheus"` - Tag string `yaml:"tag" env-default:"v2.45.0"` - ScrapeInterval string `yaml:"scrape_interval" env-default:"15s"` - Persistence struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - StorageSize string `yaml:"storage_size" env-default:"3Gi"` - Retention string `yaml:"retention" env-default:"7d"` - } `yaml:"persistence"` - Operator struct { - Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-operator"` - Tag string `yaml:"tag" env-default:"v0.65.2"` - ConfigReloader struct { - Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-config-reloader"` - Tag string `yaml:"tag" env-default:"v0.65.2"` - } `yaml:"config_reloader"` - KubeRbacProxy struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-rbac-proxy"` - Tag string `yaml:"tag" env-default:"0.14.1"` - } `yaml:"kube_rbac_proxy"` - } `yaml:"operator"` - } `yaml:"prometheus"` - AlertManager struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/alertmanager"` - Tag string `yaml:"tag" env-default:"v0.26.0"` - AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"` - Route interface{} `yaml:"route"` - Receivers interface{} `yaml:"receivers"` - } `yaml:"alert_manager"` - Blackbox struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/blackbox-exporter"` - Tag string `yaml:"tag" env-default:"v0.24.0"` - AdditionalModules string `yaml:"routes" env-default:""` - } `yaml:"blackbox"` - KubeState struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-state-metrics"` - Tag string `yaml:"tag" env-default:"2.9.2"` - } `yaml:"kube_state"` - Node struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/node-exporter"` - Tag string `yaml:"tag" env-default:"v1.5.0"` - } `yaml:"node"` - MetricsServer struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"` - ChartVersion string `yaml:"chart_version" env-default:"3.12.1"` - Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"` - Tag string `yaml:"tag" env-default:""` - Namespace string `yaml:"namespace" env-default:"kube-system"` - } -} - -type Visualization struct { - Enabled bool `yaml:"enabled"` - Grafana struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana"` - Tag string `yaml:"tag" env-default:"10.4.1-v2"` - Expose struct { - Type string `yaml:"type" env-default:"ingress"` - Domain string `yaml:"domain" env-default:""` - Path string `yaml:"path" env-default:"/"` - NodePortHttp int `yaml:"node_port_http" env-default:"30007"` - Tls struct { - Enabled bool `yaml:"enabled"` - } - } `yaml:"expose"` - Persistence struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - StorageSize string `yaml:"storage_size" env-default:"2Gi"` - } `yaml:"persistence"` - Config struct { - Auth string `yaml:"auth" env-default:""` - AuthGenericAuth string `yaml:"auth_generic_auth" env-default:""` - AdditionalDatasources interface{} `yaml:"additional_datasources"` - } `yaml:"config"` - } `yaml:"grafana"` -} diff --git a/internal/config/modules_registry.go b/internal/config/modules_registry.go deleted file mode 100644 index 4a8ffcb..0000000 --- a/internal/config/modules_registry.go +++ /dev/null @@ -1,66 +0,0 @@ -package config - -type Registry struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/harbor"` - ChartVersion string `yaml:"chart_version" env-default:"1.14.2"` - Enabled bool `yaml:"enabled"` - AdminPassword string - Namespace string `yaml:"namespace" env-default:"registry"` - Expose struct { - Type string `yaml:"type" env-default:"nodePort"` - Domain string `yaml:"domain" env-default:""` - Path string `yaml:"path" env-default:"/"` - NodePortHttp int `yaml:"node_port_http" env-default:"30002"` - NodePortHttps int `yaml:"node_port_https" env-default:"30003"` - } `yaml:"expose"` - Tls struct { - Enabled bool `yaml:"enabled"` - CertificateGenerator struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/certificate-generator"` - ChartVersion string `yaml:"chart_version" env-default:"0.1.0"` - } `yaml:"certificate_generator"` - } `yaml:"tls"` - Persistence struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - RegistrySize string `yaml:"registry_size" env-default:"10Gi"` - JobserviceSize string `yaml:"jobservice_size" env-default:"1Gi"` - DatabaseSize string `yaml:"database_size" env-default:"2Gi"` - RedisSize string `yaml:"redis_size" env-default:"1Gi"` - TrivySize string `yaml:"trivy_size" env-default:"5Gi"` - } `yaml:"persistence"` - EnabledScanner bool `yaml:"enabled_scanner"` - Portal struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"portal"` - Core struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-core"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"core"` - Jobservice struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"jobservice"` - Registry struct { - Registry struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/registry-photon"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"registry"` - Controller struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"controller"` - } `yaml:"registry"` - Trivy struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"trivy"` - Database struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-db"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"database"` - Redis struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/redis-photon"` - Tag string `yaml:"tag" env-default:"v2.10.1"` - } `yaml:"redis"` -} diff --git a/internal/config/modules_secrets_storage.go b/internal/config/modules_secrets_storage.go deleted file mode 100644 index 4b422bb..0000000 --- a/internal/config/modules_secrets_storage.go +++ /dev/null @@ -1,48 +0,0 @@ -package config - -type SecretsStorage struct { - ChartRef string `yaml:"chart_ref" env-default:"kube-forge/vault"` - ChartVersion string `yaml:"chart_version" env-default:"0.1.0"` - Namespace string `yaml:"namespace" env-default:"secrets-storage"` - Enabled bool `yaml:"enabled"` - KeyShares int `yaml:"key_shares" env-default:"5"` - KeyThreshold int `yaml:"key_threshold" env-default:"3"` - UnsealKeys []string `yaml:"unseal_keys" env-default:"[]"` - AuthToken string `yaml:"auth_token" env-default:""` - Expose struct { - Type string `yaml:"type"` - Domain string `yaml:"domain"` - Path string `yaml:"path" env-default:"/"` - NodePort int `yaml:"node_port"` - Tls struct { - Enabled bool `yaml:"enabled"` - } `yaml:"tls"` - } `yaml:"expose"` - CsiIntegration struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-csi-provider"` - Tag string `yaml:"tag" env-default:"1.4.1"` - } `yaml:"csi_integration"` - Injector struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-k8s"` - Tag string `yaml:"tag" env-default:"1.3.1"` - } `yaml:"injector"` - Server struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"` - Tag string `yaml:"tag" env-default:"1.16.0"` - Persistence struct { - DataStorage struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - Size string `yaml:"size" env-default:"10Gi"` - } `yaml:"data_storage"` - AuditStorage struct { - StorageClass string `yaml:"storage_class" env-default:"local-path"` - Size string `yaml:"size" env-default:"10Gi"` - } `yaml:"audit_storage"` - } `yaml:"persistence"` - } `yaml:"server"` - Agent struct { - Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"` - Tag string `yaml:"tag" env-default:"1.16.0"` - } `yaml:"agent"` -} diff --git a/internal/config/orchestrator.go b/internal/config/orchestrator.go index 7025df9..07e499f 100644 --- a/internal/config/orchestrator.go +++ b/internal/config/orchestrator.go @@ -12,16 +12,19 @@ type RegistryMirror struct { type Orchestrator struct { Version string `yaml:"version" env-default:"v1.29.0"` - ClusterName string `yaml:"cluster_name" env-default:"k8s-cluster.local"` + ClusterName string `yaml:"cluster_name" env-default:"cluster.local"` BinDir string `yaml:"bin_dir" env-default:"/usr/local/bin"` SysctlFilePath string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"` LoadbalancerApiserverPort int `yaml:"loadbalancer_apiserver_port" env-default:"6443"` Dns Dns `yaml:"dns"` CloudProvider string `yaml:"cloud_provider"` ExgernalCloudProvider string `yaml:"external_cloud_provider"` + KubeletDir string `yaml:"kubelet_dir" env-default:"/var/lib/kubelet"` ContainerEngine struct { - Type string `yaml:"type" env-default:"containerd"` - Install bool `yaml:"install"` + Type string `yaml:"type" env-default:"containerd"` + Install bool `yaml:"install"` + DataDir string `yaml:"data_dir" env-default:"/var/lib/containerd"` + StateDir string `yaml:"state_dir" env-default:"/run/containerd"` } `yaml:"container_engine"` PingAccessIp bool `yaml:"ping_access_ip"` AutoRenewCertificates bool `yaml:"auto_renew_certificates"` diff --git a/internal/config/utility.go b/internal/config/utility.go index 0c40e0c..860ae3d 100644 --- a/internal/config/utility.go +++ b/internal/config/utility.go @@ -11,8 +11,3 @@ func getBcryptHash(input string) string { } return string(hashedPassword) } - -func generateCreds(config *Config) { - config.Modules.Cicd.ArgoCd.AdminPassword = getBcryptHash(config.Modules.AdminPassword) - config.Modules.Registry.AdminPassword = config.Modules.AdminPassword -} diff --git a/internal/kubespray/cluster.go b/internal/kubespray/cluster.go index dca0f15..42ab05f 100644 --- a/internal/kubespray/cluster.go +++ b/internal/kubespray/cluster.go @@ -21,3 +21,9 @@ func ScaleCluster() { runPlaybook("kubespray/project/scale.yml", "") CopyK8SAdminConfig(appConfig.KubeconfigFile) } + +func ResetCluster() { + appConfig := config.GetConfig() + runPlaybook("kubespray/project/reset.yml", "") + CopyK8SAdminConfig(appConfig.KubeconfigFile) +} diff --git a/internal/observability/helm.go b/internal/observability/helm.go deleted file mode 100644 index 7f7fd65..0000000 --- a/internal/observability/helm.go +++ /dev/null @@ -1,122 +0,0 @@ -package observability - -import ( - "kube-forge/internal/config" - "kube-forge/internal/helm_client" - "kube-forge/internal/templates" - "time" - - go_helm_client "github.com/mittwald/go-helm-client" -) - -var HELM_REPOS = []config.RepoSettings{ - { - Name: "kube-forge", - URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable", - }, -} - -func getFluentOperatorSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "fluent-operator", - ChartName: appConfig.Modules.Observability.Logging.Operator.ChartRef, - Version: appConfig.Modules.Observability.Logging.Operator.ChartVersion, - Namespace: appConfig.Modules.Observability.Logging.Operator.Namespace, - CreateNamespace: true, - Atomic: true, - UpgradeCRDs: true, - Timeout: time.Second * 60, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"), - } -} - -func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "opentelemetry-operator", - ChartName: appConfig.Modules.Observability.Tracing.Operator.ChartRef, - Version: appConfig.Modules.Observability.Tracing.Operator.ChartVersion, - Namespace: appConfig.Modules.Observability.Tracing.Operator.Namespace, - CreateNamespace: true, - Atomic: true, - UpgradeCRDs: true, - Timeout: time.Second * 60, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"), - } -} - -func getMetricsServerSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "metrics-server", - ChartName: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef, - Version: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion, - Namespace: appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 60, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"), - } -} - -func getTempoSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "tempo", - ChartName: appConfig.Modules.Observability.Tracing.Tempo.ChartRef, - Version: appConfig.Modules.Observability.Tracing.Tempo.ChartVersion, - Namespace: appConfig.Modules.Observability.Tracing.Tempo.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 60, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"), - } -} - -func getLokiSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "loki", - ChartName: appConfig.Modules.Observability.Logging.Loki.ChartRef, - Version: appConfig.Modules.Observability.Logging.Loki.ChartVersion, - Namespace: appConfig.Modules.Observability.Logging.Loki.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 60, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"), - } -} - -func getObservabilitySpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "observability", - ChartName: appConfig.Modules.Observability.ChartRef, - Version: appConfig.Modules.Observability.ChartVersion, - Namespace: appConfig.Modules.Observability.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"), - } -} - -func ApplyCharts() { - appConfig := config.GetConfig() - helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS) - if appConfig.Modules.Observability.Enabled { - if appConfig.Modules.Observability.Logging.Enabled { - helm_client.InstallChart(getFluentOperatorSpec()) - helm_client.InstallChart(getLokiSpec()) - } - if appConfig.Modules.Observability.Tracing.Enabled { - helm_client.InstallChart(getOpenTelemetryOperatorSpec()) - helm_client.InstallChart(getTempoSpec()) - } - if appConfig.Modules.Observability.Monitoring.Enabled { - helm_client.InstallChart(getMetricsServerSpec()) - } - helm_client.InstallChart(getObservabilitySpec()) - } -} diff --git a/internal/registry/helm.go b/internal/registry/helm.go deleted file mode 100644 index 602fc8c..0000000 --- a/internal/registry/helm.go +++ /dev/null @@ -1,61 +0,0 @@ -package registry - -import ( - "kube-forge/internal/config" - "kube-forge/internal/helm_client" - "kube-forge/internal/templates" - "time" - - go_helm_client "github.com/mittwald/go-helm-client" -) - -var HELM_REPOS = []config.RepoSettings{ - { - Name: "kube-forge", - URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable", - }, -} - -func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "harbor-certificate-generator", - ChartName: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef, - Version: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion, - Namespace: appConfig.Modules.Registry.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 60, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"), - } -} - -func getHarborSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "harbor", - ChartName: appConfig.Modules.Registry.ChartRef, - Version: appConfig.Modules.Registry.ChartVersion, - Namespace: appConfig.Modules.Registry.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"), - } -} - -func ApplyCharts() { - appConfig := config.GetConfig() - helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS) - if appConfig.Modules.Registry.Enabled { - if appConfig.Modules.Registry.Expose.Type == "ingress" { - helm_client.InstallChart(getHarborCertificateGeneratorSpec()) - } else { - helm_client.DeleteChart(getHarborCertificateGeneratorSpec()) - } - helm_client.InstallChart(getHarborSpec()) - } else { - helm_client.DeleteChart(getHarborSpec()) - helm_client.DeleteChart(getHarborCertificateGeneratorSpec()) - } -} diff --git a/internal/resources/templates/helm-apps/releases/additional-modules/ingress-contour.yml.tmpl b/internal/resources/templates/helm-apps/releases/additional-modules/ingress-contour.yml.tmpl new file mode 100644 index 0000000..29097f7 --- /dev/null +++ b/internal/resources/templates/helm-apps/releases/additional-modules/ingress-contour.yml.tmpl @@ -0,0 +1,1845 @@ +# Copyright Broadcom, Inc. All Rights Reserved. +# SPDX-License-Identifier: APACHE-2.0 + +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass +## + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets [array] Global Docker registry secret names as an array +## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s) +## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead +## +global: + imageRegistry: "" + ## E.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + defaultStorageClass: "" + storageClass: "" + ## Compatibility adaptations for Kubernetes platforms + ## + compatibility: + ## Compatibility adaptations for Openshift + ## + openshift: + ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) + ## + adaptSecurityContext: auto +## @section Common parameters +## + +## @param nameOverride String to partially override contour.fullname include (will maintain the release name) +## +nameOverride: "" +## @param fullnameOverride String to fully override contour.fullname template +## +fullnameOverride: "" +## @param namespaceOverride String to fully override common.names.namespace +## +namespaceOverride: "" +## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) +## +kubeVersion: "" +## @param extraDeploy [array] Array of extra objects to deploy with the release +## +extraDeploy: [] +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## Diagnostic mode in the deployment +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command [array] Command to override all containers in the deployment + ## + command: + - sleep + ## @param diagnosticMode.args [array] Args to override all containers in the deployment + ## + args: + - infinity +## @section Contour parameters +## + +## To configure Contour, you must specify ONE of the following two options. +## @param existingConfigMap Specifies the name of an externally-defined ConfigMap to use as the configuration (this is mutually exclusive with `configInline`) +## Helm will not manage the contents of this ConfigMap, it is your responsibility to create it. +## e.g: +## existingConfigMap: contour +## +existingConfigMap: "" +## @param configInline [object] Specifies Contour's configuration directly in YAML format +## When configInline is used, Helm manages Contour's configuration ConfigMap as +## part of the release, and existingConfigMap is ignored. +## Refer to https://projectcontour.io/docs/latest/configuration for available options. +## +configInline: + disablePermitInsecure: false + tls: + fallback-certificate: {} + accesslog-format: envoy +contour: + ## @param contour.enabled Contour Deployment creation. + ## + enabled: true + ## @param contour.image.registry [default: REGISTRY_NAME] Contour image registry + ## @param contour.image.repository [default: REPOSITORY_NAME/contour] Contour image name + ## @skip contour.image.tag Contour image tag + ## @param contour.image.digest Contour image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param contour.image.pullPolicy Contour Image pull policy + ## @param contour.image.pullSecrets [array] Contour Image pull secrets + ## @param contour.image.debug Enable image debug mode + ## + image: + registry: docker.io + repository: bitnami/contour + tag: 1.30.0-debian-12-r3 + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + debug: false + ## @param contour.contourConfigName Contour Deployment with ContourConfiguration CRD. + # + contourConfigName: "contour" + ## @param contour.configPath Contour Deployment with configmap. + ## + configPath: true + ## @param contour.replicaCount Number of Contour Pod replicas + # + replicaCount: 1 + ## @param contour.priorityClassName Priority class assigned to the pods + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param contour.schedulerName Name of the k8s scheduler (other than default) + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param contour.terminationGracePeriodSeconds In seconds, time the given to the Contour pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param contour.topologySpreadConstraints Topology Spread Constraints for pod assignment + ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## The value is evaluated as a template + ## + topologySpreadConstraints: [] + ## Configures the ports the Envoy proxy listens on + ## @param contour.containerPorts.xds Set xds port inside Contour pod + ## @param contour.containerPorts.metrics Set metrics port inside Contour pod + ## + containerPorts: + xds: 8001 + metrics: 8000 + ## @param contour.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: true + ## @param contour.hostAliases [array] Add deployment host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param contour.updateStrategy Strategy to use to update Pods + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: {} + ## @param contour.extraArgs [array] Extra arguments passed to Contour container + ## + extraArgs: [] + ## Contour container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## ref: https://projectcontour.io/guides/resource-limits/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param contour.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if contour.resources is set (contour.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param contour.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## @param contour.manageCRDs Manage the creation, upgrade and deletion of Contour CRDs. + ## + manageCRDs: true + ## @param contour.envoyServiceNamespace Namespace of the envoy service to inspect for Ingress status details. + ## + envoyServiceNamespace: "" + ## @param contour.envoyServiceName Name of the envoy service to inspect for Ingress status details. + ## + envoyServiceName: "" + ## @param contour.leaderElectionResourceName Name of the contour (Lease) leader election will lease. + ## + leaderElectionResourceName: "" + ## @param contour.ingressStatusAddress Address to set in Ingress object status. It is exclusive with `envoyServiceName` and `envoyServiceNamespace`. + ## + ingressStatusAddress: "" + ## @param contour.podAffinityPreset Contour Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param contour.podAntiAffinityPreset Contour Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## @param contour.podLabels [object] Extra labels for Contour pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param contour.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. + ## + lifecycleHooks: {} + ## @param contour.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + ## @param contour.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + ## @param contour.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## @param contour.nodeAffinityPreset.type Contour Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param contour.nodeAffinityPreset.key Contour Node label key to match Ignored if `affinity` is set. + ## @param contour.nodeAffinityPreset.values [array] Contour Node label values to match. Ignored if `affinity` is set. + ## + nodeAffinityPreset: + type: "" + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param contour.command Override default command + ## + command: [] + ## @param contour.args Override default args + ## + args: [] + ## @param contour.affinity [object] Affinity for Contour pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param contour.nodeSelector [object] Node labels for Contour pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param contour.tolerations [array] Tolerations for Contour pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param contour.podAnnotations [object] Contour Pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param contour.serviceAccount.create Create a serviceAccount for the Contour pod + ## @param contour.serviceAccount.name Use the serviceAccount with the specified name, a name is generated using the fullname template + ## @param contour.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param contour.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. + ## + serviceAccount: + create: true + name: "" + automountServiceAccountToken: false + annotations: {} + ## Contour Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param contour.podSecurityContext.enabled Default backend Pod securityContext + ## @param contour.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param contour.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param contour.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param contour.podSecurityContext.fsGroup Set Default backend Pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Envoy container security context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param contour.containerSecurityContext.enabled Enabled contour containers' Security Context + ## @param contour.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param contour.containerSecurityContext.runAsUser Set contour containers' Security Context runAsUser + ## @param contour.containerSecurityContext.runAsGroup Set contour containers' Security Context runAsGroup + ## @param contour.containerSecurityContext.runAsNonRoot Set contour containers' Security Context runAsNonRoot + ## @param contour.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte + ## @param contour.containerSecurityContext.privileged Set contour container's Security Context privileged + ## @param contour.containerSecurityContext.allowPrivilegeEscalation Set contour container's Security Context allowPrivilegeEscalation + ## @param contour.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param contour.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: true + ## @param contour.livenessProbe.enabled Enable/disable the Liveness probe + ## @param contour.livenessProbe.initialDelaySeconds Delay before liveness probe is initiated + ## @param contour.livenessProbe.periodSeconds How often to perform the probe + ## @param contour.livenessProbe.timeoutSeconds When the probe times out + ## @param contour.livenessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param contour.livenessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + livenessProbe: + enabled: true + initialDelaySeconds: 120 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param contour.readinessProbe.enabled Enable/disable the readiness probe + ## @param contour.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated + ## @param contour.readinessProbe.periodSeconds How often to perform the probe + ## @param contour.readinessProbe.timeoutSeconds When the probe times out + ## @param contour.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param contour.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + readinessProbe: + enabled: true + initialDelaySeconds: 15 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + ## @param contour.startupProbe.enabled Enable/disable the startup probe + ## @param contour.startupProbe.initialDelaySeconds Delay before startup probe is initiated + ## @param contour.startupProbe.periodSeconds How often to perform the probe + ## @param contour.startupProbe.timeoutSeconds When the probe times out + ## @param contour.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param contour.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + startupProbe: + enabled: false + initialDelaySeconds: 15 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + ## Contour certgen configs + ## + certgen: + ## @param contour.certgen.serviceAccount.create Create a serviceAccount for the Contour pod + ## @param contour.certgen.serviceAccount.name Use the serviceAccount with the specified name, a name is generated using the fullname template + ## @param contour.certgen.serviceAccount.automountServiceAccountToken Automount service account token for the server service account + ## @param contour.certgen.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. + ## + serviceAccount: + create: true + name: "" + automountServiceAccountToken: false + annotations: {} + ## @param contour.certgen.certificateLifetime Generated certificate lifetime (in days). + ## + certificateLifetime: 365 + ## @param contour.certgen.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: true + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param contour.certgen.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param contour.certgen.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param contour.certgen.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param contour.certgen.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) + ## + kubeAPIServerPorts: [443, 6443, 8443] + ## @param contour.certgen.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param contour.certgen.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param contour.certgen.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param contour.certgen.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## @param contour.tlsExistingSecret Name of the existingSecret to be use in Contour deployment. If it is not nil `contour.certgen` will be disabled. + ## It will override `tlsExistingSecret` + ## + tlsExistingSecret: "" + ## Contour Service properties + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services + ## + service: + ## @param contour.service.type Service type + ## + type: ClusterIP + ## @param contour.service.ports.xds Contour service xds port + ## @param contour.service.ports.metrics Contour service xds port + ## + ports: + xds: 8001 + metrics: 8000 + ## Node ports to expose + ## @param contour.service.nodePorts.xds Node port for HTTP + ## NOTE: choose port between <30000-32767> + ## + nodePorts: + xds: "" + ## @param contour.service.clusterIP Contour service Cluster IP + ## e.g.: + ## clusterIP: None + ## + clusterIP: "" + ## @param contour.service.loadBalancerIP Contour service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer + ## + loadBalancerIP: "" + ## @param contour.service.loadBalancerSourceRanges Contour service Load Balancer sources + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g: + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param contour.service.loadBalancerClass Contour service Load Balancer Class + ## ref https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + ## + loadBalancerClass: "" + ## @param contour.service.externalTrafficPolicy Contour service external traffic policy + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param contour.service.annotations Additional custom annotations for Contour service + ## + annotations: {} + ## @param contour.service.extraPorts Extra port to expose on Contour service + ## + extraPorts: [] + ## @param contour.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param contour.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param contour.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param contour.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param contour.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param contour.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) + ## + kubeAPIServerPorts: [443, 6443, 8443] + ## @param contour.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param contour.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param contour.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param contour.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## @param contour.initContainers [array] Attach additional init containers to Contour pods + ## For example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## + initContainers: [] + ## @param contour.sidecars [array] Add additional sidecar containers to the Contour pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param contour.extraVolumes [array] Array to add extra volumes + ## + extraVolumes: [] + ## @param contour.extraVolumeMounts [array] Array to add extra mounts (normally used with extraVolumes) + ## + extraVolumeMounts: [] + ## @param contour.extraEnvVars [array] Array containing extra env vars to be added to all Contour containers + ## For example: + ## extraEnvVars: + ## - name: MY_ENV_VAR + ## value: env_var_value + ## + extraEnvVars: [] + ## @param contour.extraEnvVarsCM ConfigMap containing extra env vars to be added to all Contour containers + ## + extraEnvVarsCM: "" + ## @param contour.extraEnvVarsSecret Secret containing extra env vars to be added to all Contour containers + ## + extraEnvVarsSecret: "" + ## @param contour.ingressClass.name Name of the ingress class to route through this controller. + ## @param contour.ingressClass.create Whether to create or not the IngressClass resource + ## @param contour.ingressClass.default Mark IngressClass resource as default for cluster + ## + ## DEPRECATED: Use a map instead + ## You can use the the 'contour.ingressClass' as a string to indicate the ingress + ## class name. This will skip the creation of an IngressClass resource. + ## e.g: + ## ingressClass: contour + ## + ingressClass: + name: "" + create: true + default: true + ## @param contour.debug Enable Contour debug log level + ## + debug: false + ## @param contour.logFormat Set contour log-format. Default text, either text or json. + ## + logFormat: text + ## @param contour.kubernetesDebug Contour kubernetes debug log level, Default 0, minimum 0, maximum 9. + ## + kubernetesDebug: 0 + ## @param contour.rootNamespaces Restrict Contour to searching these namespaces for root ingress routes. + ## + rootNamespaces: "" + ## Exposes configuration of Envoy's Overload Manager through Contour's bootstrapping process + ## When 95% of max heap size is reached for an Envoy, "shrink heap" operation is triggered. + ## When 98% of max heap size is reached for an Envoy, it no longer accepts requests. + ## https://projectcontour.io/docs/main/config/overload-manager/ + ## @param contour.overloadManager.enabled Enable Overload Manager + ## @param contour.overloadManager.maxHeapBytes Overload Manager's maximum heap size in bytes + ## + overloadManager: + enabled: false + maxHeapBytes: "2147483648" + ## PodDisruptionBudget for default backend + ## Contour Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ + ## @param contour.pdb.create Enable Pod Disruption Budget configuration + ## @param contour.pdb.minAvailable Minimum number/percentage of Default backend pods that should remain scheduled + ## @param contour.pdb.maxUnavailable Maximum number/percentage of Default backend pods that should remain scheduled + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + +## @section Envoy parameters +## +envoy: + ## @param envoy.enabled Envoy Proxy creation + ## + enabled: true + ## Bitnami Envoy image + ## ref: https://hub.docker.com/r/bitnami/envoy/tags/ + ## @param envoy.image.registry [default: REGISTRY_NAME] Envoy Proxy image registry + ## @param envoy.image.repository [default: REPOSITORY_NAME/envoy] Envoy Proxy image repository + ## @skip envoy.image.tag Envoy Proxy image tag (immutable tags are recommended) + ## @param envoy.image.digest Envoy Proxy image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param envoy.image.pullPolicy Envoy image pull policy + ## @param envoy.image.pullSecrets [array] Envoy image pull secrets + ## + image: + registry: docker.io + repository: bitnami/envoy + tag: 1.31.0-debian-12-r0 + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param envoy.priorityClassName Priority class assigned to the pods + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param envoy.schedulerName Name of the k8s scheduler (other than default) + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param envoy.topologySpreadConstraints Topology Spread Constraints for pod assignment + ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## The value is evaluated as a template + ## + topologySpreadConstraints: [] + ## @param envoy.extraArgs [array] Extra arguments passed to Envoy container + ## + extraArgs: [] + ## @param envoy.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param envoy.hostAliases [array] Add deployment host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## Envoy container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## ref: https://projectcontour.io/guides/resource-limits/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. If you do want to specify resources, uncomment the following + ## lines, adjust them as necessary, and remove the curly braces after 'resources:'. + ## @param envoy.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if envoy.resources is set (envoy.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param envoy.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## @param envoy.command Override default command + ## + command: [] + ## @param envoy.args Override default args + ## + args: [] + ## @param envoy.shutdownManager.enabled Contour shutdownManager sidecar + ## @param envoy.shutdownManager.extraArgs [array] Extra arguments passed to shutdown container + ## @param envoy.shutdownManager.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if envoy.shutdownManager.resources is set (envoy.shutdownManager.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## @param envoy.shutdownManager.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## @param envoy.shutdownManager.containerPorts.http Specify Port for shutdown container + ## @param envoy.shutdownManager.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. + ## + shutdownManager: + lifecycleHooks: {} + extraArgs: [] + enabled: true + resourcesPreset: "nano" + containerPorts: + http: 8090 + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + resources: {} + ## Shutdown Manager container security context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param envoy.shutdownManager.containerSecurityContext.enabled Enabled envoy shutdownManager containers' Security Context + ## @param envoy.shutdownManager.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param envoy.shutdownManager.containerSecurityContext.runAsUser Set envoy shutdownManager containers' Security Context runAsUser + ## @param envoy.shutdownManager.containerSecurityContext.runAsGroup Set contour containers' Security Context runAsGroup + ## @param envoy.shutdownManager.containerSecurityContext.runAsNonRoot Set envoy shutdownManager containers' Security Context runAsNonRoot + ## @param envoy.shutdownManager.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte + ## @param envoy.shutdownManager.containerSecurityContext.privileged Set envoy.shutdownManager container's Security Context privileged + ## @param envoy.shutdownManager.containerSecurityContext.allowPrivilegeEscalation Set envoy shutdownManager container's Security Context allowPrivilegeEscalation + ## @param envoy.shutdownManager.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param envoy.shutdownManager.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: true + ## @param envoy.shutdownManager.livenessProbe.enabled Enable livenessProbe + ## @param envoy.shutdownManager.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param envoy.shutdownManager.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param envoy.shutdownManager.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param envoy.shutdownManager.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param envoy.shutdownManager.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 120 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param envoy.shutdownManager.readinessProbe.enabled Enable/disable the readiness probe + ## @param envoy.shutdownManager.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated + ## @param envoy.shutdownManager.readinessProbe.periodSeconds How often to perform the probe + ## @param envoy.shutdownManager.readinessProbe.timeoutSeconds When the probe times out + ## @param envoy.shutdownManager.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param envoy.shutdownManager.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + readinessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 3 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param envoy.shutdownManager.startupProbe.enabled Enable/disable the startup probe + ## @param envoy.shutdownManager.startupProbe.initialDelaySeconds Delay before startup probe is initiated + ## @param envoy.shutdownManager.startupProbe.periodSeconds How often to perform the probe + ## @param envoy.shutdownManager.startupProbe.timeoutSeconds When the probe times out + ## @param envoy.shutdownManager.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param envoy.shutdownManager.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + startupProbe: + enabled: false + initialDelaySeconds: 15 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + ## @param envoy.shutdownManager.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + ## @param envoy.shutdownManager.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + ## @param envoy.shutdownManager.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + ## Envoy Initconfig initcontainer security context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param envoy.initConfig.containerSecurityContext.enabled Enabled envoy initConfig containers' Security Context + ## @param envoy.initConfig.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param envoy.initConfig.containerSecurityContext.runAsUser Set envoy initConfig containers' Security Context runAsUser + ## @param envoy.initConfig.containerSecurityContext.runAsGroup Set envoy initConfig containers' Security Context runAsUser + ## @param envoy.initConfig.containerSecurityContext.runAsNonRoot Set envoy initConfig containers' Security Context runAsNonRoot + ## @param envoy.initConfig.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte + ## @param envoy.initConfig.containerSecurityContext.privileged Set contraller container's Security Context privileged + ## @param envoy.initConfig.containerSecurityContext.allowPrivilegeEscalation Set contraller container's Security Context allowPrivilegeEscalation + ## @param envoy.initConfig.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param envoy.initConfig.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + initConfig: + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: true + ## @param envoy.kind Install as deployment or daemonset + ## + kind: daemonset + ## @param envoy.replicaCount Desired number of Controller pods + ## + replicaCount: 1 + ## @param envoy.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. + ## + lifecycleHooks: {} + ## @param envoy.updateStrategy [object] Strategy to use to update Pods + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## e.g: + ## updateStrategy: + ## type: RollingUpdate + ## rollingUpdate: + ## maxSurge: 25% + ## maxUnavailable: 25% + ## + updateStrategy: + type: RollingUpdate + ## @param envoy.minReadySeconds The minimum number of seconds for which a newly created Pod should be ready + ## + minReadySeconds: 0 + ## @param envoy.revisionHistoryLimit The number of old history to retain to allow rollback + ## + revisionHistoryLimit: 10 + ## Controller Autoscaling configuration + ## @param envoy.autoscaling.enabled Enable autoscaling for Controller + ## @param envoy.autoscaling.minReplicas Minimum number of Controller replicas + ## @param envoy.autoscaling.maxReplicas Maximum number of Controller replicas + ## @param envoy.autoscaling.targetCPU Target CPU utilization percentage + ## @param envoy.autoscaling.targetMemory Target Memory utilization percentage + ## @param envoy.autoscaling.behavior HPA Behavior + ## + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 11 + targetCPU: "" + targetMemory: "" + behavior: {} + ## @param envoy.podAffinityPreset Envoy Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## + podAffinityPreset: "" + ## @param envoy.podAntiAffinityPreset Envoy Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## + podAntiAffinityPreset: "" + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## @param envoy.nodeAffinityPreset.type Envoy Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param envoy.nodeAffinityPreset.key Envoy Node label key to match Ignored if `affinity` is set. + ## @param envoy.nodeAffinityPreset.values [array] Envoy Node label values to match. Ignored if `affinity` is set. + ## + nodeAffinityPreset: + type: "" + key: "" + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param envoy.affinity [object] Affinity for Envoy pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param envoy.nodeSelector [object] Node labels for Envoy pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param envoy.tolerations [array] Tolerations for Envoy pod assignment + ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param envoy.podAnnotations [object] Envoy Pod annotations + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param envoy.podLabels Extra labels for Envoy pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## Pod security context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param envoy.podSecurityContext.enabled Envoy Pod securityContext + ## @param envoy.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param envoy.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param envoy.podSecurityContext.fsGroup User ID for the for the mounted volumes + ## @param envoy.podSecurityContext.sysctls Array of sysctl options to allow + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + supplementalGroups: [] + fsGroup: 0 + sysctls: [] + ## Envoy container security context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param envoy.containerSecurityContext.enabled Enabled envoy containers' Security Context + ## @param envoy.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param envoy.containerSecurityContext.runAsUser Set envoy containers' Security Context runAsUser + ## @param envoy.containerSecurityContext.runAsGroup Set envoy containers' Security Context runAsGroup + ## @param envoy.containerSecurityContext.runAsNonRoot Set envoy containers' Security Context runAsNonRoot + ## @param envoy.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte + ## @param envoy.containerSecurityContext.privileged Set envoy container's Security Context privileged + ## @param envoy.containerSecurityContext.allowPrivilegeEscalation Set envoy container's Security Context allowPrivilegeEscalation + ## @param envoy.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param envoy.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: true + ## @param envoy.hostNetwork Envoy Pod host network access + ## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces + ## + hostNetwork: false + ## @param envoy.dnsPolicy Envoy Pod Dns Policy's DNS Policy + ## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy + ## + dnsPolicy: ClusterFirst + ## @param envoy.tlsExistingSecret Name of the existingSecret to be use in Envoy deployment + ## + tlsExistingSecret: "" + ## @param envoy.serviceAccount.create Specifies whether a ServiceAccount should be created + ## @param envoy.serviceAccount.name The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template + ## @param envoy.serviceAccount.automountServiceAccountToken Whether to auto mount API credentials for a service account + ## @param envoy.serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server + ## + serviceAccount: + create: true + name: "" + automountServiceAccountToken: false + annotations: {} + ## @param envoy.livenessProbe.enabled Enable livenessProbe + ## @param envoy.livenessProbe.port LivenessProbe port + ## @param envoy.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param envoy.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param envoy.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param envoy.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param envoy.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + port: 8002 + initialDelaySeconds: 120 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param envoy.readinessProbe.enabled Enable/disable the readiness probe + ## @param envoy.readinessProbe.port ReadinessProbe port + ## @param envoy.readinessProbe.initialDelaySeconds Delay before readiness probe is initiated + ## @param envoy.readinessProbe.periodSeconds How often to perform the probe + ## @param envoy.readinessProbe.timeoutSeconds When the probe times out + ## @param envoy.readinessProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param envoy.readinessProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + readinessProbe: + enabled: true + port: 8002 + initialDelaySeconds: 10 + periodSeconds: 3 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param envoy.startupProbe.enabled Enable/disable the startup probe + ## @param envoy.startupProbe.port StartupProbe port + ## @param envoy.startupProbe.initialDelaySeconds Delay before startup probe is initiated + ## @param envoy.startupProbe.periodSeconds How often to perform the probe + ## @param envoy.startupProbe.timeoutSeconds When the probe times out + ## @param envoy.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param envoy.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + startupProbe: + enabled: false + port: 8002 + initialDelaySeconds: 15 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + ## @param envoy.customLivenessProbe Override default liveness probe + ## + customLivenessProbe: {} + ## @param envoy.customReadinessProbe Override default readiness probe + ## + customReadinessProbe: {} + ## @param envoy.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + ## @param envoy.terminationGracePeriodSeconds Envoy termination grace period in seconds + ## + terminationGracePeriodSeconds: 300 + ## @param envoy.logLevel Envoy log level + ## + logLevel: info + ## Envoy Service properties + ## + service: + ## @param envoy.service.name envoy service name + ## + name: "" + ## The multi az feature renders multiple service, so you could attach different service provider loadbalancer to it. + ## This feature is primarily used to achieve a high availability with multiple loadbalancer + ## @param envoy.service.multiAz.enabled enables the rendering of the multiple services + ## @param envoy.service.multiAz.zones defines different zones their annotations and loadBalancerIPs + ## + multiAz: + enabled: false + zones: [] + ## Example + ## - name: "zone1" + ## loadBalancerIP: "1.2.3.4" + ## annotations: + ## service.beta.kubernetes.io/loadbalancer-zone: zone1 + ## - name: "zone2" + ## loadBalancerIP: "5.6.7.8" + ## annotations: + ## service.beta.kubernetes.io/loadbalancer-zone: zone2 + ## + ## @param envoy.service.targetPorts [object] Map the controller service HTTP/HTTPS port + ## + targetPorts: + http: http + https: https + metrics: metrics + ## @param envoy.service.type Type of Envoy service to create + ## + type: NodePort + ## @param envoy.service.externalTrafficPolicy Envoy Service external cluster policy. If `envoy.service.type` is NodePort or LoadBalancer + ## + externalTrafficPolicy: Local + ## @param envoy.service.labels Labels to add to te envoy service + ## + labels: {} + ## @param envoy.service.clusterIP Internal envoy cluster service IP + ## e.g.: + ## clusterIP: None + ## + clusterIP: "" + ## @param envoy.service.externalIPs [array] Envoy service external IP addresses + ## + externalIPs: [] + ## @param envoy.service.loadBalancerIP IP address to assign to load balancer (if supported) + ## + loadBalancerIP: "" + ## @param envoy.service.loadBalancerSourceRanges [array] List of IP CIDRs allowed access to load balancer (if supported) + ## + loadBalancerSourceRanges: [] + ## @param envoy.service.loadBalancerClass Envoy service Load Balancer Class + ## ref https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + ## + loadBalancerClass: "" + ## @param envoy.service.ipFamilyPolicy [string], support SingleStack, PreferDualStack and RequireDualStack + ## + ipFamilyPolicy: "" + ## @param envoy.service.ipFamilies [array] List of IP families (e.g. IPv4, IPv6) assigned to the service. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ## E.g. + ## ipFamilies: + ## - IPv6 + ## + ipFamilies: [] + ## @param envoy.service.annotations [object] Annotations for Envoy service + ## + annotations: {} + ports: + ## @param envoy.service.ports.http Sets service http port + ## + http: 80 + ## @param envoy.service.ports.https Sets service https port + ## + https: 443 + ## @param envoy.service.ports.metrics Sets service metrics port + ## + metrics: 8002 + ## Specify the nodePort(s) value(s) for the LoadBalancer and NodePort service types. + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## @param envoy.service.nodePorts.http HTTP Port. If `envoy.service.type` is NodePort and this is non-empty + ## @param envoy.service.nodePorts.https HTTPS Port. If `envoy.service.type` is NodePort and this is non-empty + ## + nodePorts: + http: "" + https: "" + ## @param envoy.service.extraPorts [array] Extra ports to expose (normally used with the `sidecar` value) + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#multi-port-services + ## + extraPorts: [] + ## @param envoy.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param envoy.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param envoy.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param envoy.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param envoy.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param envoy.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param envoy.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param envoy.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param envoy.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## @param envoy.useHostPort.http Enable/disable `hostPort` for TCP/80 + ## @param envoy.useHostPort.https Enable/disable `hostPort` TCP/443 + ## @param envoy.useHostPort.metrics Enable/disable `hostPort` for TCP/8002 + ## + useHostPort: + http: true + https: true + metrics: false + ## @param envoy.useHostIP Enable/disable `hostIP` + ## + useHostIP: false + ## @param envoy.hostPorts.http Sets `hostPort` http port + ## @param envoy.hostPorts.https Sets `hostPort` https port + ## @param envoy.hostPorts.metrics Sets `hostPort` metrics port + ## + hostPorts: + http: 80 + https: 443 + metrics: 8002 + ## @param envoy.hostIPs.http Sets `hostIP` http IP + ## @param envoy.hostIPs.https Sets `hostIP` https IP + ## @param envoy.hostIPs.metrics Sets `hostIP` metrics IP + ## + hostIPs: + http: 127.0.0.1 + https: 127.0.0.1 + metrics: 127.0.0.1 + ## Configures the ports the Envoy proxy listens on + ## @param envoy.containerPorts.http Sets http port inside Envoy pod (change this to >1024 to run envoy as a non-root user) + ## @param envoy.containerPorts.https Sets https port inside Envoy pod (change this to >1024 to run envoy as a non-root user) + ## @param envoy.containerPorts.metrics Sets metrics port inside Envoy pod (change this to >1024 to run envoy as a non-root user) + ## + containerPorts: + http: 8080 + https: 8443 + metrics: 8002 + ## @param envoy.initContainers [array] Attach additional init containers to Envoy pods + ## For example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## + initContainers: [] + ## @param envoy.sidecars Add additional sidecar containers to the Envoy pods + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param envoy.extraVolumes [array] Array to add extra volumes + ## + extraVolumes: [] + ## @param envoy.extraVolumeMounts [array] Array to add extra mounts (normally used with extraVolumes) + ## + extraVolumeMounts: [] + ## @param envoy.extraEnvVars [array] Array containing extra env vars to be added to all Envoy containers + ## For example: + ## extraEnvVars: + ## - name: MY_ENV_VAR + ## value: env_var_value + ## + extraEnvVars: [] + ## @param envoy.extraEnvVarsCM ConfigMap containing extra env vars to be added to all Envoy containers + ## + extraEnvVarsCM: "" + ## @param envoy.extraEnvVarsSecret Secret containing extra env vars to be added to all Envoy containers + ## + extraEnvVarsSecret: "" + ## PodDisruptionBudget for default backend + ## Envoy Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ + ## @param envoy.pdb.create Enable Pod Disruption Budget configuration + ## @param envoy.pdb.minAvailable Minimum number/percentage of Default backend pods that should remain scheduled + ## @param envoy.pdb.maxUnavailable Maximum number/percentage of Default backend pods that should remain scheduled + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" + +## @section Default backend parameters +## + +## Default 404 backend +## +defaultBackend: + ## @param defaultBackend.enabled Enable a default backend based on NGINX + ## + enabled: false + ## Bitnami NGINX image + ## ref: https://hub.docker.com/r/bitnami/nginx/tags/ + ## @param defaultBackend.image.registry [default: REGISTRY_NAME] Default backend image registry + ## @param defaultBackend.image.repository [default: REPOSITORY_NAME/nginx] Default backend image name + ## @skip defaultBackend.image.tag Default backend image tag + ## @param defaultBackend.image.digest Default backend image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param defaultBackend.image.pullPolicy Image pull policy + ## @param defaultBackend.image.pullSecrets [array] Specify docker-registry secret names as an array + ## + image: + registry: docker.io + repository: bitnami/nginx + tag: 1.27.0-debian-12-r6 + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param defaultBackend.extraArgs [object] Additional command line arguments to pass to NGINX container + ## + extraArgs: {} + ## @param defaultBackend.lifecycleHooks lifecycleHooks for the container to automate configuration before or after startup. + ## + lifecycleHooks: {} + ## @param defaultBackend.extraEnvVars [array] Array containing extra env vars to be added to all Contour containers + ## For example: + ## extraEnvVars: + ## - name: MY_ENV_VAR + ## value: env_var_value + ## + extraEnvVars: [] + ## @param defaultBackend.extraEnvVarsCM ConfigMap containing extra env vars to be added to all Contour containers + ## + extraEnvVarsCM: "" + ## @param defaultBackend.extraEnvVarsSecret Secret containing extra env vars to be added to all Contour containers + ## + extraEnvVarsSecret: "" + ## @param defaultBackend.extraVolumes [array] Array to add extra volumes + ## + extraVolumes: [] + ## @param defaultBackend.extraVolumeMounts [array] Array to add extra mounts (normally used with extraVolumes) + ## + extraVolumeMounts: [] + ## @param defaultBackend.initContainers [array] Attach additional init containers to the http backend pods + ## For example: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## + initContainers: [] + ## @param defaultBackend.sidecars [array] Add additional sidecar containers to the default backend + ## Example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## Configures the ports the http backend listens on + ## @param defaultBackend.containerPorts.http Set http port inside Contour pod + ## + containerPorts: + http: 8001 + ## @param defaultBackend.updateStrategy Strategy to use to update Pods + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: {} + ## @param defaultBackend.command Override default command + ## + command: [] + ## @param defaultBackend.args Override default args + ## + args: [] + ## @param defaultBackend.hostAliases [array] Add deployment host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param defaultBackend.replicaCount Desired number of default backend pods + ## + replicaCount: 1 + ## Default backend pods' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param defaultBackend.podSecurityContext.enabled Default backend Pod securityContext + ## @param defaultBackend.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param defaultBackend.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param defaultBackend.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param defaultBackend.podSecurityContext.fsGroup Set Default backend Pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Default backend containers' Security Context (only main container) + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param defaultBackend.containerSecurityContext.enabled Enabled defaultBackend containers' Security Context + ## @param defaultBackend.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container + ## @param defaultBackend.containerSecurityContext.runAsUser Set defaultBackend containers' Security Context runAsUser + ## @param defaultBackend.containerSecurityContext.runAsGroup Set defaultBackend containers' Security Context runAsGroup + ## @param defaultBackend.containerSecurityContext.runAsNonRoot Set defaultBackend containers' Security Context runAsNonRoot + ## @param defaultBackend.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte + ## @param defaultBackend.containerSecurityContext.privileged Set defaultBackend container's Security Context privileged + ## @param defaultBackend.containerSecurityContext.allowPrivilegeEscalation Set defaultBackend container's Security Context allowPrivilegeEscalation + ## @param defaultBackend.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param defaultBackend.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsGroup: 1001 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + readOnlyRootFilesystem: true + ## Default backend containers' resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## We usually recommend not to specify default resources and to leave this as a conscious + ## choice for the user. This also increases chances charts run on environments with little + ## resources, such as Minikube. + ## @param defaultBackend.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if defaultBackend.resources is set (defaultBackend.resources is recommended for production). + ## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + ## + resourcesPreset: "nano" + ## @param defaultBackend.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) + ## Example: + ## resources: + ## requests: + ## cpu: 2 + ## memory: 512Mi + ## limits: + ## cpu: 3 + ## memory: 1024Mi + ## + resources: {} + ## Default backend containers' liveness probe. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param defaultBackend.livenessProbe.enabled Enable livenessProbe + ## @param defaultBackend.livenessProbe.httpGet [object] Path, port and scheme for the livenessProbe + ## @param defaultBackend.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param defaultBackend.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param defaultBackend.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param defaultBackend.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param defaultBackend.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + ## Default backend containers' readiness probe. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## @param defaultBackend.readinessProbe.enabled Enable readinessProbe + ## @param defaultBackend.readinessProbe.httpGet [object] Path, port and scheme for the readinessProbe + ## @param defaultBackend.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param defaultBackend.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param defaultBackend.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param defaultBackend.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param defaultBackend.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + failureThreshold: 6 + initialDelaySeconds: 0 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + ## @param defaultBackend.startupProbe.enabled Enable/disable the startup probe + ## @param defaultBackend.startupProbe.initialDelaySeconds Delay before startup probe is initiated + ## @param defaultBackend.startupProbe.periodSeconds How often to perform the probe + ## @param defaultBackend.startupProbe.timeoutSeconds When the probe times out + ## @param defaultBackend.startupProbe.failureThreshold Minimum consecutive failures for the probe to be considered failed after having succeeded. + ## @param defaultBackend.startupProbe.successThreshold Minimum consecutive successes for the probe to be considered successful after having failed. + ## + startupProbe: + enabled: false + initialDelaySeconds: 15 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + ## @param defaultBackend.customLivenessProbe [object] Override default liveness probe, it overrides the default one (evaluated as a template) + ## + customLivenessProbe: {} + ## @param defaultBackend.customReadinessProbe [object] Override default readiness probe, it overrides the default one (evaluated as a template) + ## + customReadinessProbe: {} + ## @param defaultBackend.customStartupProbe Override default startup probe + ## + customStartupProbe: {} + ## @param defaultBackend.podLabels [object] Extra labels for Controller pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param defaultBackend.podAnnotations [object] Annotations for Controller pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param defaultBackend.priorityClassName Priority class assigned to the pods + ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + ## + priorityClassName: "" + ## @param defaultBackend.schedulerName Name of the k8s scheduler (other than default) + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param defaultBackend.terminationGracePeriodSeconds In seconds, time the given to the default backend pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: 60 + ## @param defaultBackend.topologySpreadConstraints Topology Spread Constraints for pod assignment + ## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## The value is evaluated as a template + ## + topologySpreadConstraints: [] + ## @param defaultBackend.podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## + podAffinityPreset: "" + ## @param defaultBackend.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## Allowed values: soft, hard + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## @param defaultBackend.nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## @param defaultBackend.nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set. + ## @param defaultBackend.nodeAffinityPreset.values [array] Node label values to match. Ignored if `affinity` is set. + ## + nodeAffinityPreset: + type: "" + key: "" + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param defaultBackend.affinity [object] Affinity for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: defaultBackend.podAffinityPreset, defaultBackend.podAntiAffinityPreset, and defaultBackend.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param defaultBackend.nodeSelector [object] Node labels for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param defaultBackend.tolerations [array] Tolerations for pod assignment. Evaluated as a template. + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## Default backend Service parameters + ## @param defaultBackend.service.type Service type + ## @param defaultBackend.service.ports.http Service port + ## @param defaultBackend.service.annotations Annotations to add to the service + ## + service: + type: ClusterIP + ports: + http: 80 + annotations: {} + ## Network Policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param defaultBackend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: true + ## @param defaultBackend.networkPolicy.allowExternal Don't require server label for connections + ## The Policy model to apply. When set to false, only pods with the correct + ## server label will have network access to the ports server is listening + ## on. When true, server will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param defaultBackend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. + ## + allowExternalEgress: true + ## @param defaultBackend.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + extraIngress: [] + ## @param defaultBackend.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param defaultBackend.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces + ## @param defaultBackend.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} + ## PodDisruptionBudget for default backend + ## Default backend Pod Disruption Budget configuration + ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ + ## @param defaultBackend.pdb.create Enable Pod Disruption Budget configuration + ## @param defaultBackend.pdb.minAvailable Minimum number/percentage of Default backend pods that should remain scheduled + ## @param defaultBackend.pdb.maxUnavailable Maximum number/percentage of Default backend pods that should remain scheduled + ## + pdb: + create: true + minAvailable: "" + maxUnavailable: "" +## Ingress parameters +## +ingress: + ## @param ingress.enabled Ingress configuration enabled + ## Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/ + ## + ## Enable Ingress. + ## + enabled: false + ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.certManager Add annotations for cert-manager + ## + certManager: false + ## @param ingress.annotations Annotations to be added to the web ingress. + ## Example: + ## kubernetes.io/ingress.class: nginx + ## kubernetes.io/tls-acme: 'true' + ## + annotations: {} + ## Either `hosts` or `rulesOverride` must be provided if Ingress is enabled. + ## `hosts` sets up the Ingress with default rules per provided hostname. + ## @param ingress.hostname Hostname for the Ingress object + ## + hostname: contour.local + ## @param ingress.path The Path to Concourse + ## + path: / + ## @param ingress.rulesOverride Ingress rules override + ## Either `hosts` or `rulesOverride` must be provided if Ingress is enabled. + ## `rulesOverride` allows the user to define the full set of ingress rules, for more complex Ingress setups. + ## + rulesOverride: [] + ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) + ## + ingressClassName: "" + ## @param ingress.extraPaths Add additional arbitrary paths that may need to be added to the ingress under the main host. + ## For example: The ALB ingress controller requires a special rule for handling SSL redirection. + ## + extraPaths: [] + ## @param ingress.tls TLS configuration. + ## Secrets must be manually created in the namespace. + ## Example: + ## - secretName: concourse-web-tls + ## hosts: + ## - concourse.domain.com + ## + tls: false + ## @param ingress.pathType Ingress Path type + ## + pathType: ImplementationSpecific + ## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record. + ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array + ## extraHosts: + ## - name: concourse.local + ## path: / + ## + extraHosts: [] + ## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record. + ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## extraTls: + ## - hosts: + ## - concourse.local + ## secretName: concourse.local-tls + ## + extraTls: [] + ## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## Example: + ## - name: concourse.local-tls + ## key: + ## certificate: + ## + secrets: [] + ## @param ingress.extraRules Additional rules to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules + ## e.g: + ## extraRules: + ## - host: example.local + ## http: + ## path: / + ## backend: + ## service: + ## name: example-svc + ## port: + ## name: http + ## + extraRules: [] +## @section Metrics parameters +## +metrics: + ## Prometheus Operator service monitors + ## + serviceMonitor: + ## @param metrics.serviceMonitor.namespace Specify if the servicemonitors will be deployed into a different namespace (blank deploys into same namespace as chart) + ## + namespace: "" + ## @param metrics.serviceMonitor.enabled Specify if a servicemonitor will be deployed for prometheus-operator. + ## + enabled: false + ## @param metrics.serviceMonitor.jobLabel Specify the jobLabel to use for the prometheus-operator + ## + jobLabel: "app.kubernetes.io/name" + ## @param metrics.serviceMonitor.interval Specify the scrape interval if not specified use default prometheus scrapeIntervall, the Prometheus default scrape interval is used. + ## + interval: "" + ## @param metrics.serviceMonitor.metricRelabelings [array] Specify additional relabeling of metrics. + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.relabelings [array] Specify general relabeling. + ## + relabelings: [] + ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint + ## + honorLabels: false + ## @param metrics.serviceMonitor.scrapeTimeout The timeout after which the scrape is ended + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.selector Specify honorLabels parameter to add the scrape endpoint + ## + selector: {} + ## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor + ## + labels: {} + ## Prometheus Operator prometheusRules + ## + prometheusRule: + ## @param metrics.prometheusRule.enabled Creates a Prometheus Operator prometheusRule + ## + enabled: false + ## @param metrics.prometheusRule.namespace Namespace for the prometheusRule Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so prometheusRule will be discovered by Prometheus + ## + additionalLabels: {} + ## @param metrics.prometheusRule.rules Prometheus Rule definitions + ## + rules: [] +## @section Other parameters +## + +## @param rbac.create Create the RBAC roles for API accessibility +## +rbac: + create: true + ## @param rbac.rules [array] Custom RBAC rules to set + ## e.g: + ## rules: + ## - apiGroups: + ## - "" + ## resources: + ## - pods + ## verbs: + ## - get + ## - list + ## + rules: [] +## @param tlsExistingSecret Name of the existingSecret to be use in both contour and envoy. If it is not nil `contour.certgen` will be disabled. +## +tlsExistingSecret: "" diff --git a/internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl b/internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl deleted file mode 100644 index e69de29..0000000 diff --git a/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl b/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl deleted file mode 100644 index 97afbcc..0000000 --- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl +++ /dev/null @@ -1,24 +0,0 @@ -services: - - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }} - path: {{ .Modules.Cicd.ArgoCd.Expose.Path }} - address: argo-cd-argocd-server - port: 80 - secretName: argo-cd-server-tls - -ingress: - accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }} - class: {{ .Modules.Additional.Ingress.Type }} - annotations: - {{- if eq .Modules.Additional.Ingress.Type "nginx" }} - nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" - nginx.ingress.kubernetes.io/proxy-buffers: "4 256k" - nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k" - nginx.ingress.kubernetes.io/proxy-body-size: "0" - {{- end }} - tls: - enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }} - useCertManager: true - - # used if "useCertManager" is false - crt: "" - key: "" diff --git a/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl b/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl deleted file mode 100644 index e27a9b0..0000000 --- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl +++ /dev/null @@ -1,170 +0,0 @@ -crds: - install: true - -global: - repository: {{ .Modules.Cicd.ArgoCd.Global.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }} - -server: - image: - repository: {{ .Modules.Cicd.ArgoCd.Server.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }} - certificateSecret: - enabled: false - {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }} - service: - type: "NodePort" - nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }} - nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }} - {{- end }} - {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }} - {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }} - autoscaling: - enabled: true - minReplicas: 2 - {{- else }} - replicas: 2 - {{- end }} - {{- end }} - - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -redis: - image: - repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }} - exporter: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - image: - repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }} - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -controller: - image: - repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }} - replicas: 1 - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -applicationSet: - image: - repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }} - tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }} - {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }} - replicas: 2 - {{- end }} - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -dex: - image: - repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }} - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - ## check later - serviceMonitor: - enabled: false - -repoServer: - image: - repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }} - tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }} - {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }} - {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }} - autoscaling: - enabled: true - minReplicas: 2 - {{- else }} - replicas: 2 - {{- end }} - {{- end }} - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -notifications: - image: - repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }} - tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }} - metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -configs: - params: - server.insecure: true - {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }} - server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}' - {{- end }} - - secret: - argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }} - - repositories: - # add default helm-repository from harbor - {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }} - - cm: - create: true - url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}" - - accounts.developer: login - accounts.guest: login - - # oidc.config: "" - - rbac: - create: true - policy.csv: | - p, role:admin, applications, create, */*, allow - p, role:admin, applications, update, */*, allow - p, role:admin, applications, delete, */*, allow - p, role:admin, applications, sync, */*, allow - p, role:admin, applications, override, */*, allow - p, role:admin, applications, action/*, */*, allow - p, role:admin, applicationsets, get, */*, allow - p, role:admin, applicationsets, create, */*, allow - p, role:admin, applicationsets, update, */*, allow - p, role:admin, applicationsets, delete, */*, allow - p, role:admin, certificates, create, *, allow - p, role:admin, certificates, update, *, allow - p, role:admin, certificates, delete, *, allow - p, role:admin, clusters, create, *, allow - p, role:admin, clusters, update, *, allow - p, role:admin, clusters, delete, *, allow - p, role:admin, repositories, create, *, allow - p, role:admin, repositories, update, *, allow - p, role:admin, repositories, delete, *, allow - p, role:admin, projects, create, *, allow - p, role:admin, projects, update, *, allow - p, role:admin, projects, delete, *, allow - p, role:admin, accounts, update, *, allow - p, role:admin, gpgkeys, create, *, allow - p, role:admin, gpgkeys, delete, *, allow - p, role:admin, exec, create, */*, allow - - {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }} - - - policy.default: role:'' - # scopes: "[roles,email,groups]" - -{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }} -redis-ha: - enabled: true -{{- end }} diff --git a/internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl b/internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl deleted file mode 100644 index 0639374..0000000 --- a/internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl +++ /dev/null @@ -1,424 +0,0 @@ -installCRDs: true -keepCRDs: false -clusterInstall: true -createClusterAggregateRoles: true - -apiVersionOverrides: - # -- String to override apiVersion of ingresses rendered by this helm chart - ingress: "" # networking.k8s.io/v1beta1 - -# -- Override the Kubernetes version, which is used to evaluate certain manifests -kubeVersionOverride: "" - -# -- Additional manifests to deploy within the chart. A list of objects. -## Can be used to add secrets for Analysis with 3rd-party monitoring solutions. -extraObjects: [] - # - apiVersion: v1 - # kind: Secret - # metadata: - # name: datadog - # type: Opaque - # data: - # address: https://api.datadoghq.com - # api-key: - # app-key: - -global: - # -- Annotations for all deployed Deployments - deploymentAnnotations: {} - -controller: - # -- Value of label `app.kubernetes.io/component` - component: rollouts-controller - # -- Annotations to be added to the controller deployment - deploymentAnnotations: {} - # -- Annotations to be added to application controller pods - podAnnotations: {} - # -- [Node selector] - nodeSelector: {} - # -- [Tolerations] for use with node taints - tolerations: [] - # -- Assign custom [affinity] rules to the deployment - affinity: {} - logging: - # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`) - level: info - # -- Set the klog logging level - kloglevel: "0" - # -- Set the logging format (one of: `text`, `json`) - format: "text" - - # -- Assign custom [TopologySpreadConstraints] rules to the controller - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment - topologySpreadConstraints: [] - # - maxSkew: 1 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: DoNotSchedule - - # -- [priorityClassName] for the controller - priorityClassName: "" - # -- The number of controller pods to run - {{- if .Modules.Cicd.Rollouts.Ha.Enabled }} - replicas: 3 - {{- else }} - replicas: 1 - {{- end }} - image: - # -- Registry to use - registry: {{ .Modules.Cicd.Rollouts.Registry }} - # -- Repository to use - repository: {{ .Modules.Cicd.Rollouts.Repository }} - # -- Overrides the image tag (default is the chart appVersion) - tag: {{ .Modules.Cicd.Rollouts.Tag }} - # -- Image pull policy - pullPolicy: IfNotPresent - - # -- flag to enable creation of cluster controller role (requires cluster RBAC) - createClusterRole: true - - # Controller container ports - containerPorts: - # -- Metrics container port - metrics: 8090 - # -- Healthz container port - healthz: 8080 - {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - metrics: - # -- Deploy metrics service - enabled: true - service: - # -- Metrics service port name - portName: metrics - # -- Metrics service port - port: 8090 - # -- Service annotations - annotations: {} - serviceMonitor: - # -- Enable a prometheus ServiceMonitor - enabled: true - # -- Namespace to be used for the ServiceMonitor - namespace: "" - # -- Labels to be added to the ServiceMonitor - additionalLabels: {} - # -- Annotations to be added to the ServiceMonitor - additionalAnnotations: {} - # -- RelabelConfigs to apply to samples before scraping - relabelings: [] - # -- MetricRelabelConfigs to apply to samples before ingestion - metricRelabelings: [] - {{- end }} - - # -- Configure liveness [probe] for the controller - # @default -- See [values.yaml] - livenessProbe: - httpGet: - path: /healthz - port: healthz - initialDelaySeconds: 30 - periodSeconds: 20 - failureThreshold: 3 - successThreshold: 1 - timeoutSeconds: 10 - - # -- Configure readiness [probe] for the controller - # @default -- See [values.yaml] - readinessProbe: - httpGet: - path: /metrics - port: metrics - initialDelaySeconds: 15 - periodSeconds: 5 - failureThreshold: 3 - successThreshold: 1 - timeoutSeconds: 4 - - ## Configure Pod Disruption Budget for the controller - pdb: - # -- Labels to be added to controller [Pod Disruption Budget] - labels: {} - # -- Annotations to be added to controller [Pod Disruption Budget] - annotations: {} - # -- Deploy a [Pod Disruption Budget] for the controller - enabled: false - # -- Minimum number / percentage of pods that should remain scheduled - minAvailable: # 1 - # -- Maximum number / percentage of pods that may be made unavailable - maxUnavailable: # 0 - - # -- Additional volumes to add to the controller pod - volumes: [] - # - configMap: - # name: my-certs-cm - # name: my-certs - - # -- Additional volumeMounts to add to the controller container - volumeMounts: [] - # - mountPath: /etc/ssl/certs - # name: my-certs - - # -- Configures 3rd party metric providers for controller - ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/ - metricProviderPlugins: {} - # metricProviderPlugins: |- - # - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration - # location: "file://./my-custom-plugin" # supports http(s):// urls and file:// - - # -- Configures 3rd party traffic router plugins for controller - ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/ - trafficRouterPlugins: {} - # trafficRouterPlugins: |- - # - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration - # location: "file://./my-custom-plugin" # supports http(s):// urls and file:// - -serviceAccount: - # -- Specifies whether a service account should be created - create: true - # -- Annotations to add to the service account - annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - -# -- Annotations to be added to all CRDs -crdAnnotations: {} - -# -- Annotations for the all deployed pods -podAnnotations: {} - -# -- Security Context to set on pod level -podSecurityContext: - runAsNonRoot: true - -# -- Security Context to set on container level -containerSecurityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - -# -- Annotations to be added to the Rollout service -serviceAnnotations: {} - -# -- Labels to be added to the Rollout pods -podLabels: {} - -# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array. -imagePullSecrets: [] -# - name: argo-pull-secret - -providerRBAC: - # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole - enabled: true - # providerRBAC.enabled must be true in order to toggle the individual providers - providers: - # -- Adds RBAC rules for the Istio provider - istio: true - # -- Adds RBAC rules for the SMI provider - smi: true - # -- Adds RBAC rules for the Ambassador provider - ambassador: true - # -- Adds RBAC rules for the AWS Load Balancer Controller provider - awsLoadBalancerController: true - # -- Adds RBAC rules for the AWS App Mesh provider - awsAppMesh: true - # -- Adds RBAC rules for the Traefik provider - traefik: true - # -- Adds RBAC rules for the Apisix provider - apisix: true - # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md` - contour: true - # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md` - glooPlatform: true - # -- Additional RBAC rules for others providers - additionalRules: [] - -dashboard: - # -- Deploy dashboard server - enabled: true - # -- Set cluster role to readonly - readonly: false - # -- Value of label `app.kubernetes.io/component` - component: rollouts-dashboard - # -- Annotations to be added to the dashboard deployment - deploymentAnnotations: {} - # -- Annotations to be added to application dashboard pods - podAnnotations: {} - # -- [Node selector] - nodeSelector: {} - # -- [Tolerations] for use with node taints - tolerations: [] - # -- Assign custom [affinity] rules to the deployment - affinity: {} - logging: - # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`) - level: info - # -- Set the klog logging level - kloglevel: "0" - - # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment - topologySpreadConstraints: [] - # - maxSkew: 1 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: DoNotSchedule - - # -- [priorityClassName] for the dashboard server - priorityClassName: "" - - # -- flag to enable creation of dashbord cluster role (requires cluster RBAC) - createClusterRole: true - - # -- The number of dashboard pods to run - {{- if .Modules.Cicd.Rollouts.Ha.Enabled }} - replicas: 3 - {{- else }} - replicas: 1 - {{- end }} - image: - # -- Registry to use - registry: quay.io - # -- Repository to use - repository: argoproj/kubectl-argo-rollouts - # -- Overrides the image tag (default is the chart appVersion) - tag: "" - # -- Image pull policy - pullPolicy: IfNotPresent - # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags. - extraArgs: [] - # -- Additional environment variables for rollouts-dashboard. A list of name/value maps. - extraEnv: [] - # - name: FOO - # value: bar - # -- Resource limits and requests for the dashboard pods. - resources: {} - # -- Security Context to set on pod level - podSecurityContext: - runAsNonRoot: true - # -- Security Context to set on container level - containerSecurityContext: {} - service: - # -- Sets the type of the Service - {{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }} - type: NodePort - nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }} - {{- else }} - type: ClusterIP - nodePort: - {{- end }} - # -- LoadBalancer will get created with the IP specified in this field - loadBalancerIP: "" - # -- Source IP ranges to allow access to service from - loadBalancerSourceRanges: [] - # -- Dashboard service external IPs - externalIPs: [] - # -- Service annotations - annotations: {} - # -- Service labels - labels: {} - # -- Service port name - portName: dashboard - # -- Service port - port: 3100 - # -- Service target port - targetPort: 3100 - # -- (int) Service nodePort - - serviceAccount: - # -- Specifies whether a dashboard service account should be created - create: true - # -- Annotations to add to the dashboard service account - annotations: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - - ## Configure Pod Disruption Budget for the dashboard - pdb: - # -- Labels to be added to dashboard [Pod Disruption Budget] - labels: {} - # -- Annotations to be added to dashboard [Pod Disruption Budget] - annotations: {} - # -- Deploy a [Pod Disruption Budget] for the dashboard - enabled: false - # -- Minimum number / percentage of pods that should remain scheduled - minAvailable: # 1 - # -- Maximum number / percentage of pods that may be made unavailable - maxUnavailable: # 0 - - ## Ingress configuration. - ## ref: https://kubernetes.io/docs/user-guide/ingress/ - ## - ingress: - # -- Enable dashboard ingress support - enabled: false - # -- Dashboard ingress annotations - annotations: {} - # -- Dashboard ingress labels - labels: {} - # -- Dashboard ingress class name - ingressClassName: "" - - # -- Dashboard ingress hosts - ## Argo Rollouts Dashboard Ingress. - ## Hostnames must be provided if Ingress is enabled. - ## Secrets must be manually created in the namespace - hosts: [] - # - argorollouts.example.com - - # -- Dashboard ingress paths - paths: - - / - # -- Dashboard ingress path type - pathType: Prefix - # -- Dashboard ingress extra paths - extraPaths: [] - # - path: /* - # backend: - # serviceName: ssl-redirect - # servicePort: use-annotation - ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used) - # - path: /* - # pathType: Prefix - # backend: - # service - # name: ssl-redirect - # port: - # name: use-annotation - - # -- Dashboard ingress tls - tls: [] - # - secretName: argorollouts-example-tls - # hosts: - # - argorollouts.example.com - - # -- Additional volumes to add to the dashboard pod - volumes: [] - - # -- Additional volumeMounts to add to the dashboard container - volumeMounts: [] - -notifications: - secret: - # -- Whether to create notifications secret - create: false - # -- Generic key:value pairs to be inserted into the notifications secret - items: {} - # slack-token: - - # -- Configures notification services - notifiers: {} - # service.slack: | - # token: $slack-token - - # -- Notification templates - templates: {} - - # -- The trigger defines the condition when the notification should be sent - triggers: {} - # trigger.on-purple: | - # - send: [my-purple-template] - # when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple' diff --git a/internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl b/internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl deleted file mode 100644 index ce4cad1..0000000 --- a/internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl +++ /dev/null @@ -1,245 +0,0 @@ -image: - repository: {{ .Modules.Cicd.UpdatesOperator.Image }} - tag: {{ .Modules.Cicd.UpdatesOperator.Tag }} - pullPolicy: Always - -# Enable insecure registries -insecureRegistry: false - -# Polling is enabled by default, -# you can disable it setting value below to false -polling: - enabled: true - defaultSchedule: "@every 1m" - -# Extra Containers to run alongside Keel -# extraContainers: -# - name: busybox -# image: busybox -# imagePullPolicy: IfNotPresent -# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600'] - -# Helm provider support -helmProvider: - enabled: true - # set to version "v3" for Helm v3 - version: "v2" - tillerNamespace: "kube-system" - # optional Tiller address (if portforwarder tunnel doesn't work), - # if you are using default configuration, setting it to - # 'tiller-deploy:44134' is usually fine - tillerAddress: 'tiller-deploy:44134' -# helmDriver: '' -# helmDriverSqlConnectionString: '' - -# Google Container Registry -# GCP Project ID -gcr: - enabled: false - projectId: "" - gcpServiceAccount: "" - clusterName: "" - pubSub: - enabled: false - -# Notification level (debug, info, success, warn, error, fatal) -notificationLevel: info - -# AWS Elastic Container Registry -# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR -ecr: - enabled: false - roleArn: "" - accessKeyId: "" - secretAccessKey: "" - region: "" - -# Webhook Notification -# Remote webhook endpoint for notification delivery -webhook: - enabled: false - endpoint: "" - -# Slack Notification -# bot name (default keel) must exist! -slack: - enabled: false - botName: "" - token: "" - channel: "" - approvalsChannel: "" - -# Hipchat notification and approvals -hipchat: - enabled: false - token: "" - channel: "" - approvalsChannel: "" - botName: "" - userName: "" - password: "" - -# Mattermost notifications -mattermost: - enabled: false - endpoint: "" - -# MS Teams notifications -teams: - enabled: false - webhookUrl: "" - -# Discord notifications -discord: - enabled: false - webhookUrl: "" - -# Mail notifications -mail: - enabled: false - from: "" - to: "" - smtp: - server: "" - port: 25 - user: "" - pass: "" - -# Basic auth on approvals -basicauth: - enabled: true - user: "admin" - password: "{{ .Modules.AdminPassword }}" - -# Keel service -# Enable to receive webhooks from Docker registries -service: - enabled: false - type: LoadBalancer - externalPort: 9300 - clusterIP: "" - -# Webhook Relay service -# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/ -# which can deliver webhooks to your internal Keel service through Keel sidecar container. -webhookRelay: - enabled: false - bucket: "" - # webhookrelay.com credentials - # Set the key and secret values here to create the keel-webhookrelay secret with this - # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately. - key: "" - secret: "" - # webhookrelay docker image - image: - repository: webhookrelay/webhookrelayd - tag: latest - pullPolicy: IfNotPresent - -# Use a secret file to define passwords and tokens of third parties. -secret: - # Leave blank to use `keel.fullname` - name: "" - # Set to false to manage your own secret file, with terraform for example. - create: true - -# Keel self-update -# uncomment lines below if you want Keel to automaticly -# self-update to the latest release version -# keel: -# # keel policy (all/major/minor/patch/force) -# policy: patch -# # trigger type, defaults to events such as pubsub, webhooks -# trigger: poll -# # polling schedule -# pollSchedule: "@every 3m" -# # images to track and update -# images: -# - repository: image.repository -# tag: image.tag - -# RBAC manifests management -rbac: - enabled: true - serviceAccount: - # Kubernetes service account name to be used for ClusterRoleBinding and Deployment. - # name: - # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account. - # If rbac.serviceAccount.name is not set, a new name for the service account is generated - create: true - -# Resources -resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 50m - memory: 64Mi - -# NodeSelector -nodeSelector: {} - -affinity: {} - -tolerations: {} - -# base64 encoded json of GCP service account -# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform -# e.g. --set googleApplicationCredentials=$(cat | base64) -googleApplicationCredentials: "" - -# Enable DEBUG logging -debug: false - -# This is used by the static manifest generator in order to create a static -# namespace manifest for the namespace that keel is being installed -# within. It should **not** be used if you are using Helm for deployment. -createNamespaceResource: false - -podAnnotations: {} - -serviceAnnotations: {} -# Useful for making the load balancer internal -# serviceAnnotations: -# cloud.google.com/load-balancer-type: Internal - -aws: - region: null - -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - minAvailable: null - -# Google Cloud Certificates -gcloud: - managedCertificates: - enabled: false - domains: - - "" - -ingress: - enabled: false - labels: {} - annotations: {} -# kubernetes.io/ingress.class: nginx -# kubernetes.io/tls-acme: "true" - hosts: [] -# - host: chart-example.local -# paths: -# - / - tls: [] -# - secretName: chart-example-tls -# hosts: -# - chart-example.local - -dockerRegistry: - enabled: false - name: "" - key: "" - -persistence: - enabled: false - storageClass: "-" - size: 1Gi diff --git a/internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl deleted file mode 100644 index d857a57..0000000 --- a/internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl +++ /dev/null @@ -1,55 +0,0 @@ -# Set this to containerd or crio if you want to collect CRI format logs -containerRuntime: {{ .Orchestrator.ContainerEngine.Type }} -Kubernetes: false - -operator: - initcontainer: - repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}" - tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}" - - resources: - limits: - cpu: 100m - memory: 100Mi - - requests: - cpu: 50m - memory: 64Mi - container: - repository: "{{ .Modules.Observability.Logging.Operator.Image }}" - tag: "{{ .Modules.Observability.Logging.Operator.Tag }}" - resources: - limits: - cpu: 100m - memory: 100Mi - requests: - cpu: 100m - memory: 60Mi - imagePullSecrets: [] - labels: {} - logPath: - # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below. - # crio: /var/log - containerd: /var/log - disableComponentControllers: "" - -fluentbit: - crdsEnable: true - enable: false - -fluentd: - crdsEnable: true - enable: false - name: fluentd - # Valid modes include "collector" and "agent". - # The "collector" mode will deploy Fluentd as a StatefulSet as before. - # The new "agent" mode will deploy Fluentd as a DaemonSet. - mode: "agent" - port: 24224 - image: - repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}" - tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}" - -nameOverride: "" -fullnameOverride: "" -namespaceOverride: "" diff --git a/internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl deleted file mode 100644 index b84b95d..0000000 --- a/internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl +++ /dev/null @@ -1,188 +0,0 @@ -loki: - image: - registry: {{ .Modules.Observability.Logging.Loki.Registry }} - repository: {{ .Modules.Observability.Logging.Loki.Image }} - tag: {{ .Modules.Observability.Logging.Loki.Tag }} - podAnnotations: - app.kubernetes.io/component: "loki" - auth_enabled: false - commonConfig: - replication_factor: 1 - storage: - type: 'filesystem' - - frontend: - max_outstanding_per_tenant: 10000 - - limits_config: - reject_old_samples: false - split_queries_by_interval: 15m - max_query_parallelism: 32 - max_query_series: 10000 - retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }} - - compactor: - compaction_interval: 10m - retention_enabled: true - retention_delete_delay: 2h - - querier: - max_concurrent: 2048 - - query_scheduler: - max_outstanding_requests_per_tenant: 10000 - - rulerConfig: - storage: - type: local - local: - directory: /var/loki/rules - rule_path: /tmp/rules - - alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }} - - -singleBinary: - replicas: 1 - - extraVolumes: - - name: loki-default-rules - configMap: - name: loki-default-alerting-rules - - extraVolumeMounts: - - name: loki-default-rules - mountPath: /var/loki/rules - - -write: - persistence: - volumeClaimsEnabled: true - storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}" - size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }} - -test: - enabled: false - -gateway: - enabled: false - -monitoring: - selfMonitoring: - enabled: false - grafanaAgent: - installOperator: false - lokiCanary: - enabled: false - rules: - enabled: true - alerting: true - -extraObjects: - - apiVersion: v1 - kind: ConfigMap - metadata: - name: loki-default-alerting-rules - labels: - loki_rule: "" - - data: - loki-default-alerting-rules.yaml: |- - groups: - {{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}} - - name: kube-events-alerts - rules: - - alert: FailedEventsOccured - expr: | - count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0 - for: 1m - labels: - severity: critical - annotations: - alertname: FailedEventsOccured - instance: kube-cluster - jobName: kube_events - summary: Failed events occured in cluster - addDefaultUrl: "true" - - - alert: OOMKilledEventsOccured - expr: | - count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0 - for: 1m - labels: - severity: critical - annotations: - alertname: OOMKilledEventsOccured - instance: kube-cluster - jobName: kube_events - summary: OOMKilled events occured in cluster - addDefaultUrl: "true" - - - alert: EvictedEventsOccured - expr: | - count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0 - for: 1m - labels: - severity: critical - annotations: - alertname: EvictedEventsOccured - instance: kube-cluster - jobName: kube_events - summary: Evicted events occured in cluster - addDefaultUrl: "true" - - - alert: ImagePullBackOffEventsOccured - expr: | - count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0 - for: 1m - labels: - severity: critical - annotations: - alertname: ImagePullBackOffEventsOccured - instance: kube-cluster - jobName: kube_events - summary: ImagePullBackOff events occured in cluster - addDefaultUrl: "true" - - - alert: BackOffEventsOccured - expr: | - count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0 - for: 1m - labels: - severity: critical - annotations: - alertname: BackOffEventsOccured - instance: kube-cluster - jobName: kube_events - summary: BackOff events occured in cluster - addDefaultUrl: "true" -sidecar: - rules: - enabled: true - # -- Label that the configmaps/secrets with rules will be marked with. - label: loki_rule - # -- Label value that the configmaps/secrets with rules will be set to. - labelValue: "" - # -- Folder into which the rules will be placed. - folder: /var/loki/rules - # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces. - # Otherwise the namespace in which the sidecar is running will be used. - # It's also possible to specify 'ALL' to search in all namespaces. - searchNamespace: 'ALL' - # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds. - watchMethod: WATCH - # -- Search in configmap, secret, or both. - resource: both - # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded. - script: null - # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that. - # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S. - watchServerTimeout: 60 - # - # -- WatchClientTimeout: is a client-side timeout, configuring your local socket. - # If you have a network outage dropping all packets with no RST/FIN, - # this is how long your client waits before realizing & dropping the connection. - # Defaults to 66sec. - watchClientTimeout: 60 - # -- Log level of the sidecar container. - logLevel: INFO diff --git a/internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl deleted file mode 100644 index 8a25833..0000000 --- a/internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl +++ /dev/null @@ -1,192 +0,0 @@ -image: - repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }} - tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}" - pullPolicy: IfNotPresent - -imagePullSecrets: [] -# - name: registrySecretName - -nameOverride: "" -fullnameOverride: "" - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - # The list of secrets mountable by this service account. - # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets - secrets: [] - -rbac: - # Specifies whether RBAC resources should be created - create: true - pspEnabled: false - -apiService: - create: true - # Annotations to add to the API service - annotations: {} - # Specifies whether to skip TLS verification - insecureSkipTLSVerify: true - # The PEM encoded CA bundle for TLS verification - caBundle: "" - -commonLabels: {} -podLabels: - "app.kubernetes.io/component": "metrics-server" -podAnnotations: {} - -podSecurityContext: {} - -securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - -priorityClassName: system-cluster-critical - -containerPort: 10250 - -hostNetwork: - # Specifies if metrics-server should be started in hostNetwork mode. - # - # You would require this enabled if you use alternate overlay networking for pods and - # API server unable to communicate with metrics-server. As an example, this is required - # if you use Weave network on EKS - enabled: false - -replicas: 1 - -revisionHistoryLimit: - -updateStrategy: {} -# type: RollingUpdate -# rollingUpdate: -# maxSurge: 0 -# maxUnavailable: 1 - -podDisruptionBudget: - # https://kubernetes.io/docs/tasks/run-application/configure-pdb/ - enabled: false - minAvailable: - maxUnavailable: - -defaultArgs: - - --cert-dir=/tmp - - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname - - --kubelet-use-node-status-port - - --metric-resolution=15s - - --kubelet-insecure-tls - -args: [] - -livenessProbe: - httpGet: - path: /livez - port: https - scheme: HTTPS - initialDelaySeconds: 0 - periodSeconds: 10 - failureThreshold: 3 - -readinessProbe: - httpGet: - path: /readyz - port: https - scheme: HTTPS - initialDelaySeconds: 20 - periodSeconds: 10 - failureThreshold: 3 - -service: - type: ClusterIP - port: 443 - annotations: {} - labels: {} - # Add these labels to have metrics-server show up in `kubectl cluster-info` - # kubernetes.io/cluster-service: "true" - # kubernetes.io/name: "Metrics-server" - -addonResizer: - enabled: false - image: - repository: registry.k8s.io/autoscaling/addon-resizer - tag: 1.8.20 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - resources: - requests: - cpu: 40m - memory: 25Mi - limits: - cpu: 40m - memory: 25Mi - nanny: - cpu: 0m - extraCpu: 1m - memory: 0Mi - extraMemory: 2Mi - minClusterSize: 100 - pollPeriod: 300000 - threshold: 5 - -metrics: - enabled: true - -serviceMonitor: - enabled: true - additionalLabels: {} - interval: 1m - scrapeTimeout: 10s - metricRelabelings: [] - relabelings: [] - -# See https://github.com/kubernetes-sigs/metrics-server#scaling -resources: - requests: - cpu: 100m - memory: 200Mi - # limits: - # cpu: - # memory: - -extraVolumeMounts: [] - -extraVolumes: [] - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -topologySpreadConstraints: [] - -dnsConfig: {} - -# Annotations to add to the deployment -deploymentAnnotations: {} - -schedulerName: "" - -tmpVolume: - emptyDir: {} - diff --git a/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl deleted file mode 100644 index aeee731..0000000 --- a/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl +++ /dev/null @@ -1,391 +0,0 @@ -prometheus: - enabled: {{ .Modules.Observability.Monitoring.Enabled }} - serviceMonitor: true - image: - repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }} - tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }} - pullPolicy: IfNotPresent - - clustering: - enabled: false - replicas: 3 - shards: 1 - - persistence: - enabled: true - - storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}" - storageResources: - requests: - storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }} - - scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }} - retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }} - # serviceNodePort: 30008 - - additionalConfigs: | - - job_name: "kubelet" - scheme: https - metrics_path: /metrics/cadvisor - tls_config: - insecure_skip_verify: true - authorization: - credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token - kubernetes_sd_configs: - - role: node - relabel_configs: - - action: labelmap - regex: __meta_kubernetes_node_label_(.+) - - - job_name: "kubernetes-apiservers" - kubernetes_sd_configs: - - role: endpoints - scheme: https - tls_config: - ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - authorization: - credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token - relabel_configs: - - source_labels: - [ - __meta_kubernetes_namespace, - __meta_kubernetes_service_name, - __meta_kubernetes_endpoint_port_name, - ] - action: keep - regex: default;kubernetes;https - - - job_name: "coredns" - kubernetes_sd_configs: - - role: endpoints - scheme: http - relabel_configs: - - source_labels: - [ - __meta_kubernetes_namespace, - __meta_kubernetes_service_name, - __meta_kubernetes_endpoint_port_name, - ] - action: keep - regex: kube-system;.*dns.*;metrics - - {{- if .Modules.Observability.Monitoring.Blackbox.Enabled }} - - job_name: 'ingress-endpoints' - metrics_path: /probe - params: - module: [https_ok] - kubernetes_sd_configs: - - role: ingress - relabel_configs: - - source_labels: [__address__] - target_label: __param_target - - source_labels: [__param_target] - target_label: instance - - source_labels: - [ - __meta_kubernetes_ingress_scheme, - __address__, - __meta_kubernetes_ingress_path, - ] - regex: (.+);(.+);(.+) - replacement: https://${2}${3}/ - target_label: __param_target - - target_label: __address__ - replacement: observability-blackbox-exporter:9115 - {{- end }} - -alertManager: - enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }} - serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} - enableDefaultRules: true - image: - repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }} - tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}" - pullPolicy: IfNotPresent - - # serviceNodePort: 30009 - - configPath: /etc/alertmanager - {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }} - additionalMessageTemplates: - {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }} - {{- end }} - {{- if .Modules.Observability.Monitoring.AlertManager.Route }} - route: - {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }} - {{- end }} - {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }} - receivers: - {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }} - {{- end }} - -blackboxExporter: - enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }} - serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} - image: - repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }} - tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}" - pullPolicy: IfNotPresent - - # serviceNodePort: 30012 - - configPath: /etc/blackbox_exporter - additionalModules: - - -kubeStateMetrics: - enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }} - image: - repository: {{ .Modules.Observability.Monitoring.KubeState.Image }} - tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}" - pullPolicy: IfNotPresent - resources: - requests: - cpu: 30m - memory: 120Mi - limits: - memory: 240Mi - cpu: 60m - -prometheusOperator: - enabled: {{ .Modules.Observability.Monitoring.Enabled }} - image: - repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }} - tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }} - pullPolicy: IfNotPresent - - prometheusConfigReloader: - image: - repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }} - tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }} - pullPolicy: IfNotPresent - - kubeRbacProxy: - image: - repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }} - tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }} - pullPolicy: IfNotPresent - -nodeExporter: - enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }} - image: - repository: {{ .Modules.Observability.Monitoring.Node.Image }} - tag: {{ .Modules.Observability.Monitoring.Node.Tag }} - pullPolicy: IfNotPresent - -kubeEventsExporter: - enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }} - image: - repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }} - tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }} - pullPolicy: IfNotPresent - lokiAddress: http://loki.observability.svc.cluster.local:3100 - logLevel: warn - logFormat: json - kubeQPS: 100 - kubeBurst: 500 - maxEventAgeSeconds: 120 - metricsNamePrefix: event_exporter_ - - cron: - restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}" - image: - repository: {{ .Modules.Observability.Logging.Events.Cron.Image }} - tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }} - pullPolicy: IfNotPresent - additionalRoutes: - additionalReceivers: - -grafana: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }} - serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} - domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }} - path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }} - {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }} - serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }} - {{- end }} - image: - repository: {{ .Modules.Observability.Visualization.Grafana.Image }} - tag: {{ .Modules.Observability.Visualization.Grafana.Tag }} - pullPolicy: IfNotPresent - - storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}" - storageResources: - requests: - storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }} - - config: - server: | - enable_gzip = true - root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }} - {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }} - serve_from_sub_path = true - {{- end }} - - security: | - admin_user = admin - admin_password = {{ .Modules.AdminPassword }} - - auth: | - {{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }} - - authGenericAuth: | - {{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }} - - additionalDatasources: - {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }} - - name: Kube-loki - type: loki - uid: P2895588539814C92 - access: proxy - url: http://loki:3100 - editable: false - basicAuth: false - isDefault: false - jsonData: - maxLines: 1000 - {{- end }} - {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }} - - name: Kube-jaeger-query - type: jaeger - access: proxy - url: http://tempo:16686 - editable: false - basicAuth: false - isDefault: false - {{- end }} - {{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }} - {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }} - {{- end }} - -opentelemetryCollector: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }} - serviceMonitor: true - config: | - receivers: - otlp: - protocols: - grpc: - http: - exporters: - otlphttp: - endpoint: http://tempo:4318 - service: - telemetry: - logs: - level: "debug" - pipelines: - traces: - receivers: [otlp] - exporters: [otlphttp] - -ingress: - {{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }} - enabled: true - {{- else }} - enabled: false - {{- end }} - accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }} - class: {{ .Modules.Additional.Ingress.Type }} - annotations: - {{- if eq .Modules.Additional.Ingress.Type "nginx" }} - nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" - nginx.ingress.kubernetes.io/proxy-buffers: "4 256k" - nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k" - {{- end }} - tls: - {{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }} - enabled: true - {{- end }} - hosts: - - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }} - secretName: grafana-tls - -containerRuntime: {{ .Orchestrator.ContainerEngine.Type }} - -fluentbit: - enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }} - serviceMonitor: true - image: - repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}" - tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}" - - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: node-role.kubernetes.io/edge - operator: DoesNotExist - tolerations: - - operator: Exists - - input: - tail: - enable: true - refreshIntervalSeconds: 10 - memBufLimit: 100MB - bufferMaxSize: "" - path: "/var/log/containers/*.log" - skipLongLines: true - readFromHead: false - storageType: memory - pauseOnChunksOverlimit: "off" - systemd: - enable: true - systemdFilter: - enable: true - filters: [] - path: "/var/log/journal" - includeKubelet: true - stripUnderscores: "off" - storageType: memory - pauseOnChunksOverlimit: "off" - - nodeExporterMetrics: {} - fluentBitMetrics: {} - - output: - es: - enable: false - host: "" - port: 9200 - logstashPrefix: ks-logstash-log - bufferSize: 20MB - traceError: true - kafka: - enable: false - brokers: "" - topics: ks-log - opentelemetry: {} - opensearch: - enable: false - stdout: - enable: false - loki: - enable: true - host: loki - port: 3100 - - stackdriver: {} - - service: - storage: {} - - filter: - kubernetes: - enable: true - labels: true - annotations: true - containerd: - enable: true - systemd: - enable: true - - kubeedge: - enable: false - prometheusRemoteWrite: - # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data - host: "" - # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data - port: "" diff --git a/internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl deleted file mode 100644 index 3d2aafc..0000000 --- a/internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl +++ /dev/null @@ -1,134 +0,0 @@ -replicaCount: 1 -nameOverride: "" -imagePullSecrets: [] -pdb: - create: false - minAvailable: 1 - maxUnavailable: "" - -manager: - image: - repository: {{ .Modules.Observability.Tracing.Operator.Image }} - tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}" - collectorImage: - repository: {{ .Modules.Observability.Tracing.Collector.Image }} - tag: {{ .Modules.Observability.Tracing.Collector.Tag }} - - featureGates: "" - ports: - metricsPort: 8080 - webhookPort: 9443 - healthzPort: 8081 - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 100m - memory: 64Mi - env: - ENABLE_WEBHOOKS: "true" - - serviceAccount: - create: true - annotations: {} - - serviceMonitor: - enabled: true - metricsEndpoints: - - port: metrics - - prometheusRule: - enabled: true - groups: [] - defaultRules: - enabled: true - - extraArgs: [] - - leaderElection: - enabled: true - - verticalPodAutoscaler: - enabled: false - controlledResources: [] - maxAllowed: {} - minAllowed: {} - - updatePolicy: - updateMode: Auto - minReplicas: 2 - rolling: false - - securityContext: {} - -kubeRBACProxy: - enabled: true - image: - repository: quay.io/brancz/kube-rbac-proxy - tag: v0.15.0 - ports: - proxyPort: 8443 - resources: - limits: - cpu: 500m - memory: 128Mi - requests: - cpu: 5m - memory: 64Mi - - extraArgs: [] - - securityContext: {} - -admissionWebhooks: - create: true - servicePort: 443 - failurePolicy: Fail - secretName: "" - pods: - failurePolicy: Ignore - - namePrefix: "" - - timeoutSeconds: 10 - - namespaceSelector: {} - objectSelector: {} - certManager: - enabled: true - issuerRef: {} - certificateAnnotations: {} - issuerAnnotations: {} - - autoGenerateCert: - enabled: true - recreate: true - - secretAnnotations: {} - secretLabels: {} - -role: - create: true - -clusterRole: - create: true - -affinity: {} -tolerations: [] -nodeSelector: {} -topologySpreadConstraints: [] -hostNetwork: false - -priorityClassName: "" - -securityContext: - runAsGroup: 65532 - runAsNonRoot: true - runAsUser: 65532 - fsGroup: 65532 - -testFramework: - image: - repository: busybox - tag: latest diff --git a/internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl deleted file mode 100644 index 83c0246..0000000 --- a/internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl +++ /dev/null @@ -1,68 +0,0 @@ -replicas: 1 - -tempo: - repository: {{ .Modules.Observability.Tracing.Tempo.Image }} - tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}" - pullPolicy: IfNotPresent - - updateStrategy: RollingUpdate - - memBallastSizeMbs: 1024 - multitenancyEnabled: false - reportingEnabled: false - - metricsGenerator: - enabled: false - remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write" - retention: {{ .Modules.Observability.Tracing.Tempo.Retention }} - global_overrides: - per_tenant_override_config: /conf/overrides.yaml - - server: - http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }} - storage: - trace: - backend: local - local: - path: /var/tempo/traces - wal: - path: /var/tempo/wal - receivers: - otlp: - protocols: - grpc: - endpoint: "0.0.0.0:4317" - http: - endpoint: "0.0.0.0:4318" - -tempoQuery: - repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }} - tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }} - pullPolicy: IfNotPresent - - enabled: true - - service: - port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }} - - ingress: - enabled: false - -serviceAccount: - create: true - automountServiceAccountToken: true - -service: - type: ClusterIP - -serviceMonitor: - enabled: true - -persistence: - enabled: true - storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }} - accessModes: - - ReadWriteOnce - size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }} - -priorityClassName: null diff --git a/internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl b/internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl deleted file mode 100644 index 9e96cf7..0000000 --- a/internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl +++ /dev/null @@ -1,6 +0,0 @@ -issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }} -solver_ingress_class: {{ .Modules.Additional.Ingress.Type }} - -certificates: - - name: harbor-tls - domain: {{ .Modules.Registry.Expose.Domain }} diff --git a/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl b/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl deleted file mode 100644 index d8fc678..0000000 --- a/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl +++ /dev/null @@ -1,371 +0,0 @@ -expose: - type: {{ .Modules.Registry.Expose.Type }} - tls: - enabled: {{ .Modules.Registry.Tls.Enabled }} - certSource: secret - secret: - secretName: harbor-tls - ingress: - hosts: - core: {{ .Modules.Registry.Expose.Domain }} - controller: default - kubeVersionOverride: "" - className: "{{ .Modules.Additional.Ingress.Type }}" - annotations: - ingress.kubernetes.io/ssl-redirect: "true" - ingress.kubernetes.io/proxy-body-size: "0" - {{- if eq .Modules.Additional.Ingress.Type "nginx" }} - nginx.ingress.kubernetes.io/ssl-redirect: "true" - nginx.ingress.kubernetes.io/proxy-body-size: "0" - {{- end }} - labels: {} - - nodePort: - name: harbor - ports: - http: - port: 80 - nodePort: {{ .Modules.Registry.Expose.NodePortHttp }} - https: - port: 443 - nodePort: {{ .Modules.Registry.Expose.NodePortHttps }} - -externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }} -persistence: - resourcePolicy: "keep" - persistentVolumeClaim: - registry: - existingClaim: "" - storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}" - subPath: "" - accessMode: ReadWriteOnce - size: {{ .Modules.Registry.Persistence.RegistrySize }} - annotations: {} - jobservice: - jobLog: - existingClaim: "" - storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}" - subPath: "" - accessMode: ReadWriteOnce - size: {{ .Modules.Registry.Persistence.JobserviceSize }} - annotations: {} - database: - existingClaim: "" - storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}" - subPath: "" - accessMode: ReadWriteOnce - size: {{ .Modules.Registry.Persistence.DatabaseSize }} - annotations: {} - redis: - existingClaim: "" - storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}" - subPath: "" - accessMode: ReadWriteOnce - size: {{ .Modules.Registry.Persistence.RedisSize }} - annotations: {} - trivy: - existingClaim: "" - storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}" - subPath: "" - accessMode: ReadWriteOnce - size: {{ .Modules.Registry.Persistence.TrivySize }} - annotations: {} - - imageChartStorage: - disableredirect: false - - type: filesystem - filesystem: - rootdirectory: /storage - #maxthreads: 100 - -imagePullPolicy: IfNotPresent - -updateStrategy: - type: RollingUpdate - -harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}" - -logLevel: info - -metrics: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - core: - path: /metrics - port: 8001 - registry: - path: /metrics - port: 8001 - jobservice: - path: /metrics - port: 8001 - exporter: - path: /metrics - port: 8001 - - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - -trace: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }} - provider: otel - sample_rate: 1 - attributes: - application: harbor - jaeger: - endpoint: http://hostname:14268/api/traces - otel: - endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318 - url_path: /v1/traces - compression: false - insecure: true - timeout: 10 - -portal: - image: - repository: {{ .Modules.Registry.Portal.Image }} - tag: {{ .Modules.Registry.Portal.Tag }} - serviceAccountName: "" - automountServiceAccountToken: false - replicas: 1 - revisionHistoryLimit: 10 - - topologySpreadConstraints: [] - - podLabels: - "app.kubernetes.io/component": "harbor-portal" - priorityClassName: - -core: - image: - repository: {{ .Modules.Registry.Core.Image }} - tag: {{ .Modules.Registry.Portal.Tag }} - serviceAccountName: "" - automountServiceAccountToken: false - replicas: 1 - revisionHistoryLimit: 10 - startupProbe: - enabled: true - initialDelaySeconds: 10 - extraEnvVars: [] - nodeSelector: {} - tolerations: [] - affinity: {} - topologySpreadConstraints: [] - podLabels: - "app.kubernetes.io/component": "harbor-core" - serviceAnnotations: {} - priorityClassName: - configureUserSettings: - quotaUpdateProvider: db # Or redis - secret: "" - existingSecret: "" - secretName: "" - tokenKey: "" - - tokenCert: "" - - xsrfKey: "" - existingXsrfSecret: "" - existingXsrfSecretKey: CSRF_KEY - artifactPullAsyncFlushDuration: - gdpr: - deleteUser: false - auditLogsCompliant: false - - -jobservice: - image: - repository: {{ .Modules.Registry.Jobservice.Image }} - tag: {{ .Modules.Registry.Jobservice.Tag }} - serviceAccountName: "" - automountServiceAccountToken: false - replicas: 1 - revisionHistoryLimit: 10 - topologySpreadConstraints: - podLabels: - "app.kubernetes.io/component": "harbor-jobservice" - priorityClassName: - maxJobWorkers: 10 - jobLoggers: - - file - # - database - # - stdout - loggerSweeperDuration: 14 #days - notification: - webhook_job_max_retry: 3 - webhook_job_http_client_timeout: 3 # in seconds - reaper: - max_update_hours: 24 - max_dangling_hours: 168 - secret: "" - existingSecret: "" - existingSecretKey: JOBSERVICE_SECRET - -registry: - registry: - image: - repository: {{ .Modules.Registry.Registry.Registry.Image }} - tag: {{ .Modules.Registry.Registry.Registry.Tag }} - extraEnvVars: [] - controller: - image: - repository: {{ .Modules.Registry.Registry.Controller.Image }} - tag: {{ .Modules.Registry.Registry.Controller.Tag }} - extraEnvVars: [] - serviceAccountName: "" - automountServiceAccountToken: false - replicas: 1 - revisionHistoryLimit: 10 - topologySpreadConstraints: [] - podLabels: - "app.kubernetes.io/component": "harbor-registry" - priorityClassName: - secret: "" - existingSecret: "" - existingSecretKey: REGISTRY_HTTP_SECRET - relativeurls: false - credentials: - # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD - existingSecret: "" - # Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt. - # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string - # htpasswdString: "" - middleware: - enabled: false - type: cloudFront - cloudFront: - baseurl: example.cloudfront.net - keypairid: KEYPAIRID - duration: 3000s - ipfilteredby: none - # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key - # that allows access to CloudFront - privateKeySecret: "my-secret" - # enable purge _upload directories - upload_purging: - enabled: true - # remove files in _upload directories which exist for a period of time, default is one week. - age: 168h - # the interval of the purge operations - interval: 24h - dryrun: false - -trivy: - enabled: {{ .Modules.Registry.EnabledScanner }} - image: - repository: {{ .Modules.Registry.Trivy.Image }} - tag: {{ .Modules.Registry.Trivy.Tag }} - serviceAccountName: "" - automountServiceAccountToken: false - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - cpu: 1 - memory: 1Gi - - -database: - # if external database is used, set "type" to "external" - # and fill the connection information in "external" section - type: internal - internal: - image: - repository: {{ .Modules.Registry.Database.Image }} - tag: {{ .Modules.Registry.Database.Tag }} - serviceAccountName: "" - automountServiceAccountToken: false - livenessProbe: - timeoutSeconds: 1 - readinessProbe: - timeoutSeconds: 1 - priorityClassName: - # The initial superuser password for internal database - # password: "changeit" - # The size limit for Shared memory, pgSQL use it for shared_buffer - # More details see: - # https://github.com/goharbor/harbor/issues/15034 - shmSizeLimit: 512Mi - initContainer: - migrator: {} - # resources: - # requests: - # memory: 128Mi - # cpu: 100m - permissions: {} - # resources: - # requests: - # memory: 128Mi - # cpu: 100m - external: - host: "192.168.0.1" - port: "5432" - username: "user" - password: "password" - coreDatabase: "registry" - # if using existing secret, the key must be "password" - existingSecret: "" - # "disable" - No SSL - # "require" - Always SSL (skip verification) - # "verify-ca" - Always SSL (verify that the certificate presented by the - # server was signed by a trusted CA) - # "verify-full" - Always SSL (verify that the certification presented by the - # server was signed by a trusted CA and the server host name matches the one - # in the certificate) - sslmode: "disable" - # The maximum number of connections in the idle connection pool per pod (core+exporter). - # If it <=0, no idle connections are retained. - maxIdleConns: 100 - # The maximum number of open connections to the database per pod (core+exporter). - # If it <= 0, then there is no limit on the number of open connections. - # Note: the default number of connections is 1024 for postgre of harbor. - maxOpenConns: 900 - ## Additional deployment annotations - podAnnotations: {} - ## Additional deployment labels - podLabels: {} - - -redis: - type: internal - internal: - image: - repository: {{ .Modules.Registry.Redis.Image }} - tag: {{ .Modules.Registry.Redis.Tag }} - serviceAccountName: "" - automountServiceAccountToken: false - extraEnvVars: [] - nodeSelector: {} - tolerations: [] - affinity: {} - priorityClassName: - jobserviceDatabaseIndex: "1" - registryDatabaseIndex: "2" - trivyAdapterIndex: "5" - # harborDatabaseIndex: "6" - # cacheLayerDatabaseIndex: "7" - external: - # support redis, redis+sentinel - # addr for redis: : - # addr for redis+sentinel: :,:,: - addr: "192.168.0.2:6379" - # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel - sentinelMasterSet: "" - # The "coreDatabaseIndex" must be "0" as the library Harbor - # used doesn't support configuring it - # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional - # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional - coreDatabaseIndex: "0" - jobserviceDatabaseIndex: "1" - registryDatabaseIndex: "2" - trivyAdapterIndex: "5" - # harborDatabaseIndex: "6" - # cacheLayerDatabaseIndex: "7" - # username field can be an empty string, and it will be authenticated against the default user - username: "" - password: "" - existingSecret: "" - podAnnotations: {} - podLabels: {} diff --git a/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl b/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl deleted file mode 100644 index 543fcb7..0000000 --- a/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl +++ /dev/null @@ -1,873 +0,0 @@ -global: - enabled: true - - imagePullSecrets: [] - tlsDisable: true - - externalVaultAddr: "" - - openshift: false - - # Create PodSecurityPolicy for pods - psp: - enable: false - # Annotation for PodSecurityPolicy. - # This is a multi-line templated string map, and can also be set as YAML. - annotations: | - seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default - apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default - seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default - apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default - - serverTelemetry: - # Enable integration with the Prometheus Operator - # See the top level serverTelemetry section below before enabling this feature. - prometheusOperator: false - -injector: - enabled: true - - replicas: 1 - - # Configures the port the injector should listen on - port: 8080 - - # If multiple replicas are specified, by default a leader will be determined - # so that only one injector attempts to create TLS certificates. - leaderElector: - enabled: true - - # If true, will enable a node exporter metrics endpoint at /metrics. - metrics: - enabled: false - - # Deprecated: Please use global.externalVaultAddr instead. - externalVaultAddr: "" - - # image sets the repo and tag of the vault-k8s image to use for the injector. - image: - repository: "{{ .Modules.SecretsStorage.Injector.Image }}" - tag: "{{ .Modules.SecretsStorage.Injector.Tag }}" - pullPolicy: IfNotPresent - - # agentImage sets the repo and tag of the Vault image to use for the Vault Agent - # containers. This should be set to the official Vault image. Vault 1.3.1+ is - # required. - agentImage: - repository: "{{ .Modules.SecretsStorage.Agent.Image }}" - tag: "{{ .Modules.SecretsStorage.Agent.Tag }}" - agentDefaults: - cpuLimit: "500m" - cpuRequest: "250m" - memLimit: "128Mi" - memRequest: "64Mi" - # ephemeralLimit: "128Mi" - # ephemeralRequest: "64Mi" - - # Default template type for secrets when no custom template is specified. - # Possible values include: "json" and "map". - template: "map" - - # Default values within Agent's template_config stanza. - templateConfig: - exitOnRetryFailure: true - staticSecretRenderInterval: "" - - # Used to define custom livenessProbe settings - livenessProbe: - # When a probe fails, Kubernetes will try failureThreshold times before giving up - failureThreshold: 2 - # Number of seconds after the container has started before probe initiates - initialDelaySeconds: 5 - # How often (in seconds) to perform the probe - periodSeconds: 2 - # Minimum consecutive successes for the probe to be considered successful after having failed - successThreshold: 1 - # Number of seconds after which the probe times out. - timeoutSeconds: 5 - # Used to define custom readinessProbe settings - readinessProbe: - # When a probe fails, Kubernetes will try failureThreshold times before giving up - failureThreshold: 2 - # Number of seconds after the container has started before probe initiates - initialDelaySeconds: 5 - # How often (in seconds) to perform the probe - periodSeconds: 2 - # Minimum consecutive successes for the probe to be considered successful after having failed - successThreshold: 1 - # Number of seconds after which the probe times out. - timeoutSeconds: 5 - # Used to define custom startupProbe settings - startupProbe: - # When a probe fails, Kubernetes will try failureThreshold times before giving up - failureThreshold: 12 - # Number of seconds after the container has started before probe initiates - initialDelaySeconds: 5 - # How often (in seconds) to perform the probe - periodSeconds: 5 - # Minimum consecutive successes for the probe to be considered successful after having failed - successThreshold: 1 - # Number of seconds after which the probe times out. - timeoutSeconds: 5 - - # Mount Path of the Vault Kubernetes Auth Method. - authPath: "auth/kubernetes" - - # Configures the log verbosity of the injector. - # Supported log levels include: trace, debug, info, warn, error - logLevel: "info" - - # Configures the log format of the injector. Supported log formats: "standard", "json". - logFormat: "standard" - - # Configures all Vault Agent sidecars to revoke their token when shutting down - revokeOnShutdown: false - - webhook: - # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the - # API Tag of the WebHook. - # To block pod creation while the webhook is unavailable, set the policy to `Fail` below. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy - # - failurePolicy: Ignore - - # matchPolicy specifies the approach to accepting changes based on the rules of - # the MutatingWebhookConfiguration. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy - # for more details. - # - matchPolicy: Exact - - # timeoutSeconds is the amount of seconds before the webhook request will be ignored - # or fails. - # If it is ignored or fails depends on the failurePolicy - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts - # for more details. - # - timeoutSeconds: 30 - - # namespaceSelector is the selector for restricting the webhook to only - # specific namespaces. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector - # for more details. - # Example: - # namespaceSelector: - # matchLabels: - # sidecar-injector: enabled - namespaceSelector: {} - - # objectSelector is the selector for restricting the webhook to only - # specific labels. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector - # for more details. - # Example: - # objectSelector: - # matchLabels: - # vault-sidecar-injector: enabled - - # Extra annotations to attach to the webhook - annotations: {} - - # Deprecated: please use 'webhook.failurePolicy' instead - # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the - # API Tag of the WebHook. - # To block pod creation while webhook is unavailable, set the policy to `Fail` below. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy - # - failurePolicy: Ignore - - # Deprecated: please use 'webhook.namespaceSelector' instead - # namespaceSelector is the selector for restricting the webhook to only - # specific namespaces. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector - # for more details. - # Example: - # namespaceSelector: - # matchLabels: - # sidecar-injector: enabled - namespaceSelector: {} - - # Deprecated: please use 'webhook.objectSelector' instead - # objectSelector is the selector for restricting the webhook to only - # specific labels. - # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector - # for more details. - # Example: - # objectSelector: - # matchLabels: - # vault-sidecar-injector: enabled - objectSelector: {} - - # Deprecated: please use 'webhook.annotations' instead - # Extra annotations to attach to the webhook - webhookAnnotations: {} - - certs: - # secretName is the name of the secret that has the TLS certificate and - # private key to serve the injector webhook. If this is null, then the - # injector will default to its automatic management mode that will assign - # a service account to the injector to generate its own certificates. - secretName: null - - # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA - # that signed the TLS certificate that the webhook serves. This must be set - # if secretName is non-null unless an external service like cert-manager is - # keeping the caBundle updated. - caBundle: "" - - # certName and keyName are the names of the files within the secret for - # the TLS cert and private key, respectively. These have reasonable - # defaults but can be customized if necessary. - certName: tls.crt - keyName: tls.key - - securityContext: - pod: {} - container: {} - - resources: {} - - # extraEnvironmentVars is a list of extra environment variables to set in the - # injector deployment. - extraEnvironmentVars: {} - # KUBERNETES_SERVICE_HOST: kubernetes.default.svc - - topologySpreadConstraints: [] - - tolerations: [] - - nodeSelector: {} - - priorityClassName: "" - - annotations: {} - - extraLabels: {} - - hostNetwork: false - - - service: - # Extra annotations to attach to the injector service - annotations: {} - - # Injector serviceAccount specific config - serviceAccount: - # Extra annotations to attach to the injector serviceAccount - annotations: {} - - # A disruption budget limits the number of pods of a replicated application - # that are down simultaneously from voluntary disruptions - podDisruptionBudget: {} - # podDisruptionBudget: - # maxUnavailable: 1 - - # strategy for updating the deployment. This can be a multi-line string or a - # YAML map. - strategy: {} - # strategy: | - # rollingUpdate: - # maxSurge: 25% - # maxUnavailable: 25% - # type: RollingUpdate - -server: - enabled: true - enterpriseLicense: - # The name of the Kubernetes secret that holds the enterprise license. The - # secret must be in the same namespace that Vault is installed into. - secretName: "" - # The key within the Kubernetes secret that holds the enterprise license. - secretKey: "license" - - image: - repository: "{{ .Modules.SecretsStorage.Server.Image }}" - tag: "{{ .Modules.SecretsStorage.Server.Tag }}" - # Overrides the default Image Pull Policy - pullPolicy: IfNotPresent - - updateStrategyType: "RollingUpdate" - - # Supported log levels include: trace, debug, info, warn, error - logLevel: "" - - # Supported log formats include: standard, json - logFormat: "" - - resources: {} - - hostAliases: [] - # - ip: 127.0.0.1 - # hostnames: - # - chart-example.local - - route: - enabled: false - - # When HA mode is enabled and K8s service registration is being used, - # configure the route to point to the Vault active service. - activeService: true - - labels: {} - annotations: {} - host: chart-example.local - # tls will be passed directly to the route's TLS config, which - # can be used to configure other termination methods that terminate - # TLS at the router - tls: - termination: passthrough - - # authDelegator enables a cluster role binding to be attached to the service - # account. This cluster role binding can be used to setup Kubernetes auth - # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes - authDelegator: - enabled: true - - extraInitContainers: null - extraContainers: null - shareProcessNamespace: false - extraArgs: "" - - extraPorts: null - # - containerPort: 8300 - # name: http-monitoring - - readinessProbe: - enabled: false - # If you need to use a http path instead of the default exec - # path: /v1/sys/health?standbyok=true - - # Port number on which readinessProbe will be checked. - port: 8200 - # When a probe fails, Kubernetes will try failureThreshold times before giving up - failureThreshold: 2 - # Number of seconds after the container has started before probe initiates - initialDelaySeconds: 5 - # How often (in seconds) to perform the probe - periodSeconds: 5 - # Minimum consecutive successes for the probe to be considered successful after having failed - successThreshold: 1 - # Number of seconds after which the probe times out. - timeoutSeconds: 3 - # Used to enable a livenessProbe for the pods - livenessProbe: - enabled: false - # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler. - execCommand: [] - # - /bin/sh - # - -c - # - /vault/userconfig/mylivenessscript/run.sh - # Path for the livenessProbe to use httpGet as the livenessProbe handler - path: "/v1/sys/health?standbyok=true" - # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler - port: 8200 - # When a probe fails, Kubernetes will try failureThreshold times before giving up - failureThreshold: 2 - # Number of seconds after the container has started before probe initiates - initialDelaySeconds: 60 - # How often (in seconds) to perform the probe - periodSeconds: 5 - # Minimum consecutive successes for the probe to be considered successful after having failed - successThreshold: 1 - # Number of seconds after which the probe times out. - timeoutSeconds: 3 - - terminationGracePeriodSeconds: 10 - - # Used to set the sleep time during the preStop step - preStopSleepSeconds: 5 - - extraEnvironmentVars: {} - - extraSecretEnvironmentVars: [] - - extraVolumes: [] - - volumes: null - - volumeMounts: null - - topologySpreadConstraints: [] - - tolerations: [] - nodeSelector: {} - - # Enables network policy for server pods - networkPolicy: - enabled: false - egress: [] - # egress: - # - to: - # - ipBlock: - # cidr: 10.0.0.0/24 - # ports: - # - protocol: TCP - # port: 443 - ingress: - - from: - - namespaceSelector: {} - ports: - - port: 8200 - protocol: TCP - - port: 8201 - protocol: TCP - - priorityClassName: "" - extraLabels: {} - - annotations: {} - - service: - enabled: true - # Enable or disable the vault-active service, which selects Vault pods that - # have labeled themselves as the cluster leader with `vault-active: "true"`. - active: - enabled: true - # Extra annotations for the service definition. This can either be YAML or a - # YAML-formatted multi-line templated string map of the annotations to apply - # to the active service. - annotations: {} - # Enable or disable the vault-standby service, which selects Vault pods that - # have labeled themselves as a cluster follower with `vault-active: "false"`. - standby: - enabled: true - # Extra annotations for the service definition. This can either be YAML or a - # YAML-formatted multi-line templated string map of the annotations to apply - # to the standby service. - annotations: {} - # When disabled, services may select Vault pods not deployed from the chart. - # Does not affect the headless vault-internal service with `ClusterIP: None` - instanceSelector: - enabled: true - # clusterIP controls whether a Cluster IP address is attached to the - # Vault service within Kubernetes. By default, the Vault service will - # be given a Cluster IP address, set to None to disable. When disabled - # Kubernetes will create a "headless" service. Headless services can be - # used to communicate with pods directly through DNS instead of a round-robin - # load balancer. - # clusterIP: None - - # Configures the service type for the main Vault service. Can be ClusterIP - # or NodePort. - #type: ClusterIP - - # The IP family and IP families options are to set the behaviour in a dual-stack environment. - # Omitting these values will let the service fall back to whatever the CNI dictates the defaults - # should be. - # These are only supported for kubernetes versions >=1.23.0 - # - # Configures the service's supported IP family policy, can be either: - # SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range. - # PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service. - # RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges. - ipFamilyPolicy: "" - - # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. - # Can be IPv4 and/or IPv6. - ipFamilies: [] - - # Do not wait for pods to be ready before including them in the services' - # targets. Does not apply to the headless service, which is used for - # cluster-internal communication. - publishNotReadyAddresses: true - - # The externalTrafficPolicy can be set to either Cluster or Local - # and is only valid for LoadBalancer and NodePort service types. - # The default value is Cluster. - # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy - externalTrafficPolicy: Cluster - - # If type is set to "NodePort", a specific nodePort value can be configured, - # will be random if left blank. - #nodePort: 30000 - - # When HA mode is enabled - # If type is set to "NodePort", a specific nodePort value can be configured, - # will be random if left blank. - #activeNodePort: 30001 - - # When HA mode is enabled - # If type is set to "NodePort", a specific nodePort value can be configured, - # will be random if left blank. - #standbyNodePort: 30002 - - # Port on which Vault server is listening - port: 8200 - # Target port to which the service should be mapped to - targetPort: 8200 - # Extra annotations for the service definition. This can either be YAML or a - # YAML-formatted multi-line templated string map of the annotations to apply - # to the service. - annotations: {} - - dataStorage: - enabled: true - size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }} - mountPath: "/vault/data" - storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }} - accessMode: ReadWriteOnce - annotations: {} - labels: {} - - persistentVolumeClaimRetentionPolicy: {} - - # required for ha installation - auditStorage: - enabled: false - # Size of the PVC created - size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }} - # Location where the PVC will be mounted. - mountPath: "/vault/audit" - # Name of the storage class to use. If null it will use the - # configured default Storage Class. - storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }} - # Access Mode of the storage device being used for the PVC - accessMode: ReadWriteOnce - # Annotations to apply to the PVC - annotations: {} - # Labels to apply to the PVC - labels: {} - - dev: - enabled: false - - # Set VAULT_DEV_ROOT_TOKEN_ID value - devRootToken: "root" - - # Run Vault in "standalone" mode. This is the default mode that will deploy if - # no arguments are given to helm. This requires a PVC for data storage to use - # the "file" backend. This mode is not highly available and should not be scaled - # past a single replica. - standalone: - enabled: "-" - - # config is a raw string of default configuration when using a Stateful - # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data - # and store data there. This is only used when using a Replica count of 1, and - # using a stateful set. This should be HCL. - - # Note: Configuration files are stored in ConfigMaps so sensitive data - # such as passwords should be either mounted through extraSecretEnvironmentVars - # or through a Kube secret. For more information see: - # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations - config: | - ui = true - - listener "tcp" { - tls_disable = 1 - address = "[::]:8200" - cluster_address = "[::]:8201" - - {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - telemetry { - unauthenticated_metrics_access = "true" - } - {{- end }} - } - storage "file" { - path = "/vault/data" - } - - {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - telemetry { - prometheus_retention_time = "30s" - disable_hostname = true - } - {{- end }} - - # Run Vault in "HA" mode. There are no storage requirements unless the audit log - # persistence is required. In HA mode Vault will configure itself to use Consul - # for its storage backend. The default configuration provided will work the Consul - # Helm project by default. It is possible to manually configure Vault to use a - # different HA backend. - ha: - enabled: false - replicas: 3 - - # Set the api_addr configuration for Vault HA - # See https://developer.hashicorp.com/vault/docs/configuration#api_addr - # If set to null, this will be set to the Pod IP Address - apiAddr: null - - # Set the cluster_addr confuguration for Vault HA - # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr - clusterAddr: null - - # Enables Vault's integrated Raft storage. Unlike the typical HA modes where - # Vault's persistence is external (such as Consul), enabling Raft mode will create - # persistent volumes for Vault to store data according to the configuration under server.dataStorage. - # The Vault cluster will coordinate leader elections and failovers internally. - raft: - # Enables Raft integrated storage - enabled: false - # Set the Node Raft ID to the name of the pod - setNodeId: false - - config: | - ui = true - - listener "tcp" { - tls_disable = 1 - address = "[::]:8200" - cluster_address = "[::]:8201" - - {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - telemetry { - unauthenticated_metrics_access = "true" - } - {{- end }} - } - - storage "raft" { - path = "/vault/data" - } - - service_registration "kubernetes" {} - - # config is a raw string of default configuration when using a Stateful - # deployment. Default is to use a Consul for its HA storage backend. - # This should be HCL. - - # Note: Configuration files are stored in ConfigMaps so sensitive data - # such as passwords should be either mounted through extraSecretEnvironmentVars - # or through a Kube secret. For more information see: - # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations - config: | - ui = true - - listener "tcp" { - tls_disable = 1 - address = "[::]:8200" - cluster_address = "[::]:8201" - {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - telemetry { - unauthenticated_metrics_access = "true" - } - {{- end }} - } - storage "consul" { - path = "vault" - address = "HOST_IP:8500" - } - - service_registration "kubernetes" {} - - # Example configuration for using auto-unseal, using Google Cloud KMS. The - # GKMS keys must already exist, and the cluster must have a service account - # that is authorized to access GCP KMS. - #seal "gcpckms" { - # project = "vault-helm-dev-246514" - # region = "global" - # key_ring = "vault-helm-unseal-kr" - # crypto_key = "vault-helm-unseal-key" - #} - - {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - telemetry { - prometheus_retention_time = "30s" - disable_hostname = true - } - {{- end }} - - # A disruption budget limits the number of pods of a replicated application - # that are down simultaneously from voluntary disruptions - disruptionBudget: - enabled: true - - # maxUnavailable will default to (n/2)-1 where n is the number of - # replicas. If you'd like a custom value, you can specify an override here. - maxUnavailable: null - - serviceAccount: - create: true - name: "" - createSecret: false - annotations: {} - extraLabels: {} - serviceDiscovery: - enabled: true - - statefulSet: - annotations: {} - securityContext: - pod: {} - container: {} - - hostNetwork: false - -# Vault UI -ui: - enabled: true - domain: {{ .Modules.SecretsStorage.Expose.Domain }} - path: {{ .Modules.SecretsStorage.Expose.Path }} - publishNotReadyAddresses: true - # The service should only contain selectors for active Vault pod - activeVaultPodOnly: false - {{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }} - serviceType: "NodePort" - serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }} - {{- else }} - serviceType: "ClusterIP" - serviceNodePort: null - {{- end }} - externalPort: 8200 - targetPort: 8200 - - serviceIPFamilyPolicy: "" - - serviceIPFamilies: [] - - externalTrafficPolicy: Cluster - - #loadBalancerSourceRanges: - # - 10.0.0.0/16 - # - 1.78.23.3/32 - - # loadBalancerIP: - - annotations: {} - -csi: - # True if you want to install a secrets-store-csi-driver-provider-vault daemonset. - # - # Requires installing the secrets-store-csi-driver separately, see: - # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver - # - # With the driver and provider installed, you can mount Vault secrets into volumes - # similar to the Vault Agent injector, and you can also sync those secrets into - # Kubernetes secrets. - enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }} - - image: - repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}" - tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}" - pullPolicy: IfNotPresent - - volumes: null - - volumeMounts: null - - resources: {} - - # Override the default secret name for the CSI Provider's HMAC key used for - # generating secret versions. - hmacSecretName: "" - - daemonSet: - updateStrategy: - type: RollingUpdate - maxUnavailable: "" - # Extra annotations for the daemonSet. This can either be YAML or a - # YAML-formatted multi-line templated string map of the annotations to apply - # to the daemonSet. - annotations: {} - # Provider host path (must match the CSI provider's path) - providersDir: "/etc/kubernetes/secrets-store-csi-providers" - # Kubelet host path - kubeletRootDir: "/var/lib/kubelet" - # Extra labels to attach to the vault-csi-provider daemonSet - # This should be a YAML map of the labels to apply to the csi provider daemonSet - extraLabels: {} - # security context for the pod template and container in the csi provider daemonSet - securityContext: - pod: {} - container: {} - - pod: - annotations: {} - tolerations: - - key: node-role.kubernetes.io/master - effect: NoSchedule - - key: node-role.kubernetes.io/control-plane - effect: NoSchedule - nodeSelector: {} - affinity: {} - extraLabels: {} - - agent: - enabled: true - extraArgs: [] - - image: - repository: "{{ .Modules.SecretsStorage.Agent.Image }}" - tag: "{{ .Modules.SecretsStorage.Agent.Tag }}" - pullPolicy: IfNotPresent - - logFormat: standard - logLevel: info - - resources: {} - - priorityClassName: "" - - serviceAccount: - annotations: {} - extraLabels: {} - - readinessProbe: - enabled: true - failureThreshold: 2 - initialDelaySeconds: 5 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 3 - - livenessProbe: - failureThreshold: 2 - initialDelaySeconds: 5 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 3 - - debug: false - extraArgs: [] - -serverTelemetry: - # Enable support for the Prometheus Operator. Currently, this chart does not support - # authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included - # in the `listener "tcp"{}` stanza - # telemetry { - # unauthenticated_metrics_access = "true" - # } - # - # See the `standalone.config` for a more complete example of this. - # - # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration: - # - # example: - # telemetry { - # prometheus_retention_time = "30s" - # disable_hostname = true - # } - # - # Configuration for monitoring the Vault server. - serviceMonitor: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - selectors: {} - interval: 30s - scrapeTimeout: 10s - - prometheusRules: - enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }} - selectors: {} - rules: [] - -ingress: - {{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }} - enabled: true - {{- end }} - accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }} - class: {{ .Modules.Additional.Ingress.Type }} - annotations: - {{- if eq .Modules.Additional.Ingress.Type "nginx" }} - nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" - nginx.ingress.kubernetes.io/proxy-buffers: "4 256k" - nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k" - {{- end }} - tls: - {{- if .Modules.SecretsStorage.Expose.Tls.Enabled }} - enabled: true - {{- end }} - hosts: - - host: {{ .Modules.SecretsStorage.Expose.Domain }} - secretName: vault-tls diff --git a/internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl index 6c952af..09ffdbd 100644 --- a/internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl +++ b/internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl @@ -135,7 +135,5 @@ unsafe_show_logs: false ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases. allow_unsupported_distribution_setup: false -## Containerd settings -# containerd_metadata_root_dir: /app/lib/containerd -# The state directory for containerd -# containerd_state_dir: /app/run/containerd +## Kubelet additional settings +kubelet_custom_flags: "--root-dir={{ .Orchestrator.KubeletDir }}" diff --git a/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl new file mode 100644 index 0000000..4765798 --- /dev/null +++ b/internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl @@ -0,0 +1,60 @@ +--- +# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options + +containerd_storage_dir: {{ .Orchestrator.ContainerEngine.DataDir }} +containerd_state_dir: {{ .Orchestrator.ContainerEngine.StateDir }} + +# containerd_oom_score: 0 + +# containerd_default_runtime: "runc" +# containerd_snapshotter: "native" + +# containerd_runc_runtime: +# name: runc +# type: "io.containerd.runc.v2" +# engine: "" +# root: "" + +# containerd_additional_runtimes: +# Example for Kata Containers as additional runtime: +# - name: kata +# type: "io.containerd.kata.v2" +# engine: "" +# root: "" + +# containerd_grpc_max_recv_message_size: 16777216 +# containerd_grpc_max_send_message_size: 16777216 + +# Containerd debug socket location: unix or tcp format +# containerd_debug_address: "" + +# Containerd log level +# containerd_debug_level: "info" + +# Containerd logs format, supported values: text, json +# containerd_debug_format: "" + +# Containerd debug socket UID +# containerd_debug_uid: 0 + +# Containerd debug socket GID +# containerd_debug_gid: 0 + +# containerd_metrics_address: "" + +# containerd_metrics_grpc_histogram: false + +# Registries defined within containerd. +# containerd_registries_mirrors: +# - prefix: docker.io +# mirrors: +# - host: https://registry-1.docker.io +# capabilities: ["pull", "resolve"] +# skip_verify: false + +# containerd_max_container_log_line_size: -1 + +# containerd_registry_auth: +# - registry: 10.0.0.2:5000 +# username: user +# password: pass \ No newline at end of file diff --git a/internal/resources/templates/secrets-storage/vault-keys.json.tmpl b/internal/resources/templates/secrets-storage/vault-keys.json.tmpl deleted file mode 100644 index a326df1..0000000 --- a/internal/resources/templates/secrets-storage/vault-keys.json.tmpl +++ /dev/null @@ -1,8 +0,0 @@ -{ - "keys": [ - {{- range $index, $key := .Modules.SecretsStorage.UnsealKeys }} - "{{ $key }}", - {{- end }} - ], - "root_token": "{{ .Modules.SecretsStorage.AuthToken }}" -} \ No newline at end of file diff --git a/internal/secrets_storage/commands.go b/internal/secrets_storage/commands.go deleted file mode 100644 index 544fb07..0000000 --- a/internal/secrets_storage/commands.go +++ /dev/null @@ -1,130 +0,0 @@ -package secrets_storage - -import ( - "fmt" - "kube-forge/internal/config" - "kube-forge/internal/kubernetes_client" - "kube-forge/internal/logging" - "kube-forge/internal/templates" - "regexp" - "strings" -) - -func initVault() { - _, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage") - if err != nil { - logging.Log.Error(err.Error()) - return - } - err = commandToInitVault() - if err != nil { - logging.Log.Warn(err.Error()) - return - } - logging.Log.Info("Vault initialized") - templates.ApplyVaultInitKeysTemplate() -} - -func addKubernetesLocalIntegration() { - _, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage") - if err != nil { - logging.Log.Error(err.Error()) - return - } - err = commandToAddKubernetesLocalIntegration() - if err != nil { - logging.Log.Error(err.Error()) - return - } - logging.Log.Info("Vault local Kubernetes integration added") -} - -func unsealVault() { - _, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage") - if err != nil { - logging.Log.Error(err.Error()) - return - } - commandToUnsealVault() -} - -func commandToInitVault() error { - config := config.GetConfig() - commandArray := []string{ - "vault", "operator", "init", - fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares), - fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold), - } - output, err := kubernetes_client.ExecuteCommandInPodContainer( - commandArray, "secrets-storage", "vault-0", "vault", - ) - if err != nil && strings.Contains(output, "Vault is already initialized") { - return VaultAlreadyInitialised - } - - unsealKeys, rootToken := parseVaultInitKeys(output) - config.Modules.SecretsStorage.UnsealKeys = unsealKeys - config.Modules.SecretsStorage.AuthToken = rootToken - return nil -} - -func parseVaultInitKeys(input string) ([]string, string) { - unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`) - rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`) - - unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1) - var unsealKeys []string - for _, match := range unsealKeysMatches { - unsealKeys = append(unsealKeys, match[1]) - } - - rootTokenMatches := rootTokenPattern.FindStringSubmatch(input) - rootToken := rootTokenMatches[1] - - return unsealKeys, rootToken -} - -func commandToUnsealVault() { - config := config.GetConfig() - - for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys { - commandArray := []string{"vault", "operator", "unseal", unsealKey} - kubernetes_client.ExecuteCommandInPodContainer( - commandArray, "secrets-storage", "vault-0", "vault", - ) - } - logging.Log.Info("Vault unsealed") -} - -func commandToAddKubernetesLocalIntegration() error { - config := config.GetConfig() - - commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken} - output, err := kubernetes_client.ExecuteCommandInPodContainer( - commandArray, "secrets-storage", "vault-0", "vault", - ) - if err != nil && strings.Contains(output, "permission denied") { - return IncorrectCredentials - } - commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"} - output, err = kubernetes_client.ExecuteCommandInPodContainer( - commandArray, "secrets-storage", "vault-0", "vault", - ) - kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer( - "KUBERNETES_PORT_443_TCP_ADDR", - "secrets-storage", - "vault-0", - "vault", - ) - if err != nil { - return err - } - commandArray = []string{ - "vault", "write", "auth/kubernetes-local/config", - fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr), - } - output, err = kubernetes_client.ExecuteCommandInPodContainer( - commandArray, "secrets-storage", "vault-0", "vault", - ) - return nil -} diff --git a/internal/secrets_storage/errors.go b/internal/secrets_storage/errors.go deleted file mode 100644 index ed395b8..0000000 --- a/internal/secrets_storage/errors.go +++ /dev/null @@ -1,6 +0,0 @@ -package secrets_storage - -import "errors" - -var VaultAlreadyInitialised = errors.New("Vault already initialised") -var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!") diff --git a/internal/secrets_storage/helm.go b/internal/secrets_storage/helm.go deleted file mode 100644 index 95ac87d..0000000 --- a/internal/secrets_storage/helm.go +++ /dev/null @@ -1,44 +0,0 @@ -package secrets_storage - -import ( - "kube-forge/internal/config" - "kube-forge/internal/helm_client" - "kube-forge/internal/templates" - "time" - - go_helm_client "github.com/mittwald/go-helm-client" -) - -var HELM_REPOS = []config.RepoSettings{ - { - Name: "kube-forge", - URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable", - }, -} - -func getVaultSpec() go_helm_client.ChartSpec { - appConfig := config.GetConfig() - return go_helm_client.ChartSpec{ - ReleaseName: "vault", - ChartName: appConfig.Modules.SecretsStorage.ChartRef, - Version: appConfig.Modules.SecretsStorage.ChartVersion, - Namespace: appConfig.Modules.SecretsStorage.Namespace, - CreateNamespace: true, - Atomic: true, - Timeout: time.Second * 600, - ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"), - } -} - -func ApplyCharts() { - appConfig := config.GetConfig() - helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS) - if appConfig.Modules.SecretsStorage.Enabled { - helm_client.InstallChart(getVaultSpec()) - initVault() - unsealVault() - addKubernetesLocalIntegration() - } else { - helm_client.DeleteChart(getVaultSpec()) - } -} diff --git a/internal/templates/kubespray.go b/internal/templates/kubespray.go index 13e9822..f7464f4 100644 --- a/internal/templates/kubespray.go +++ b/internal/templates/kubespray.go @@ -5,6 +5,7 @@ var K8S_TEMPLATES = [...][2]string{ {"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"}, {"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"}, {"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"}, + {"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"}, } func ApplyK8sTemplates() { diff --git a/kubespray/inventory/group_vars/all.yml b/kubespray/inventory/group_vars/all.yml index af6aed2..6162050 100644 --- a/kubespray/inventory/group_vars/all.yml +++ b/kubespray/inventory/group_vars/all.yml @@ -32,6 +32,7 @@ disable_host_nameservers: false upstream_dns_servers: - 8.8.8.8 - 8.8.4.4 + - 1.1.1.1 ## There are some changes specific to the cloud providers ## for instance we need to encapsulate packets with some network plugins @@ -128,7 +129,5 @@ unsafe_show_logs: false ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases. allow_unsupported_distribution_setup: false -## Containerd settings -# containerd_metadata_root_dir: /app/lib/containerd -# The state directory for containerd -# containerd_state_dir: /app/run/containerd +## Kubelet additional settings +kubelet_custom_flags: "--root-dir=/var/lib/kubelet" diff --git a/kubespray/inventory/group_vars/all/containerd.yml b/kubespray/inventory/group_vars/all/containerd.yml new file mode 100644 index 0000000..1d3f5c3 --- /dev/null +++ b/kubespray/inventory/group_vars/all/containerd.yml @@ -0,0 +1,60 @@ +--- +# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options + +containerd_storage_dir: /var/lib/containerd +containerd_state_dir: /run/containerd + +# containerd_oom_score: 0 + +# containerd_default_runtime: "runc" +# containerd_snapshotter: "native" + +# containerd_runc_runtime: +# name: runc +# type: "io.containerd.runc.v2" +# engine: "" +# root: "" + +# containerd_additional_runtimes: +# Example for Kata Containers as additional runtime: +# - name: kata +# type: "io.containerd.kata.v2" +# engine: "" +# root: "" + +# containerd_grpc_max_recv_message_size: 16777216 +# containerd_grpc_max_send_message_size: 16777216 + +# Containerd debug socket location: unix or tcp format +# containerd_debug_address: "" + +# Containerd log level +# containerd_debug_level: "info" + +# Containerd logs format, supported values: text, json +# containerd_debug_format: "" + +# Containerd debug socket UID +# containerd_debug_uid: 0 + +# Containerd debug socket GID +# containerd_debug_gid: 0 + +# containerd_metrics_address: "" + +# containerd_metrics_grpc_histogram: false + +# Registries defined within containerd. +# containerd_registries_mirrors: +# - prefix: docker.io +# mirrors: +# - host: https://registry-1.docker.io +# capabilities: ["pull", "resolve"] +# skip_verify: false + +# containerd_max_container_log_line_size: -1 + +# containerd_registry_auth: +# - registry: 10.0.0.2:5000 +# username: user +# password: pass \ No newline at end of file diff --git a/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml b/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml index 7faae94..5aa3291 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml @@ -157,7 +157,7 @@ kube_encrypt_secret_data: false # DNS configuration. # Kubernetes cluster name, also will be used as DNS domain -cluster_name: k8s-cluster.local +cluster_name: cluster.local # Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods ndots: 2 # dns_timeout: 2 diff --git a/kubespray/inventory/hosts b/kubespray/inventory/hosts index a1b1d21..041622a 100644 --- a/kubespray/inventory/hosts +++ b/kubespray/inventory/hosts @@ -1,17 +1,17 @@ -vbox-prod-k8s-master-01 ansible_host=10.250.50.22 ip=10.250.50.22 -vbox-prod-k8s-slave-01 ansible_host=10.250.50.23 ip=10.250.50.23 -vbox-prod-k8s-slave-02 ansible_host=10.250.50.21 ip=10.250.50.21 +t1-disk-lt-k8s-test-master-01 ansible_host=10.100.20.49 ip=10.100.20.49 +t1-disk-lt-k8s-test-slave-01 ansible_host=10.100.20.48 ip=10.100.20.48 +t1-disk-lt-k8s-test-slave-02 ansible_host=10.100.20.47 ip=10.100.20.47 [kube_control_plane] -vbox-prod-k8s-master-01 +t1-disk-lt-k8s-test-master-01 [etcd] -vbox-prod-k8s-master-01 +t1-disk-lt-k8s-test-master-01 [kube_node] -vbox-prod-k8s-slave-01 -vbox-prod-k8s-slave-02 +t1-disk-lt-k8s-test-slave-01 +t1-disk-lt-k8s-test-slave-02 [k8s_cluster:children] kube_control_plane @@ -20,4 +20,4 @@ kube_node [all:vars] ansible_connection=ssh ansible_user=sre-admin -ansible_ssh_private_key_file=/root/.ssh/id_rsa +ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa_bastion_ift