gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update kube-forge concept and add ability to change data dir for containerd

Browse Source
This commit is contained in:
George Stykalin
2024-11-24 17:59:37 +03:00
parent 78cf06e314
commit 1c366bdb6b
46 changed files with 2023 additions and 4343 deletions
Download Patch File Download Diff File Expand all files Collapse all files

108
internal/cicd/helm.go
View File

@@ -1,108 +0,0 @@
package cicd
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = [...]config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getArgoCdSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-cd",
ChartName: appConfig.Modules.Cicd.ArgoCd.ChartRef,
Version: appConfig.Modules.Cicd.ArgoCd.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"),
}
}
func getArgoRolloutsSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-rollouts",
ChartName: appConfig.Modules.Cicd.Rollouts.ChartRef,
Version: appConfig.Modules.Cicd.Rollouts.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"),
}
}
func getKeelSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "keel",
ChartName: appConfig.Modules.Cicd.UpdatesOperator.ChartRef,
Version: appConfig.Modules.Cicd.UpdatesOperator.ChartVersion,
Namespace: appConfig.Modules.Cicd.UpdatesOperator.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"),
}
}
func getArgoCdIngressSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "argo-cd-ingress",
ChartName: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef,
Version: appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion,
Namespace: appConfig.Modules.Cicd.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"),
}
}
func addCicdHelmRepos() {
appConfig := config.GetConfig()
for _, repoSettings := range HELM_REPOS {
helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings)
}
}
func ApplyCharts() {
addCicdHelmRepos()
appConfig := config.GetConfig()
if appConfig.Modules.Cicd.Enabled {
helm_client.InstallChart(getArgoCdSpec())
if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" {
helm_client.InstallChart(getArgoCdIngressSpec())
} else {
helm_client.DeleteChart(getArgoCdIngressSpec())
}
if appConfig.Modules.Cicd.Rollouts.Enabled {
helm_client.InstallChart(getArgoRolloutsSpec())
} else {
helm_client.DeleteChart(getArgoRolloutsSpec())
}
if appConfig.Modules.Cicd.UpdatesOperator.Enabled {
helm_client.InstallChart(getKeelSpec())
} else {
helm_client.DeleteChart(getKeelSpec())
}
} else {
helm_client.DeleteChart(getArgoCdIngressSpec())
helm_client.DeleteChart(getArgoCdSpec())
helm_client.DeleteChart(getArgoRolloutsSpec())
helm_client.DeleteChart(getKeelSpec())
}
}

11
internal/config/config.go
View File

@@ -30,13 +30,7 @@ type Config struct {
Orchestrator Orchestrator `yaml:"orchestrator"`
Modules struct {
AdminPassword string `yaml:"admin_password"`
AdditionalRepositories interface{} `yaml:"additional_repositories"`
Additional Additional `yaml:"additional"`
Observability Observability `yaml:"observability"`
Registry Registry `yaml:"registry"`
Cicd Cicd `yaml:"cicd"`
SecretsStorage SecretsStorage `yaml:"secrets_storage"`
Additional Additional `yaml:"additional"`
} `yaml:"modules"`
}
@@ -54,9 +48,6 @@ func CreateConfig(configPath string, workDir string, password string) *Config {
if password != "" {
instance.Credentials.Password = password
}
generateCreds(instance)
return instance
}

96
internal/config/modules_cicd.go
View File

@@ -1,96 +0,0 @@
package config
type Cicd struct {
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"cicd"`
ArgoCd struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
ChartVersion string `yaml:"chart_version" env-default:"6.7.10"`
AdminPassword string
Ha struct {
Enabled bool `yaml:"enabled"`
Autoscaling bool `yaml:"autoscaling"`
} `yaml:"ha"`
Expose struct {
Type string `yaml:"type"`
Domain string `yaml:"domain"`
Path string `yaml:"path" env-default:"/"`
NodePortHttp int `yaml:"node_port_http" env-default:"30005"`
NodePortHttps int `yaml:"node_port_https" env-default:"30006"`
Tls struct {
Enabled bool `yaml:"enabled"`
} `yaml:"tls"`
} `yaml:"expose"`
Repositories interface{} `yaml:"repositories"`
Rbac struct {
AdditionalPolicies string `yaml:"additional_policies"`
} `yaml:"argo_cd"`
ServiceIngress struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
} `yaml:"service_ingress"`
Global struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"global"`
Server struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"server"`
Redis struct {
Image string `yaml:"image" env-default:"public.ecr.aws/docker/library/redis"`
Tag string `yaml:"tag" env-default:"7.2.4-alpine"`
Exporter struct {
Image string `yaml:"image" env-default:"public.ecr.aws/bitnami/redis-exporter"`
Tag string `yaml:"tag" env-default:"1.58.0"`
} `yaml:"exporter"`
} `yaml:"redis"`
ApplicationSet struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"application_set"`
Dex struct {
Image string `yaml:"image" env-default:"ghcr.io/dexidp/dex"`
Tag string `yaml:"tag" env-default:"v2.38.0"`
} `yaml:"dex"`
RepoServer struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"repo_server"`
Notifications struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"notifications"`
Controller struct {
Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"controller"`
} `yaml:"argo_cd"`
UpdatesOperator struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/keel"`
ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
Enabled bool `yaml:"enabled"`
Namespace string `yaml:"namespace" env-default:"kube-system"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
Tag string `yaml:"tag" env-default:"latest"`
} `yaml:"updates_operator"`
Rollouts struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
Enabled bool `yaml:"enabled"`
Registry string `yaml:"registry" env-default:"quay.io"`
Repository string `yaml:"repository" env-default:"argoproj/argo-rollouts"`
Tag string `yaml:"tag" env-default:"latest"`
Ha struct {
Enabled bool `yaml:"enabled"`
} `yaml:"ha"`
Expose struct {
Type string `yaml:"type"`
NodePort int `yaml:"node_port" env-default:"30010"`
} `yaml:"expose"`
Controller struct {
} `yaml:"controller"`
Dashboard struct {
} `yaml:"dashboard"`
} `yaml:"rollouts"`
}

179
internal/config/modules_observability.go
View File

@@ -1,179 +0,0 @@
package config
type Observability struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/observability"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
Enabled bool `yaml:"enabled"`
Logging Logging `yaml:"logging"`
Tracing Tracing `yaml:"tracing"`
Monitoring Monitoring `yaml:"monitoring"`
Visualization Visualization `yaml:"visualization"`
Namespace string `yaml:"namespace" env-default:"observability"`
}
type Logging struct {
Enabled bool `yaml:"enabled"`
Operator struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/fluent-operator"`
ChartVersion string `yaml:"chart_version" env-default:"2.7.0"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"`
Tag string `yaml:"tag" env-default:"v2.7.0"`
Namespace string `yaml:"namespace" env-default:"observability"`
InitContainer struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"`
Tag string `yaml:"tag" env-default:"20.10"`
} `yaml:"initcontainer"`
} `yaml:"operator"`
Fluentd struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluentd"`
Tag string `yaml:"tag" env-default:"v1.15.3"`
} `yaml:"fluentd"`
FluentBit struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-bit"`
Tag string `yaml:"tag" env-default:"v2.2.2"`
} `yaml:"fluent_bit"`
Loki struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/loki"`
ChartVersion string `yaml:"chart_version" env-default:"5.47.2"`
Registry string `yaml:"registry" env-default:"harbor.kvazaric.ru"`
Image string `yaml:"image" env-default:"kube-forge/grafana/loki"`
Tag string `yaml:"tag" env-default:"latest"`
Namespace string `yaml:"namespace" env-default:"observability"`
Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
StorageSize string `yaml:"storage_size" env-default:"10Gi"`
Retention string `yaml:"retention" env-default:"168h"`
} `yaml:"persistence"`
AlertManagerUrl string `yaml:"alert_manager_u rl" env-default:"http://observability-alert-manager:9093"`
AdditionalRulesGroups string `yaml:"additional_rules_groups" env-default:""`
} `yaml:"loki"`
Events struct {
Enabled bool `yaml:"enabled"`
Exporter struct {
Image string `yaml:"image" env-default:"ghcr.io/resmoio/kubernetes-event-exporter"`
Tag string `yaml:"tag" env-default:"v1.4"`
} `yaml:"exporter"`
Cron struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kubectl"`
Tag string `yaml:"tag" env-default:"1.27.5-debian-11-r8"`
Schedule string `yaml:"schedule" env-default:"*/2 * * * *"`
} `yaml:"cron"`
} `yaml:"events"`
}
type Tracing struct {
Enabled bool `yaml:"enabled"`
Operator struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/opentelemetry-operator"`
ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
Image string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
Tag string `yaml:"tag" env-default:""`
Namespace string `yaml:"namespace" env-default:"observability"`
} `yaml:"operator"`
Collector struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"`
Tag string `yaml:"tag" env-default:"0.95.0"`
} `yaml:"collector"`
Tempo struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/tempo"`
ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"`
Tag string `yaml:"tag" env-default:"2.3.1"`
Namespace string `yaml:"namespace" env-default:"observability"`
Retention string `yaml:"retention" env-default:"24h"`
ListenPort int `yaml:"listen_port" env-default:"3100"`
Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
StorageSize string `yaml:"storage_size" env-default:"10Gi"`
} `yaml:"persistence"`
TempoQuery struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo-query"`
Tag string `yaml:"tag" env-default:"2.3.1"`
ListenPort int `yaml:"listen_port" env-default:"16686"`
} `yaml:"tempo_query"`
} `yaml:"tempo"`
}
type Monitoring struct {
Enabled bool `yaml:"enabled"`
Prometheus struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/prometheus"`
Tag string `yaml:"tag" env-default:"v2.45.0"`
ScrapeInterval string `yaml:"scrape_interval" env-default:"15s"`
Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
StorageSize string `yaml:"storage_size" env-default:"3Gi"`
Retention string `yaml:"retention" env-default:"7d"`
} `yaml:"persistence"`
Operator struct {
Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-operator"`
Tag string `yaml:"tag" env-default:"v0.65.2"`
ConfigReloader struct {
Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-config-reloader"`
Tag string `yaml:"tag" env-default:"v0.65.2"`
} `yaml:"config_reloader"`
KubeRbacProxy struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-rbac-proxy"`
Tag string `yaml:"tag" env-default:"0.14.1"`
} `yaml:"kube_rbac_proxy"`
} `yaml:"operator"`
} `yaml:"prometheus"`
AlertManager struct {
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/alertmanager"`
Tag string `yaml:"tag" env-default:"v0.26.0"`
AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"`
Route interface{} `yaml:"route"`
Receivers interface{} `yaml:"receivers"`
} `yaml:"alert_manager"`
Blackbox struct {
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/blackbox-exporter"`
Tag string `yaml:"tag" env-default:"v0.24.0"`
AdditionalModules string `yaml:"routes" env-default:""`
} `yaml:"blackbox"`
KubeState struct {
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-state-metrics"`
Tag string `yaml:"tag" env-default:"2.9.2"`
} `yaml:"kube_state"`
Node struct {
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/node-exporter"`
Tag string `yaml:"tag" env-default:"v1.5.0"`
} `yaml:"node"`
MetricsServer struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"`
ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
Image string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
Tag string `yaml:"tag" env-default:""`
Namespace string `yaml:"namespace" env-default:"kube-system"`
}
}
type Visualization struct {
Enabled bool `yaml:"enabled"`
Grafana struct {
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana"`
Tag string `yaml:"tag" env-default:"10.4.1-v2"`
Expose struct {
Type string `yaml:"type" env-default:"ingress"`
Domain string `yaml:"domain" env-default:""`
Path string `yaml:"path" env-default:"/"`
NodePortHttp int `yaml:"node_port_http" env-default:"30007"`
Tls struct {
Enabled bool `yaml:"enabled"`
}
} `yaml:"expose"`
Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
StorageSize string `yaml:"storage_size" env-default:"2Gi"`
} `yaml:"persistence"`
Config struct {
Auth string `yaml:"auth" env-default:""`
AuthGenericAuth string `yaml:"auth_generic_auth" env-default:""`
AdditionalDatasources interface{} `yaml:"additional_datasources"`
} `yaml:"config"`
} `yaml:"grafana"`
}

66
internal/config/modules_registry.go
View File

@@ -1,66 +0,0 @@
package config
type Registry struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/harbor"`
ChartVersion string `yaml:"chart_version" env-default:"1.14.2"`
Enabled bool `yaml:"enabled"`
AdminPassword string
Namespace string `yaml:"namespace" env-default:"registry"`
Expose struct {
Type string `yaml:"type" env-default:"nodePort"`
Domain string `yaml:"domain" env-default:""`
Path string `yaml:"path" env-default:"/"`
NodePortHttp int `yaml:"node_port_http" env-default:"30002"`
NodePortHttps int `yaml:"node_port_https" env-default:"30003"`
} `yaml:"expose"`
Tls struct {
Enabled bool `yaml:"enabled"`
CertificateGenerator struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/certificate-generator"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
} `yaml:"certificate_generator"`
} `yaml:"tls"`
Persistence struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
RegistrySize string `yaml:"registry_size" env-default:"10Gi"`
JobserviceSize string `yaml:"jobservice_size" env-default:"1Gi"`
DatabaseSize string `yaml:"database_size" env-default:"2Gi"`
RedisSize string `yaml:"redis_size" env-default:"1Gi"`
TrivySize string `yaml:"trivy_size" env-default:"5Gi"`
} `yaml:"persistence"`
EnabledScanner bool `yaml:"enabled_scanner"`
Portal struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"portal"`
Core struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-core"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"core"`
Jobservice struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"jobservice"`
Registry struct {
Registry struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/registry-photon"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"registry"`
Controller struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"controller"`
} `yaml:"registry"`
Trivy struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"trivy"`
Database struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-db"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"database"`
Redis struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/redis-photon"`
Tag string `yaml:"tag" env-default:"v2.10.1"`
} `yaml:"redis"`
}

48
internal/config/modules_secrets_storage.go
View File

@@ -1,48 +0,0 @@
package config
type SecretsStorage struct {
ChartRef string `yaml:"chart_ref" env-default:"kube-forge/vault"`
ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
Namespace string `yaml:"namespace" env-default:"secrets-storage"`
Enabled bool `yaml:"enabled"`
KeyShares int `yaml:"key_shares" env-default:"5"`
KeyThreshold int `yaml:"key_threshold" env-default:"3"`
UnsealKeys []string `yaml:"unseal_keys" env-default:"[]"`
AuthToken string `yaml:"auth_token" env-default:""`
Expose struct {
Type string `yaml:"type"`
Domain string `yaml:"domain"`
Path string `yaml:"path" env-default:"/"`
NodePort int `yaml:"node_port"`
Tls struct {
Enabled bool `yaml:"enabled"`
} `yaml:"tls"`
} `yaml:"expose"`
CsiIntegration struct {
Enabled bool `yaml:"enabled"`
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-csi-provider"`
Tag string `yaml:"tag" env-default:"1.4.1"`
} `yaml:"csi_integration"`
Injector struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-k8s"`
Tag string `yaml:"tag" env-default:"1.3.1"`
} `yaml:"injector"`
Server struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"`
Tag string `yaml:"tag" env-default:"1.16.0"`
Persistence struct {
DataStorage struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
Size string `yaml:"size" env-default:"10Gi"`
} `yaml:"data_storage"`
AuditStorage struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
Size string `yaml:"size" env-default:"10Gi"`
} `yaml:"audit_storage"`
} `yaml:"persistence"`
} `yaml:"server"`
Agent struct {
Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"`
Tag string `yaml:"tag" env-default:"1.16.0"`
} `yaml:"agent"`
}

9
internal/config/orchestrator.go
View File

@@ -12,16 +12,19 @@ type RegistryMirror struct {
type Orchestrator struct {
Version string `yaml:"version" env-default:"v1.29.0"`
ClusterName string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
ClusterName string `yaml:"cluster_name" env-default:"cluster.local"`
BinDir string `yaml:"bin_dir" env-default:"/usr/local/bin"`
SysctlFilePath string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
LoadbalancerApiserverPort int `yaml:"loadbalancer_apiserver_port" env-default:"6443"`
Dns Dns `yaml:"dns"`
CloudProvider string `yaml:"cloud_provider"`
ExgernalCloudProvider string `yaml:"external_cloud_provider"`
KubeletDir string `yaml:"kubelet_dir" env-default:"/var/lib/kubelet"`
ContainerEngine struct {
Type string `yaml:"type" env-default:"containerd"`
Install bool `yaml:"install"`
Type string `yaml:"type" env-default:"containerd"`
Install bool `yaml:"install"`
DataDir string `yaml:"data_dir" env-default:"/var/lib/containerd"`
StateDir string `yaml:"state_dir" env-default:"/run/containerd"`
} `yaml:"container_engine"`
PingAccessIp bool `yaml:"ping_access_ip"`
AutoRenewCertificates bool `yaml:"auto_renew_certificates"`

5
internal/config/utility.go
View File

@@ -11,8 +11,3 @@ func getBcryptHash(input string) string {
}
return string(hashedPassword)
}
func generateCreds(config *Config) {
config.Modules.Cicd.ArgoCd.AdminPassword = getBcryptHash(config.Modules.AdminPassword)
config.Modules.Registry.AdminPassword = config.Modules.AdminPassword
}

6
internal/kubespray/cluster.go
View File

@@ -21,3 +21,9 @@ func ScaleCluster() {
runPlaybook("kubespray/project/scale.yml", "")
CopyK8SAdminConfig(appConfig.KubeconfigFile)
}
func ResetCluster() {
appConfig := config.GetConfig()
runPlaybook("kubespray/project/reset.yml", "")
CopyK8SAdminConfig(appConfig.KubeconfigFile)
}

122
internal/observability/helm.go
View File

@@ -1,122 +0,0 @@
package observability
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getFluentOperatorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "fluent-operator",
ChartName: appConfig.Modules.Observability.Logging.Operator.ChartRef,
Version: appConfig.Modules.Observability.Logging.Operator.ChartVersion,
Namespace: appConfig.Modules.Observability.Logging.Operator.Namespace,
CreateNamespace: true,
Atomic: true,
UpgradeCRDs: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"),
}
}
func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "opentelemetry-operator",
ChartName: appConfig.Modules.Observability.Tracing.Operator.ChartRef,
Version: appConfig.Modules.Observability.Tracing.Operator.ChartVersion,
Namespace: appConfig.Modules.Observability.Tracing.Operator.Namespace,
CreateNamespace: true,
Atomic: true,
UpgradeCRDs: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"),
}
}
func getMetricsServerSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "metrics-server",
ChartName: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef,
Version: appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion,
Namespace: appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"),
}
}
func getTempoSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "tempo",
ChartName: appConfig.Modules.Observability.Tracing.Tempo.ChartRef,
Version: appConfig.Modules.Observability.Tracing.Tempo.ChartVersion,
Namespace: appConfig.Modules.Observability.Tracing.Tempo.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"),
}
}
func getLokiSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "loki",
ChartName: appConfig.Modules.Observability.Logging.Loki.ChartRef,
Version: appConfig.Modules.Observability.Logging.Loki.ChartVersion,
Namespace: appConfig.Modules.Observability.Logging.Loki.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"),
}
}
func getObservabilitySpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "observability",
ChartName: appConfig.Modules.Observability.ChartRef,
Version: appConfig.Modules.Observability.ChartVersion,
Namespace: appConfig.Modules.Observability.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
if appConfig.Modules.Observability.Enabled {
if appConfig.Modules.Observability.Logging.Enabled {
helm_client.InstallChart(getFluentOperatorSpec())
helm_client.InstallChart(getLokiSpec())
}
if appConfig.Modules.Observability.Tracing.Enabled {
helm_client.InstallChart(getOpenTelemetryOperatorSpec())
helm_client.InstallChart(getTempoSpec())
}
if appConfig.Modules.Observability.Monitoring.Enabled {
helm_client.InstallChart(getMetricsServerSpec())
}
helm_client.InstallChart(getObservabilitySpec())
}
}

61
internal/registry/helm.go
View File

@@ -1,61 +0,0 @@
package registry
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "harbor-certificate-generator",
ChartName: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef,
Version: appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion,
Namespace: appConfig.Modules.Registry.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 60,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"),
}
}
func getHarborSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "harbor",
ChartName: appConfig.Modules.Registry.ChartRef,
Version: appConfig.Modules.Registry.ChartVersion,
Namespace: appConfig.Modules.Registry.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
if appConfig.Modules.Registry.Enabled {
if appConfig.Modules.Registry.Expose.Type == "ingress" {
helm_client.InstallChart(getHarborCertificateGeneratorSpec())
} else {
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
}
helm_client.InstallChart(getHarborSpec())
} else {
helm_client.DeleteChart(getHarborSpec())
helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
}
}

1845
internal/resources/templates/helm-apps/releases/additional-modules/ingress-contour.yml.tmpl Normal file
View File

File diff suppressed because it is too large Load Diff

0
internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl
View File

24
internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
View File

@@ -1,24 +0,0 @@
services:
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
address: argo-cd-argocd-server
port: 80
secretName: argo-cd-server-tls
ingress:
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
{{- end }}
tls:
enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
useCertManager: true
# used if "useCertManager" is false
crt: ""
key: ""

170
internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
View File

@@ -1,170 +0,0 @@
crds:
install: true
global:
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
server:
image:
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
certificateSecret:
enabled: false
{{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
service:
type: "NodePort"
nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
{{- end }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
enabled: true
minReplicas: 2
{{- else }}
replicas: 2
{{- end }}
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
redis:
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
exporter:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
controller:
image:
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
replicas: 1
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
applicationSet:
image:
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
replicas: 2
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
dex:
image:
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
## check later
serviceMonitor:
enabled: false
repoServer:
image:
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
enabled: true
minReplicas: 2
{{- else }}
replicas: 2
{{- end }}
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
notifications:
image:
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
configs:
params:
server.insecure: true
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
{{- end }}
secret:
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
repositories:
# add default helm-repository from harbor
{{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
cm:
create: true
url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
accounts.developer: login
accounts.guest: login
# oidc.config: ""
rbac:
create: true
policy.csv: |
p, role:admin, applications, create, */*, allow
p, role:admin, applications, update, */*, allow
p, role:admin, applications, delete, */*, allow
p, role:admin, applications, sync, */*, allow
p, role:admin, applications, override, */*, allow
p, role:admin, applications, action/*, */*, allow
p, role:admin, applicationsets, get, */*, allow
p, role:admin, applicationsets, create, */*, allow
p, role:admin, applicationsets, update, */*, allow
p, role:admin, applicationsets, delete, */*, allow
p, role:admin, certificates, create, *, allow
p, role:admin, certificates, update, *, allow
p, role:admin, certificates, delete, *, allow
p, role:admin, clusters, create, *, allow
p, role:admin, clusters, update, *, allow
p, role:admin, clusters, delete, *, allow
p, role:admin, repositories, create, *, allow
p, role:admin, repositories, update, *, allow
p, role:admin, repositories, delete, *, allow
p, role:admin, projects, create, *, allow
p, role:admin, projects, update, *, allow
p, role:admin, projects, delete, *, allow
p, role:admin, accounts, update, *, allow
p, role:admin, gpgkeys, create, *, allow
p, role:admin, gpgkeys, delete, *, allow
p, role:admin, exec, create, */*, allow
{{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
policy.default: role:''
# scopes: "[roles,email,groups]"
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
redis-ha:
enabled: true
{{- end }}

424
internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl
View File

@@ -1,424 +0,0 @@
installCRDs: true
keepCRDs: false
clusterInstall: true
createClusterAggregateRoles: true
apiVersionOverrides:
# -- String to override apiVersion of ingresses rendered by this helm chart
ingress: "" # networking.k8s.io/v1beta1
# -- Override the Kubernetes version, which is used to evaluate certain manifests
kubeVersionOverride: ""
# -- Additional manifests to deploy within the chart. A list of objects.
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
extraObjects: []
# - apiVersion: v1
# kind: Secret
# metadata:
# name: datadog
# type: Opaque
# data:
# address: https://api.datadoghq.com
# api-key: <datadog-api-key>
# app-key: <datadog-app-key>
global:
# -- Annotations for all deployed Deployments
deploymentAnnotations: {}
controller:
# -- Value of label `app.kubernetes.io/component`
component: rollouts-controller
# -- Annotations to be added to the controller deployment
deploymentAnnotations: {}
# -- Annotations to be added to application controller pods
podAnnotations: {}
# -- [Node selector]
nodeSelector: {}
# -- [Tolerations] for use with node taints
tolerations: []
# -- Assign custom [affinity] rules to the deployment
affinity: {}
logging:
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
level: info
# -- Set the klog logging level
kloglevel: "0"
# -- Set the logging format (one of: `text`, `json`)
format: "text"
# -- Assign custom [TopologySpreadConstraints] rules to the controller
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# -- [priorityClassName] for the controller
priorityClassName: ""
# -- The number of controller pods to run
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
replicas: 3
{{- else }}
replicas: 1
{{- end }}
image:
# -- Registry to use
registry: {{ .Modules.Cicd.Rollouts.Registry }}
# -- Repository to use
repository: {{ .Modules.Cicd.Rollouts.Repository }}
# -- Overrides the image tag (default is the chart appVersion)
tag: {{ .Modules.Cicd.Rollouts.Tag }}
# -- Image pull policy
pullPolicy: IfNotPresent
# -- flag to enable creation of cluster controller role (requires cluster RBAC)
createClusterRole: true
# Controller container ports
containerPorts:
# -- Metrics container port
metrics: 8090
# -- Healthz container port
healthz: 8080
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
metrics:
# -- Deploy metrics service
enabled: true
service:
# -- Metrics service port name
portName: metrics
# -- Metrics service port
port: 8090
# -- Service annotations
annotations: {}
serviceMonitor:
# -- Enable a prometheus ServiceMonitor
enabled: true
# -- Namespace to be used for the ServiceMonitor
namespace: ""
# -- Labels to be added to the ServiceMonitor
additionalLabels: {}
# -- Annotations to be added to the ServiceMonitor
additionalAnnotations: {}
# -- RelabelConfigs to apply to samples before scraping
relabelings: []
# -- MetricRelabelConfigs to apply to samples before ingestion
metricRelabelings: []
{{- end }}
# -- Configure liveness [probe] for the controller
# @default -- See [values.yaml]
livenessProbe:
httpGet:
path: /healthz
port: healthz
initialDelaySeconds: 30
periodSeconds: 20
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 10
# -- Configure readiness [probe] for the controller
# @default -- See [values.yaml]
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 4
## Configure Pod Disruption Budget for the controller
pdb:
# -- Labels to be added to controller [Pod Disruption Budget]
labels: {}
# -- Annotations to be added to controller [Pod Disruption Budget]
annotations: {}
# -- Deploy a [Pod Disruption Budget] for the controller
enabled: false
# -- Minimum number / percentage of pods that should remain scheduled
minAvailable: # 1
# -- Maximum number / percentage of pods that may be made unavailable
maxUnavailable: # 0
# -- Additional volumes to add to the controller pod
volumes: []
# - configMap:
# name: my-certs-cm
# name: my-certs
# -- Additional volumeMounts to add to the controller container
volumeMounts: []
# - mountPath: /etc/ssl/certs
# name: my-certs
# -- Configures 3rd party metric providers for controller
## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
metricProviderPlugins: {}
# metricProviderPlugins: |-
# - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
# -- Configures 3rd party traffic router plugins for controller
## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
trafficRouterPlugins: {}
# trafficRouterPlugins: |-
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Annotations to add to the service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# -- Annotations to be added to all CRDs
crdAnnotations: {}
# -- Annotations for the all deployed pods
podAnnotations: {}
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Security Context to set on container level
containerSecurityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
# -- Annotations to be added to the Rollout service
serviceAnnotations: {}
# -- Labels to be added to the Rollout pods
podLabels: {}
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
imagePullSecrets: []
# - name: argo-pull-secret
providerRBAC:
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
enabled: true
# providerRBAC.enabled must be true in order to toggle the individual providers
providers:
# -- Adds RBAC rules for the Istio provider
istio: true
# -- Adds RBAC rules for the SMI provider
smi: true
# -- Adds RBAC rules for the Ambassador provider
ambassador: true
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
awsLoadBalancerController: true
# -- Adds RBAC rules for the AWS App Mesh provider
awsAppMesh: true
# -- Adds RBAC rules for the Traefik provider
traefik: true
# -- Adds RBAC rules for the Apisix provider
apisix: true
# -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
contour: true
# -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
glooPlatform: true
# -- Additional RBAC rules for others providers
additionalRules: []
dashboard:
# -- Deploy dashboard server
enabled: true
# -- Set cluster role to readonly
readonly: false
# -- Value of label `app.kubernetes.io/component`
component: rollouts-dashboard
# -- Annotations to be added to the dashboard deployment
deploymentAnnotations: {}
# -- Annotations to be added to application dashboard pods
podAnnotations: {}
# -- [Node selector]
nodeSelector: {}
# -- [Tolerations] for use with node taints
tolerations: []
# -- Assign custom [affinity] rules to the deployment
affinity: {}
logging:
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
level: info
# -- Set the klog logging level
kloglevel: "0"
# -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# -- [priorityClassName] for the dashboard server
priorityClassName: ""
# -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
createClusterRole: true
# -- The number of dashboard pods to run
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
replicas: 3
{{- else }}
replicas: 1
{{- end }}
image:
# -- Registry to use
registry: quay.io
# -- Repository to use
repository: argoproj/kubectl-argo-rollouts
# -- Overrides the image tag (default is the chart appVersion)
tag: ""
# -- Image pull policy
pullPolicy: IfNotPresent
# -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
extraArgs: []
# -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
extraEnv: []
# - name: FOO
# value: bar
# -- Resource limits and requests for the dashboard pods.
resources: {}
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Security Context to set on container level
containerSecurityContext: {}
service:
# -- Sets the type of the Service
{{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
type: NodePort
nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
{{- else }}
type: ClusterIP
nodePort:
{{- end }}
# -- LoadBalancer will get created with the IP specified in this field
loadBalancerIP: ""
# -- Source IP ranges to allow access to service from
loadBalancerSourceRanges: []
# -- Dashboard service external IPs
externalIPs: []
# -- Service annotations
annotations: {}
# -- Service labels
labels: {}
# -- Service port name
portName: dashboard
# -- Service port
port: 3100
# -- Service target port
targetPort: 3100
# -- (int) Service nodePort
serviceAccount:
# -- Specifies whether a dashboard service account should be created
create: true
# -- Annotations to add to the dashboard service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
## Configure Pod Disruption Budget for the dashboard
pdb:
# -- Labels to be added to dashboard [Pod Disruption Budget]
labels: {}
# -- Annotations to be added to dashboard [Pod Disruption Budget]
annotations: {}
# -- Deploy a [Pod Disruption Budget] for the dashboard
enabled: false
# -- Minimum number / percentage of pods that should remain scheduled
minAvailable: # 1
# -- Maximum number / percentage of pods that may be made unavailable
maxUnavailable: # 0
## Ingress configuration.
## ref: https://kubernetes.io/docs/user-guide/ingress/
##
ingress:
# -- Enable dashboard ingress support
enabled: false
# -- Dashboard ingress annotations
annotations: {}
# -- Dashboard ingress labels
labels: {}
# -- Dashboard ingress class name
ingressClassName: ""
# -- Dashboard ingress hosts
## Argo Rollouts Dashboard Ingress.
## Hostnames must be provided if Ingress is enabled.
## Secrets must be manually created in the namespace
hosts: []
# - argorollouts.example.com
# -- Dashboard ingress paths
paths:
- /
# -- Dashboard ingress path type
pathType: Prefix
# -- Dashboard ingress extra paths
extraPaths: []
# - path: /*
# backend:
# serviceName: ssl-redirect
# servicePort: use-annotation
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
# - path: /*
# pathType: Prefix
# backend:
# service
# name: ssl-redirect
# port:
# name: use-annotation
# -- Dashboard ingress tls
tls: []
# - secretName: argorollouts-example-tls
# hosts:
# - argorollouts.example.com
# -- Additional volumes to add to the dashboard pod
volumes: []
# -- Additional volumeMounts to add to the dashboard container
volumeMounts: []
notifications:
secret:
# -- Whether to create notifications secret
create: false
# -- Generic key:value pairs to be inserted into the notifications secret
items: {}
# slack-token:
# -- Configures notification services
notifiers: {}
# service.slack: |
# token: $slack-token
# -- Notification templates
templates: {}
# -- The trigger defines the condition when the notification should be sent
triggers: {}
# trigger.on-purple: |
# - send: [my-purple-template]
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'

245
internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl
View File

@@ -1,245 +0,0 @@
image:
repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
pullPolicy: Always
# Enable insecure registries
insecureRegistry: false
# Polling is enabled by default,
# you can disable it setting value below to false
polling:
enabled: true
defaultSchedule: "@every 1m"
# Extra Containers to run alongside Keel
# extraContainers:
# - name: busybox
# image: busybox
# imagePullPolicy: IfNotPresent
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
# Helm provider support
helmProvider:
enabled: true
# set to version "v3" for Helm v3
version: "v2"
tillerNamespace: "kube-system"
# optional Tiller address (if portforwarder tunnel doesn't work),
# if you are using default configuration, setting it to
# 'tiller-deploy:44134' is usually fine
tillerAddress: 'tiller-deploy:44134'
# helmDriver: ''
# helmDriverSqlConnectionString: ''
# Google Container Registry
# GCP Project ID
gcr:
enabled: false
projectId: ""
gcpServiceAccount: ""
clusterName: ""
pubSub:
enabled: false
# Notification level (debug, info, success, warn, error, fatal)
notificationLevel: info
# AWS Elastic Container Registry
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
ecr:
enabled: false
roleArn: ""
accessKeyId: ""
secretAccessKey: ""
region: ""
# Webhook Notification
# Remote webhook endpoint for notification delivery
webhook:
enabled: false
endpoint: ""
# Slack Notification
# bot name (default keel) must exist!
slack:
enabled: false
botName: ""
token: ""
channel: ""
approvalsChannel: ""
# Hipchat notification and approvals
hipchat:
enabled: false
token: ""
channel: ""
approvalsChannel: ""
botName: ""
userName: ""
password: ""
# Mattermost notifications
mattermost:
enabled: false
endpoint: ""
# MS Teams notifications
teams:
enabled: false
webhookUrl: ""
# Discord notifications
discord:
enabled: false
webhookUrl: ""
# Mail notifications
mail:
enabled: false
from: ""
to: ""
smtp:
server: ""
port: 25
user: ""
pass: ""
# Basic auth on approvals
basicauth:
enabled: true
user: "admin"
password: "{{ .Modules.AdminPassword }}"
# Keel service
# Enable to receive webhooks from Docker registries
service:
enabled: false
type: LoadBalancer
externalPort: 9300
clusterIP: ""
# Webhook Relay service
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
webhookRelay:
enabled: false
bucket: ""
# webhookrelay.com credentials
# Set the key and secret values here to create the keel-webhookrelay secret with this
# chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
key: ""
secret: ""
# webhookrelay docker image
image:
repository: webhookrelay/webhookrelayd
tag: latest
pullPolicy: IfNotPresent
# Use a secret file to define passwords and tokens of third parties.
secret:
# Leave blank to use `keel.fullname`
name: ""
# Set to false to manage your own secret file, with terraform for example.
create: true
# Keel self-update
# uncomment lines below if you want Keel to automaticly
# self-update to the latest release version
# keel:
# # keel policy (all/major/minor/patch/force)
# policy: patch
# # trigger type, defaults to events such as pubsub, webhooks
# trigger: poll
# # polling schedule
# pollSchedule: "@every 3m"
# # images to track and update
# images:
# - repository: image.repository
# tag: image.tag
# RBAC manifests management
rbac:
enabled: true
serviceAccount:
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
# name:
# Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
# If rbac.serviceAccount.name is not set, a new name for the service account is generated
create: true
# Resources
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi
# NodeSelector
nodeSelector: {}
affinity: {}
tolerations: {}
# base64 encoded json of GCP service account
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
googleApplicationCredentials: ""
# Enable DEBUG logging
debug: false
# This is used by the static manifest generator in order to create a static
# namespace manifest for the namespace that keel is being installed
# within. It should **not** be used if you are using Helm for deployment.
createNamespaceResource: false
podAnnotations: {}
serviceAnnotations: {}
# Useful for making the load balancer internal
# serviceAnnotations:
# cloud.google.com/load-balancer-type: Internal
aws:
region: null
podDisruptionBudget:
enabled: false
maxUnavailable: 1
minAvailable: null
# Google Cloud Certificates
gcloud:
managedCertificates:
enabled: false
domains:
- ""
ingress:
enabled: false
labels: {}
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
hosts: []
# - host: chart-example.local
# paths:
# - /
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
dockerRegistry:
enabled: false
name: ""
key: ""
persistence:
enabled: false
storageClass: "-"
size: 1Gi

55
internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl
View File

@@ -1,55 +0,0 @@
# Set this to containerd or crio if you want to collect CRI format logs
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
Kubernetes: false
operator:
initcontainer:
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 50m
memory: 64Mi
container:
repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 100m
memory: 60Mi
imagePullSecrets: []
labels: {}
logPath:
# The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
# crio: /var/log
containerd: /var/log
disableComponentControllers: ""
fluentbit:
crdsEnable: true
enable: false
fluentd:
crdsEnable: true
enable: false
name: fluentd
# Valid modes include "collector" and "agent".
# The "collector" mode will deploy Fluentd as a StatefulSet as before.
# The new "agent" mode will deploy Fluentd as a DaemonSet.
mode: "agent"
port: 24224
image:
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
nameOverride: ""
fullnameOverride: ""
namespaceOverride: ""

188
internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl
View File

@@ -1,188 +0,0 @@
loki:
image:
registry: {{ .Modules.Observability.Logging.Loki.Registry }}
repository: {{ .Modules.Observability.Logging.Loki.Image }}
tag: {{ .Modules.Observability.Logging.Loki.Tag }}
podAnnotations:
app.kubernetes.io/component: "loki"
auth_enabled: false
commonConfig:
replication_factor: 1
storage:
type: 'filesystem'
frontend:
max_outstanding_per_tenant: 10000
limits_config:
reject_old_samples: false
split_queries_by_interval: 15m
max_query_parallelism: 32
max_query_series: 10000
retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
compactor:
compaction_interval: 10m
retention_enabled: true
retention_delete_delay: 2h
querier:
max_concurrent: 2048
query_scheduler:
max_outstanding_requests_per_tenant: 10000
rulerConfig:
storage:
type: local
local:
directory: /var/loki/rules
rule_path: /tmp/rules
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
singleBinary:
replicas: 1
extraVolumes:
- name: loki-default-rules
configMap:
name: loki-default-alerting-rules
extraVolumeMounts:
- name: loki-default-rules
mountPath: /var/loki/rules
write:
persistence:
volumeClaimsEnabled: true
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
test:
enabled: false
gateway:
enabled: false
monitoring:
selfMonitoring:
enabled: false
grafanaAgent:
installOperator: false
lokiCanary:
enabled: false
rules:
enabled: true
alerting: true
extraObjects:
- apiVersion: v1
kind: ConfigMap
metadata:
name: loki-default-alerting-rules
labels:
loki_rule: ""
data:
loki-default-alerting-rules.yaml: |-
groups:
{{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
- name: kube-events-alerts
rules:
- alert: FailedEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: FailedEventsOccured
instance: kube-cluster
jobName: kube_events
summary: Failed events occured in cluster
addDefaultUrl: "true"
- alert: OOMKilledEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: OOMKilledEventsOccured
instance: kube-cluster
jobName: kube_events
summary: OOMKilled events occured in cluster
addDefaultUrl: "true"
- alert: EvictedEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: EvictedEventsOccured
instance: kube-cluster
jobName: kube_events
summary: Evicted events occured in cluster
addDefaultUrl: "true"
- alert: ImagePullBackOffEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: ImagePullBackOffEventsOccured
instance: kube-cluster
jobName: kube_events
summary: ImagePullBackOff events occured in cluster
addDefaultUrl: "true"
- alert: BackOffEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: BackOffEventsOccured
instance: kube-cluster
jobName: kube_events
summary: BackOff events occured in cluster
addDefaultUrl: "true"
sidecar:
rules:
enabled: true
# -- Label that the configmaps/secrets with rules will be marked with.
label: loki_rule
# -- Label value that the configmaps/secrets with rules will be set to.
labelValue: ""
# -- Folder into which the rules will be placed.
folder: /var/loki/rules
# -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
# Otherwise the namespace in which the sidecar is running will be used.
# It's also possible to specify 'ALL' to search in all namespaces.
searchNamespace: 'ALL'
# -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
watchMethod: WATCH
# -- Search in configmap, secret, or both.
resource: both
# -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
script: null
# -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
watchServerTimeout: 60
#
# -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
# If you have a network outage dropping all packets with no RST/FIN,
# this is how long your client waits before realizing & dropping the connection.
# Defaults to 66sec.
watchClientTimeout: 60
# -- Log level of the sidecar container.
logLevel: INFO

192
internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl
View File

@@ -1,192 +0,0 @@
image:
repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
pullPolicy: IfNotPresent
imagePullSecrets: []
# - name: registrySecretName
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# The list of secrets mountable by this service account.
# See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
secrets: []
rbac:
# Specifies whether RBAC resources should be created
create: true
pspEnabled: false
apiService:
create: true
# Annotations to add to the API service
annotations: {}
# Specifies whether to skip TLS verification
insecureSkipTLSVerify: true
# The PEM encoded CA bundle for TLS verification
caBundle: ""
commonLabels: {}
podLabels:
"app.kubernetes.io/component": "metrics-server"
podAnnotations: {}
podSecurityContext: {}
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
priorityClassName: system-cluster-critical
containerPort: 10250
hostNetwork:
# Specifies if metrics-server should be started in hostNetwork mode.
#
# You would require this enabled if you use alternate overlay networking for pods and
# API server unable to communicate with metrics-server. As an example, this is required
# if you use Weave network on EKS
enabled: false
replicas: 1
revisionHistoryLimit:
updateStrategy: {}
# type: RollingUpdate
# rollingUpdate:
# maxSurge: 0
# maxUnavailable: 1
podDisruptionBudget:
# https://kubernetes.io/docs/tasks/run-application/configure-pdb/
enabled: false
minAvailable:
maxUnavailable:
defaultArgs:
- --cert-dir=/tmp
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
- --kubelet-insecure-tls
args: []
livenessProbe:
httpGet:
path: /livez
port: https
scheme: HTTPS
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 3
readinessProbe:
httpGet:
path: /readyz
port: https
scheme: HTTPS
initialDelaySeconds: 20
periodSeconds: 10
failureThreshold: 3
service:
type: ClusterIP
port: 443
annotations: {}
labels: {}
# Add these labels to have metrics-server show up in `kubectl cluster-info`
# kubernetes.io/cluster-service: "true"
# kubernetes.io/name: "Metrics-server"
addonResizer:
enabled: false
image:
repository: registry.k8s.io/autoscaling/addon-resizer
tag: 1.8.20
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
resources:
requests:
cpu: 40m
memory: 25Mi
limits:
cpu: 40m
memory: 25Mi
nanny:
cpu: 0m
extraCpu: 1m
memory: 0Mi
extraMemory: 2Mi
minClusterSize: 100
pollPeriod: 300000
threshold: 5
metrics:
enabled: true
serviceMonitor:
enabled: true
additionalLabels: {}
interval: 1m
scrapeTimeout: 10s
metricRelabelings: []
relabelings: []
# See https://github.com/kubernetes-sigs/metrics-server#scaling
resources:
requests:
cpu: 100m
memory: 200Mi
# limits:
# cpu:
# memory:
extraVolumeMounts: []
extraVolumes: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
dnsConfig: {}
# Annotations to add to the deployment
deploymentAnnotations: {}
schedulerName: ""
tmpVolume:
emptyDir: {}

391
internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
View File

@@ -1,391 +0,0 @@
prometheus:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
serviceMonitor: true
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
pullPolicy: IfNotPresent
clustering:
enabled: false
replicas: 3
shards: 1
persistence:
enabled: true
storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
storageResources:
requests:
storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
# serviceNodePort: 30008
additionalConfigs: |
- job_name: "kubelet"
scheme: https
metrics_path: /metrics/cadvisor
tls_config:
insecure_skip_verify: true
authorization:
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
kubernetes_sd_configs:
- role: node
relabel_configs:
- action: labelmap
regex: __meta_kubernetes_node_label_(.+)
- job_name: "kubernetes-apiservers"
kubernetes_sd_configs:
- role: endpoints
scheme: https
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
authorization:
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: default;kubernetes;https
- job_name: "coredns"
kubernetes_sd_configs:
- role: endpoints
scheme: http
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: kube-system;.*dns.*;metrics
{{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
- job_name: 'ingress-endpoints'
metrics_path: /probe
params:
module: [https_ok]
kubernetes_sd_configs:
- role: ingress
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- source_labels:
[
__meta_kubernetes_ingress_scheme,
__address__,
__meta_kubernetes_ingress_path,
]
regex: (.+);(.+);(.+)
replacement: https://${2}${3}/
target_label: __param_target
- target_label: __address__
replacement: observability-blackbox-exporter:9115
{{- end }}
alertManager:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
enableDefaultRules: true
image:
repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
pullPolicy: IfNotPresent
# serviceNodePort: 30009
configPath: /etc/alertmanager
{{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
additionalMessageTemplates:
{{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
{{- end }}
{{- if .Modules.Observability.Monitoring.AlertManager.Route }}
route:
{{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
{{- end }}
{{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
receivers:
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
{{- end }}
blackboxExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
pullPolicy: IfNotPresent
# serviceNodePort: 30012
configPath: /etc/blackbox_exporter
additionalModules:
kubeStateMetrics:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
pullPolicy: IfNotPresent
resources:
requests:
cpu: 30m
memory: 120Mi
limits:
memory: 240Mi
cpu: 60m
prometheusOperator:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
pullPolicy: IfNotPresent
prometheusConfigReloader:
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
pullPolicy: IfNotPresent
kubeRbacProxy:
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
pullPolicy: IfNotPresent
nodeExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Node.Image }}
tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
pullPolicy: IfNotPresent
kubeEventsExporter:
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
image:
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
pullPolicy: IfNotPresent
lokiAddress: http://loki.observability.svc.cluster.local:3100
logLevel: warn
logFormat: json
kubeQPS: 100
kubeBurst: 500
maxEventAgeSeconds: 120
metricsNamePrefix: event_exporter_
cron:
restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
image:
repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
pullPolicy: IfNotPresent
additionalRoutes:
additionalReceivers:
grafana:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
{{- end }}
image:
repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
pullPolicy: IfNotPresent
storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
storageResources:
requests:
storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
config:
server: |
enable_gzip = true
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }}
serve_from_sub_path = true
{{- end }}
security: |
admin_user = admin
admin_password = {{ .Modules.AdminPassword }}
auth: |
{{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
authGenericAuth: |
{{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
additionalDatasources:
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
- name: Kube-loki
type: loki
uid: P2895588539814C92
access: proxy
url: http://loki:3100
editable: false
basicAuth: false
isDefault: false
jsonData:
maxLines: 1000
{{- end }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
- name: Kube-jaeger-query
type: jaeger
access: proxy
url: http://tempo:16686
editable: false
basicAuth: false
isDefault: false
{{- end }}
{{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
{{- end }}
opentelemetryCollector:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
serviceMonitor: true
config: |
receivers:
otlp:
protocols:
grpc:
http:
exporters:
otlphttp:
endpoint: http://tempo:4318
service:
telemetry:
logs:
level: "debug"
pipelines:
traces:
receivers: [otlp]
exporters: [otlphttp]
ingress:
{{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
enabled: true
{{- else }}
enabled: false
{{- end }}
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
{{- end }}
tls:
{{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
enabled: true
{{- end }}
hosts:
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
secretName: grafana-tls
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
fluentbit:
enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
serviceMonitor: true
image:
repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/edge
operator: DoesNotExist
tolerations:
- operator: Exists
input:
tail:
enable: true
refreshIntervalSeconds: 10
memBufLimit: 100MB
bufferMaxSize: ""
path: "/var/log/containers/*.log"
skipLongLines: true
readFromHead: false
storageType: memory
pauseOnChunksOverlimit: "off"
systemd:
enable: true
systemdFilter:
enable: true
filters: []
path: "/var/log/journal"
includeKubelet: true
stripUnderscores: "off"
storageType: memory
pauseOnChunksOverlimit: "off"
nodeExporterMetrics: {}
fluentBitMetrics: {}
output:
es:
enable: false
host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
port: 9200
logstashPrefix: ks-logstash-log
bufferSize: 20MB
traceError: true
kafka:
enable: false
brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
topics: ks-log
opentelemetry: {}
opensearch:
enable: false
stdout:
enable: false
loki:
enable: true
host: loki
port: 3100
stackdriver: {}
service:
storage: {}
filter:
kubernetes:
enable: true
labels: true
annotations: true
containerd:
enable: true
systemd:
enable: true
kubeedge:
enable: false
prometheusRemoteWrite:
# Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
host: "<cloud-prometheus-service-host>"
# Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
port: "<cloud-prometheus-service-port>"

134
internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl
View File

@@ -1,134 +0,0 @@
replicaCount: 1
nameOverride: ""
imagePullSecrets: []
pdb:
create: false
minAvailable: 1
maxUnavailable: ""
manager:
image:
repository: {{ .Modules.Observability.Tracing.Operator.Image }}
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
collectorImage:
repository: {{ .Modules.Observability.Tracing.Collector.Image }}
tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
featureGates: ""
ports:
metricsPort: 8080
webhookPort: 9443
healthzPort: 8081
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
env:
ENABLE_WEBHOOKS: "true"
serviceAccount:
create: true
annotations: {}
serviceMonitor:
enabled: true
metricsEndpoints:
- port: metrics
prometheusRule:
enabled: true
groups: []
defaultRules:
enabled: true
extraArgs: []
leaderElection:
enabled: true
verticalPodAutoscaler:
enabled: false
controlledResources: []
maxAllowed: {}
minAllowed: {}
updatePolicy:
updateMode: Auto
minReplicas: 2
rolling: false
securityContext: {}
kubeRBACProxy:
enabled: true
image:
repository: quay.io/brancz/kube-rbac-proxy
tag: v0.15.0
ports:
proxyPort: 8443
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 5m
memory: 64Mi
extraArgs: []
securityContext: {}
admissionWebhooks:
create: true
servicePort: 443
failurePolicy: Fail
secretName: ""
pods:
failurePolicy: Ignore
namePrefix: ""
timeoutSeconds: 10
namespaceSelector: {}
objectSelector: {}
certManager:
enabled: true
issuerRef: {}
certificateAnnotations: {}
issuerAnnotations: {}
autoGenerateCert:
enabled: true
recreate: true
secretAnnotations: {}
secretLabels: {}
role:
create: true
clusterRole:
create: true
affinity: {}
tolerations: []
nodeSelector: {}
topologySpreadConstraints: []
hostNetwork: false
priorityClassName: ""
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
fsGroup: 65532
testFramework:
image:
repository: busybox
tag: latest

68
internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl
View File

@@ -1,68 +0,0 @@
replicas: 1
tempo:
repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
pullPolicy: IfNotPresent
updateStrategy: RollingUpdate
memBallastSizeMbs: 1024
multitenancyEnabled: false
reportingEnabled: false
metricsGenerator:
enabled: false
remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
global_overrides:
per_tenant_override_config: /conf/overrides.yaml
server:
http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
storage:
trace:
backend: local
local:
path: /var/tempo/traces
wal:
path: /var/tempo/wal
receivers:
otlp:
protocols:
grpc:
endpoint: "0.0.0.0:4317"
http:
endpoint: "0.0.0.0:4318"
tempoQuery:
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
pullPolicy: IfNotPresent
enabled: true
service:
port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
ingress:
enabled: false
serviceAccount:
create: true
automountServiceAccountToken: true
service:
type: ClusterIP
serviceMonitor:
enabled: true
persistence:
enabled: true
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
accessModes:
- ReadWriteOnce
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
priorityClassName: null

6
internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl
View File

@@ -1,6 +0,0 @@
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
certificates:
- name: harbor-tls
domain: {{ .Modules.Registry.Expose.Domain }}

371
internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
View File

@@ -1,371 +0,0 @@
expose:
type: {{ .Modules.Registry.Expose.Type }}
tls:
enabled: {{ .Modules.Registry.Tls.Enabled }}
certSource: secret
secret:
secretName: harbor-tls
ingress:
hosts:
core: {{ .Modules.Registry.Expose.Domain }}
controller: default
kubeVersionOverride: ""
className: "{{ .Modules.Additional.Ingress.Type }}"
annotations:
ingress.kubernetes.io/ssl-redirect: "true"
ingress.kubernetes.io/proxy-body-size: "0"
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
{{- end }}
labels: {}
nodePort:
name: harbor
ports:
http:
port: 80
nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
https:
port: 443
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence:
resourcePolicy: "keep"
persistentVolumeClaim:
registry:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.RegistrySize }}
annotations: {}
jobservice:
jobLog:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.JobserviceSize }}
annotations: {}
database:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.DatabaseSize }}
annotations: {}
redis:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.RedisSize }}
annotations: {}
trivy:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.TrivySize }}
annotations: {}
imageChartStorage:
disableredirect: false
type: filesystem
filesystem:
rootdirectory: /storage
#maxthreads: 100
imagePullPolicy: IfNotPresent
updateStrategy:
type: RollingUpdate
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
logLevel: info
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
core:
path: /metrics
port: 8001
registry:
path: /metrics
port: 8001
jobservice:
path: /metrics
port: 8001
exporter:
path: /metrics
port: 8001
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
trace:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
provider: otel
sample_rate: 1
attributes:
application: harbor
jaeger:
endpoint: http://hostname:14268/api/traces
otel:
endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
url_path: /v1/traces
compression: false
insecure: true
timeout: 10
portal:
image:
repository: {{ .Modules.Registry.Portal.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-portal"
priorityClassName:
core:
image:
repository: {{ .Modules.Registry.Core.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
startupProbe:
enabled: true
initialDelaySeconds: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-core"
serviceAnnotations: {}
priorityClassName:
configureUserSettings:
quotaUpdateProvider: db # Or redis
secret: ""
existingSecret: ""
secretName: ""
tokenKey: ""
tokenCert: ""
xsrfKey: ""
existingXsrfSecret: ""
existingXsrfSecretKey: CSRF_KEY
artifactPullAsyncFlushDuration:
gdpr:
deleteUser: false
auditLogsCompliant: false
jobservice:
image:
repository: {{ .Modules.Registry.Jobservice.Image }}
tag: {{ .Modules.Registry.Jobservice.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints:
podLabels:
"app.kubernetes.io/component": "harbor-jobservice"
priorityClassName:
maxJobWorkers: 10
jobLoggers:
- file
# - database
# - stdout
loggerSweeperDuration: 14 #days
notification:
webhook_job_max_retry: 3
webhook_job_http_client_timeout: 3 # in seconds
reaper:
max_update_hours: 24
max_dangling_hours: 168
secret: ""
existingSecret: ""
existingSecretKey: JOBSERVICE_SECRET
registry:
registry:
image:
repository: {{ .Modules.Registry.Registry.Registry.Image }}
tag: {{ .Modules.Registry.Registry.Registry.Tag }}
extraEnvVars: []
controller:
image:
repository: {{ .Modules.Registry.Registry.Controller.Image }}
tag: {{ .Modules.Registry.Registry.Controller.Tag }}
extraEnvVars: []
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-registry"
priorityClassName:
secret: ""
existingSecret: ""
existingSecretKey: REGISTRY_HTTP_SECRET
relativeurls: false
credentials:
# If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
existingSecret: ""
# Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
# htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
# htpasswdString: ""
middleware:
enabled: false
type: cloudFront
cloudFront:
baseurl: example.cloudfront.net
keypairid: KEYPAIRID
duration: 3000s
ipfilteredby: none
# The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
# that allows access to CloudFront
privateKeySecret: "my-secret"
# enable purge _upload directories
upload_purging:
enabled: true
# remove files in _upload directories which exist for a period of time, default is one week.
age: 168h
# the interval of the purge operations
interval: 24h
dryrun: false
trivy:
enabled: {{ .Modules.Registry.EnabledScanner }}
image:
repository: {{ .Modules.Registry.Trivy.Image }}
tag: {{ .Modules.Registry.Trivy.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 1
memory: 1Gi
database:
# if external database is used, set "type" to "external"
# and fill the connection information in "external" section
type: internal
internal:
image:
repository: {{ .Modules.Registry.Database.Image }}
tag: {{ .Modules.Registry.Database.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
livenessProbe:
timeoutSeconds: 1
readinessProbe:
timeoutSeconds: 1
priorityClassName:
# The initial superuser password for internal database
# password: "changeit"
# The size limit for Shared memory, pgSQL use it for shared_buffer
# More details see:
# https://github.com/goharbor/harbor/issues/15034
shmSizeLimit: 512Mi
initContainer:
migrator: {}
# resources:
# requests:
# memory: 128Mi
# cpu: 100m
permissions: {}
# resources:
# requests:
# memory: 128Mi
# cpu: 100m
external:
host: "192.168.0.1"
port: "5432"
username: "user"
password: "password"
coreDatabase: "registry"
# if using existing secret, the key must be "password"
existingSecret: ""
# "disable" - No SSL
# "require" - Always SSL (skip verification)
# "verify-ca" - Always SSL (verify that the certificate presented by the
# server was signed by a trusted CA)
# "verify-full" - Always SSL (verify that the certification presented by the
# server was signed by a trusted CA and the server host name matches the one
# in the certificate)
sslmode: "disable"
# The maximum number of connections in the idle connection pool per pod (core+exporter).
# If it <=0, no idle connections are retained.
maxIdleConns: 100
# The maximum number of open connections to the database per pod (core+exporter).
# If it <= 0, then there is no limit on the number of open connections.
# Note: the default number of connections is 1024 for postgre of harbor.
maxOpenConns: 900
## Additional deployment annotations
podAnnotations: {}
## Additional deployment labels
podLabels: {}
redis:
type: internal
internal:
image:
repository: {{ .Modules.Registry.Redis.Image }}
tag: {{ .Modules.Registry.Redis.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
priorityClassName:
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
# harborDatabaseIndex: "6"
# cacheLayerDatabaseIndex: "7"
external:
# support redis, redis+sentinel
# addr for redis: <host_redis>:<port_redis>
# addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
addr: "192.168.0.2:6379"
# The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
sentinelMasterSet: ""
# The "coreDatabaseIndex" must be "0" as the library Harbor
# used doesn't support configuring it
# harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
# cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
coreDatabaseIndex: "0"
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
# harborDatabaseIndex: "6"
# cacheLayerDatabaseIndex: "7"
# username field can be an empty string, and it will be authenticated against the default user
username: ""
password: ""
existingSecret: ""
podAnnotations: {}
podLabels: {}

873
internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
View File

@@ -1,873 +0,0 @@
global:
enabled: true
imagePullSecrets: []
tlsDisable: true
externalVaultAddr: ""
openshift: false
# Create PodSecurityPolicy for pods
psp:
enable: false
# Annotation for PodSecurityPolicy.
# This is a multi-line templated string map, and can also be set as YAML.
annotations: |
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
serverTelemetry:
# Enable integration with the Prometheus Operator
# See the top level serverTelemetry section below before enabling this feature.
prometheusOperator: false
injector:
enabled: true
replicas: 1
# Configures the port the injector should listen on
port: 8080
# If multiple replicas are specified, by default a leader will be determined
# so that only one injector attempts to create TLS certificates.
leaderElector:
enabled: true
# If true, will enable a node exporter metrics endpoint at /metrics.
metrics:
enabled: false
# Deprecated: Please use global.externalVaultAddr instead.
externalVaultAddr: ""
# image sets the repo and tag of the vault-k8s image to use for the injector.
image:
repository: "{{ .Modules.SecretsStorage.Injector.Image }}"
tag: "{{ .Modules.SecretsStorage.Injector.Tag }}"
pullPolicy: IfNotPresent
# agentImage sets the repo and tag of the Vault image to use for the Vault Agent
# containers. This should be set to the official Vault image. Vault 1.3.1+ is
# required.
agentImage:
repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
agentDefaults:
cpuLimit: "500m"
cpuRequest: "250m"
memLimit: "128Mi"
memRequest: "64Mi"
# ephemeralLimit: "128Mi"
# ephemeralRequest: "64Mi"
# Default template type for secrets when no custom template is specified.
# Possible values include: "json" and "map".
template: "map"
# Default values within Agent's template_config stanza.
templateConfig:
exitOnRetryFailure: true
staticSecretRenderInterval: ""
# Used to define custom livenessProbe settings
livenessProbe:
# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 2
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 5
# How often (in seconds) to perform the probe
periodSeconds: 2
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 5
# Used to define custom readinessProbe settings
readinessProbe:
# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 2
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 5
# How often (in seconds) to perform the probe
periodSeconds: 2
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 5
# Used to define custom startupProbe settings
startupProbe:
# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 12
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 5
# How often (in seconds) to perform the probe
periodSeconds: 5
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 5
# Mount Path of the Vault Kubernetes Auth Method.
authPath: "auth/kubernetes"
# Configures the log verbosity of the injector.
# Supported log levels include: trace, debug, info, warn, error
logLevel: "info"
# Configures the log format of the injector. Supported log formats: "standard", "json".
logFormat: "standard"
# Configures all Vault Agent sidecars to revoke their token when shutting down
revokeOnShutdown: false
webhook:
# Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
# API Tag of the WebHook.
# To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
#
failurePolicy: Ignore
# matchPolicy specifies the approach to accepting changes based on the rules of
# the MutatingWebhookConfiguration.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
# for more details.
#
matchPolicy: Exact
# timeoutSeconds is the amount of seconds before the webhook request will be ignored
# or fails.
# If it is ignored or fails depends on the failurePolicy
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
# for more details.
#
timeoutSeconds: 30
# namespaceSelector is the selector for restricting the webhook to only
# specific namespaces.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
# for more details.
# Example:
# namespaceSelector:
# matchLabels:
# sidecar-injector: enabled
namespaceSelector: {}
# objectSelector is the selector for restricting the webhook to only
# specific labels.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
# for more details.
# Example:
# objectSelector:
# matchLabels:
# vault-sidecar-injector: enabled
# Extra annotations to attach to the webhook
annotations: {}
# Deprecated: please use 'webhook.failurePolicy' instead
# Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
# API Tag of the WebHook.
# To block pod creation while webhook is unavailable, set the policy to `Fail` below.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
#
failurePolicy: Ignore
# Deprecated: please use 'webhook.namespaceSelector' instead
# namespaceSelector is the selector for restricting the webhook to only
# specific namespaces.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
# for more details.
# Example:
# namespaceSelector:
# matchLabels:
# sidecar-injector: enabled
namespaceSelector: {}
# Deprecated: please use 'webhook.objectSelector' instead
# objectSelector is the selector for restricting the webhook to only
# specific labels.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
# for more details.
# Example:
# objectSelector:
# matchLabels:
# vault-sidecar-injector: enabled
objectSelector: {}
# Deprecated: please use 'webhook.annotations' instead
# Extra annotations to attach to the webhook
webhookAnnotations: {}
certs:
# secretName is the name of the secret that has the TLS certificate and
# private key to serve the injector webhook. If this is null, then the
# injector will default to its automatic management mode that will assign
# a service account to the injector to generate its own certificates.
secretName: null
# caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
# that signed the TLS certificate that the webhook serves. This must be set
# if secretName is non-null unless an external service like cert-manager is
# keeping the caBundle updated.
caBundle: ""
# certName and keyName are the names of the files within the secret for
# the TLS cert and private key, respectively. These have reasonable
# defaults but can be customized if necessary.
certName: tls.crt
keyName: tls.key
securityContext:
pod: {}
container: {}
resources: {}
# extraEnvironmentVars is a list of extra environment variables to set in the
# injector deployment.
extraEnvironmentVars: {}
# KUBERNETES_SERVICE_HOST: kubernetes.default.svc
topologySpreadConstraints: []
tolerations: []
nodeSelector: {}
priorityClassName: ""
annotations: {}
extraLabels: {}
hostNetwork: false
service:
# Extra annotations to attach to the injector service
annotations: {}
# Injector serviceAccount specific config
serviceAccount:
# Extra annotations to attach to the injector serviceAccount
annotations: {}
# A disruption budget limits the number of pods of a replicated application
# that are down simultaneously from voluntary disruptions
podDisruptionBudget: {}
# podDisruptionBudget:
# maxUnavailable: 1
# strategy for updating the deployment. This can be a multi-line string or a
# YAML map.
strategy: {}
# strategy: |
# rollingUpdate:
# maxSurge: 25%
# maxUnavailable: 25%
# type: RollingUpdate
server:
enabled: true
enterpriseLicense:
# The name of the Kubernetes secret that holds the enterprise license. The
# secret must be in the same namespace that Vault is installed into.
secretName: ""
# The key within the Kubernetes secret that holds the enterprise license.
secretKey: "license"
image:
repository: "{{ .Modules.SecretsStorage.Server.Image }}"
tag: "{{ .Modules.SecretsStorage.Server.Tag }}"
# Overrides the default Image Pull Policy
pullPolicy: IfNotPresent
updateStrategyType: "RollingUpdate"
# Supported log levels include: trace, debug, info, warn, error
logLevel: ""
# Supported log formats include: standard, json
logFormat: ""
resources: {}
hostAliases: []
# - ip: 127.0.0.1
# hostnames:
# - chart-example.local
route:
enabled: false
# When HA mode is enabled and K8s service registration is being used,
# configure the route to point to the Vault active service.
activeService: true
labels: {}
annotations: {}
host: chart-example.local
# tls will be passed directly to the route's TLS config, which
# can be used to configure other termination methods that terminate
# TLS at the router
tls:
termination: passthrough
# authDelegator enables a cluster role binding to be attached to the service
# account. This cluster role binding can be used to setup Kubernetes auth
# method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
authDelegator:
enabled: true
extraInitContainers: null
extraContainers: null
shareProcessNamespace: false
extraArgs: ""
extraPorts: null
# - containerPort: 8300
# name: http-monitoring
readinessProbe:
enabled: false
# If you need to use a http path instead of the default exec
# path: /v1/sys/health?standbyok=true
# Port number on which readinessProbe will be checked.
port: 8200
# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 2
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 5
# How often (in seconds) to perform the probe
periodSeconds: 5
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 3
# Used to enable a livenessProbe for the pods
livenessProbe:
enabled: false
# Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
execCommand: []
# - /bin/sh
# - -c
# - /vault/userconfig/mylivenessscript/run.sh
# Path for the livenessProbe to use httpGet as the livenessProbe handler
path: "/v1/sys/health?standbyok=true"
# Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
port: 8200
# When a probe fails, Kubernetes will try failureThreshold times before giving up
failureThreshold: 2
# Number of seconds after the container has started before probe initiates
initialDelaySeconds: 60
# How often (in seconds) to perform the probe
periodSeconds: 5
# Minimum consecutive successes for the probe to be considered successful after having failed
successThreshold: 1
# Number of seconds after which the probe times out.
timeoutSeconds: 3
terminationGracePeriodSeconds: 10
# Used to set the sleep time during the preStop step
preStopSleepSeconds: 5
extraEnvironmentVars: {}
extraSecretEnvironmentVars: []
extraVolumes: []
volumes: null
volumeMounts: null
topologySpreadConstraints: []
tolerations: []
nodeSelector: {}
# Enables network policy for server pods
networkPolicy:
enabled: false
egress: []
# egress:
# - to:
# - ipBlock:
# cidr: 10.0.0.0/24
# ports:
# - protocol: TCP
# port: 443
ingress:
- from:
- namespaceSelector: {}
ports:
- port: 8200
protocol: TCP
- port: 8201
protocol: TCP
priorityClassName: ""
extraLabels: {}
annotations: {}
service:
enabled: true
# Enable or disable the vault-active service, which selects Vault pods that
# have labeled themselves as the cluster leader with `vault-active: "true"`.
active:
enabled: true
# Extra annotations for the service definition. This can either be YAML or a
# YAML-formatted multi-line templated string map of the annotations to apply
# to the active service.
annotations: {}
# Enable or disable the vault-standby service, which selects Vault pods that
# have labeled themselves as a cluster follower with `vault-active: "false"`.
standby:
enabled: true
# Extra annotations for the service definition. This can either be YAML or a
# YAML-formatted multi-line templated string map of the annotations to apply
# to the standby service.
annotations: {}
# When disabled, services may select Vault pods not deployed from the chart.
# Does not affect the headless vault-internal service with `ClusterIP: None`
instanceSelector:
enabled: true
# clusterIP controls whether a Cluster IP address is attached to the
# Vault service within Kubernetes. By default, the Vault service will
# be given a Cluster IP address, set to None to disable. When disabled
# Kubernetes will create a "headless" service. Headless services can be
# used to communicate with pods directly through DNS instead of a round-robin
# load balancer.
# clusterIP: None
# Configures the service type for the main Vault service. Can be ClusterIP
# or NodePort.
#type: ClusterIP
# The IP family and IP families options are to set the behaviour in a dual-stack environment.
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
# should be.
# These are only supported for kubernetes versions >=1.23.0
#
# Configures the service's supported IP family policy, can be either:
# SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
# PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
# RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
ipFamilyPolicy: ""
# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
# Can be IPv4 and/or IPv6.
ipFamilies: []
# Do not wait for pods to be ready before including them in the services'
# targets. Does not apply to the headless service, which is used for
# cluster-internal communication.
publishNotReadyAddresses: true
# The externalTrafficPolicy can be set to either Cluster or Local
# and is only valid for LoadBalancer and NodePort service types.
# The default value is Cluster.
# ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
externalTrafficPolicy: Cluster
# If type is set to "NodePort", a specific nodePort value can be configured,
# will be random if left blank.
#nodePort: 30000
# When HA mode is enabled
# If type is set to "NodePort", a specific nodePort value can be configured,
# will be random if left blank.
#activeNodePort: 30001
# When HA mode is enabled
# If type is set to "NodePort", a specific nodePort value can be configured,
# will be random if left blank.
#standbyNodePort: 30002
# Port on which Vault server is listening
port: 8200
# Target port to which the service should be mapped to
targetPort: 8200
# Extra annotations for the service definition. This can either be YAML or a
# YAML-formatted multi-line templated string map of the annotations to apply
# to the service.
annotations: {}
dataStorage:
enabled: true
size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }}
mountPath: "/vault/data"
storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }}
accessMode: ReadWriteOnce
annotations: {}
labels: {}
persistentVolumeClaimRetentionPolicy: {}
# required for ha installation
auditStorage:
enabled: false
# Size of the PVC created
size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }}
# Location where the PVC will be mounted.
mountPath: "/vault/audit"
# Name of the storage class to use. If null it will use the
# configured default Storage Class.
storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }}
# Access Mode of the storage device being used for the PVC
accessMode: ReadWriteOnce
# Annotations to apply to the PVC
annotations: {}
# Labels to apply to the PVC
labels: {}
dev:
enabled: false
# Set VAULT_DEV_ROOT_TOKEN_ID value
devRootToken: "root"
# Run Vault in "standalone" mode. This is the default mode that will deploy if
# no arguments are given to helm. This requires a PVC for data storage to use
# the "file" backend. This mode is not highly available and should not be scaled
# past a single replica.
standalone:
enabled: "-"
# config is a raw string of default configuration when using a Stateful
# deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
# and store data there. This is only used when using a Replica count of 1, and
# using a stateful set. This should be HCL.
# Note: Configuration files are stored in ConfigMaps so sensitive data
# such as passwords should be either mounted through extraSecretEnvironmentVars
# or through a Kube secret. For more information see:
# https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
config: |
ui = true
listener "tcp" {
tls_disable = 1
address = "[::]:8200"
cluster_address = "[::]:8201"
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
telemetry {
unauthenticated_metrics_access = "true"
}
{{- end }}
}
storage "file" {
path = "/vault/data"
}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
telemetry {
prometheus_retention_time = "30s"
disable_hostname = true
}
{{- end }}
# Run Vault in "HA" mode. There are no storage requirements unless the audit log
# persistence is required. In HA mode Vault will configure itself to use Consul
# for its storage backend. The default configuration provided will work the Consul
# Helm project by default. It is possible to manually configure Vault to use a
# different HA backend.
ha:
enabled: false
replicas: 3
# Set the api_addr configuration for Vault HA
# See https://developer.hashicorp.com/vault/docs/configuration#api_addr
# If set to null, this will be set to the Pod IP Address
apiAddr: null
# Set the cluster_addr confuguration for Vault HA
# See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
clusterAddr: null
# Enables Vault's integrated Raft storage. Unlike the typical HA modes where
# Vault's persistence is external (such as Consul), enabling Raft mode will create
# persistent volumes for Vault to store data according to the configuration under server.dataStorage.
# The Vault cluster will coordinate leader elections and failovers internally.
raft:
# Enables Raft integrated storage
enabled: false
# Set the Node Raft ID to the name of the pod
setNodeId: false
config: |
ui = true
listener "tcp" {
tls_disable = 1
address = "[::]:8200"
cluster_address = "[::]:8201"
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
telemetry {
unauthenticated_metrics_access = "true"
}
{{- end }}
}
storage "raft" {
path = "/vault/data"
}
service_registration "kubernetes" {}
# config is a raw string of default configuration when using a Stateful
# deployment. Default is to use a Consul for its HA storage backend.
# This should be HCL.
# Note: Configuration files are stored in ConfigMaps so sensitive data
# such as passwords should be either mounted through extraSecretEnvironmentVars
# or through a Kube secret. For more information see:
# https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
config: |
ui = true
listener "tcp" {
tls_disable = 1
address = "[::]:8200"
cluster_address = "[::]:8201"
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
telemetry {
unauthenticated_metrics_access = "true"
}
{{- end }}
}
storage "consul" {
path = "vault"
address = "HOST_IP:8500"
}
service_registration "kubernetes" {}
# Example configuration for using auto-unseal, using Google Cloud KMS. The
# GKMS keys must already exist, and the cluster must have a service account
# that is authorized to access GCP KMS.
#seal "gcpckms" {
# project = "vault-helm-dev-246514"
# region = "global"
# key_ring = "vault-helm-unseal-kr"
# crypto_key = "vault-helm-unseal-key"
#}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
telemetry {
prometheus_retention_time = "30s"
disable_hostname = true
}
{{- end }}
# A disruption budget limits the number of pods of a replicated application
# that are down simultaneously from voluntary disruptions
disruptionBudget:
enabled: true
# maxUnavailable will default to (n/2)-1 where n is the number of
# replicas. If you'd like a custom value, you can specify an override here.
maxUnavailable: null
serviceAccount:
create: true
name: ""
createSecret: false
annotations: {}
extraLabels: {}
serviceDiscovery:
enabled: true
statefulSet:
annotations: {}
securityContext:
pod: {}
container: {}
hostNetwork: false
# Vault UI
ui:
enabled: true
domain: {{ .Modules.SecretsStorage.Expose.Domain }}
path: {{ .Modules.SecretsStorage.Expose.Path }}
publishNotReadyAddresses: true
# The service should only contain selectors for active Vault pod
activeVaultPodOnly: false
{{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }}
serviceType: "NodePort"
serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }}
{{- else }}
serviceType: "ClusterIP"
serviceNodePort: null
{{- end }}
externalPort: 8200
targetPort: 8200
serviceIPFamilyPolicy: ""
serviceIPFamilies: []
externalTrafficPolicy: Cluster
#loadBalancerSourceRanges:
# - 10.0.0.0/16
# - 1.78.23.3/32
# loadBalancerIP:
annotations: {}
csi:
# True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
#
# Requires installing the secrets-store-csi-driver separately, see:
# https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
#
# With the driver and provider installed, you can mount Vault secrets into volumes
# similar to the Vault Agent injector, and you can also sync those secrets into
# Kubernetes secrets.
enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }}
image:
repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}"
tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}"
pullPolicy: IfNotPresent
volumes: null
volumeMounts: null
resources: {}
# Override the default secret name for the CSI Provider's HMAC key used for
# generating secret versions.
hmacSecretName: ""
daemonSet:
updateStrategy:
type: RollingUpdate
maxUnavailable: ""
# Extra annotations for the daemonSet. This can either be YAML or a
# YAML-formatted multi-line templated string map of the annotations to apply
# to the daemonSet.
annotations: {}
# Provider host path (must match the CSI provider's path)
providersDir: "/etc/kubernetes/secrets-store-csi-providers"
# Kubelet host path
kubeletRootDir: "/var/lib/kubelet"
# Extra labels to attach to the vault-csi-provider daemonSet
# This should be a YAML map of the labels to apply to the csi provider daemonSet
extraLabels: {}
# security context for the pod template and container in the csi provider daemonSet
securityContext:
pod: {}
container: {}
pod:
annotations: {}
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
- key: node-role.kubernetes.io/control-plane
effect: NoSchedule
nodeSelector: {}
affinity: {}
extraLabels: {}
agent:
enabled: true
extraArgs: []
image:
repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
pullPolicy: IfNotPresent
logFormat: standard
logLevel: info
resources: {}
priorityClassName: ""
serviceAccount:
annotations: {}
extraLabels: {}
readinessProbe:
enabled: true
failureThreshold: 2
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3
livenessProbe:
failureThreshold: 2
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3
debug: false
extraArgs: []
serverTelemetry:
# Enable support for the Prometheus Operator. Currently, this chart does not support
# authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
# in the `listener "tcp"{}` stanza
# telemetry {
# unauthenticated_metrics_access = "true"
# }
#
# See the `standalone.config` for a more complete example of this.
#
# In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
#
# example:
# telemetry {
# prometheus_retention_time = "30s"
# disable_hostname = true
# }
#
# Configuration for monitoring the Vault server.
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
selectors: {}
interval: 30s
scrapeTimeout: 10s
prometheusRules:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
selectors: {}
rules: []
ingress:
{{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
enabled: true
{{- end }}
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
{{- end }}
tls:
{{- if .Modules.SecretsStorage.Expose.Tls.Enabled }}
enabled: true
{{- end }}
hosts:
- host: {{ .Modules.SecretsStorage.Expose.Domain }}
secretName: vault-tls

6
internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl
View File

@@ -135,7 +135,5 @@ unsafe_show_logs: false
## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
allow_unsupported_distribution_setup: false
## Containerd settings
# containerd_metadata_root_dir: /app/lib/containerd
# The state directory for containerd
# containerd_state_dir: /app/run/containerd
## Kubelet additional settings
kubelet_custom_flags: "--root-dir={{ .Orchestrator.KubeletDir }}"

60
internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl Normal file
View File

@@ -0,0 +1,60 @@
---
# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
containerd_storage_dir: {{ .Orchestrator.ContainerEngine.DataDir }}
containerd_state_dir: {{ .Orchestrator.ContainerEngine.StateDir }}
# containerd_oom_score: 0
# containerd_default_runtime: "runc"
# containerd_snapshotter: "native"
# containerd_runc_runtime:
# name: runc
# type: "io.containerd.runc.v2"
# engine: ""
# root: ""
# containerd_additional_runtimes:
# Example for Kata Containers as additional runtime:
# - name: kata
# type: "io.containerd.kata.v2"
# engine: ""
# root: ""
# containerd_grpc_max_recv_message_size: 16777216
# containerd_grpc_max_send_message_size: 16777216
# Containerd debug socket location: unix or tcp format
# containerd_debug_address: ""
# Containerd log level
# containerd_debug_level: "info"
# Containerd logs format, supported values: text, json
# containerd_debug_format: ""
# Containerd debug socket UID
# containerd_debug_uid: 0
# Containerd debug socket GID
# containerd_debug_gid: 0
# containerd_metrics_address: ""
# containerd_metrics_grpc_histogram: false
# Registries defined within containerd.
# containerd_registries_mirrors:
# - prefix: docker.io
# mirrors:
# - host: https://registry-1.docker.io
# capabilities: ["pull", "resolve"]
# skip_verify: false
# containerd_max_container_log_line_size: -1
# containerd_registry_auth:
# - registry: 10.0.0.2:5000
# username: user
# password: pass

8
internal/resources/templates/secrets-storage/vault-keys.json.tmpl
View File

@@ -1,8 +0,0 @@
{
"keys": [
{{- range $index, $key := .Modules.SecretsStorage.UnsealKeys }}
"{{ $key }}",
{{- end }}
],
"root_token": "{{ .Modules.SecretsStorage.AuthToken }}"
}

130
internal/secrets_storage/commands.go
View File

@@ -1,130 +0,0 @@
package secrets_storage
import (
"fmt"
"kube-forge/internal/config"
"kube-forge/internal/kubernetes_client"
"kube-forge/internal/logging"
"kube-forge/internal/templates"
"regexp"
"strings"
)
func initVault() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil {
logging.Log.Error(err.Error())
return
}
err = commandToInitVault()
if err != nil {
logging.Log.Warn(err.Error())
return
}
logging.Log.Info("Vault initialized")
templates.ApplyVaultInitKeysTemplate()
}
func addKubernetesLocalIntegration() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil {
logging.Log.Error(err.Error())
return
}
err = commandToAddKubernetesLocalIntegration()
if err != nil {
logging.Log.Error(err.Error())
return
}
logging.Log.Info("Vault local Kubernetes integration added")
}
func unsealVault() {
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
if err != nil {
logging.Log.Error(err.Error())
return
}
commandToUnsealVault()
}
func commandToInitVault() error {
config := config.GetConfig()
commandArray := []string{
"vault", "operator", "init",
fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
}
output, err := kubernetes_client.ExecuteCommandInPodContainer(
commandArray, "secrets-storage", "vault-0", "vault",
)
if err != nil && strings.Contains(output, "Vault is already initialized") {
return VaultAlreadyInitialised
}
unsealKeys, rootToken := parseVaultInitKeys(output)
config.Modules.SecretsStorage.UnsealKeys = unsealKeys
config.Modules.SecretsStorage.AuthToken = rootToken
return nil
}
func parseVaultInitKeys(input string) ([]string, string) {
unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
var unsealKeys []string
for _, match := range unsealKeysMatches {
unsealKeys = append(unsealKeys, match[1])
}
rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
rootToken := rootTokenMatches[1]
return unsealKeys, rootToken
}
func commandToUnsealVault() {
config := config.GetConfig()
for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
commandArray := []string{"vault", "operator", "unseal", unsealKey}
kubernetes_client.ExecuteCommandInPodContainer(
commandArray, "secrets-storage", "vault-0", "vault",
)
}
logging.Log.Info("Vault unsealed")
}
func commandToAddKubernetesLocalIntegration() error {
config := config.GetConfig()
commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
output, err := kubernetes_client.ExecuteCommandInPodContainer(
commandArray, "secrets-storage", "vault-0", "vault",
)
if err != nil && strings.Contains(output, "permission denied") {
return IncorrectCredentials
}
commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
output, err = kubernetes_client.ExecuteCommandInPodContainer(
commandArray, "secrets-storage", "vault-0", "vault",
)
kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
"KUBERNETES_PORT_443_TCP_ADDR",
"secrets-storage",
"vault-0",
"vault",
)
if err != nil {
return err
}
commandArray = []string{
"vault", "write", "auth/kubernetes-local/config",
fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
}
output, err = kubernetes_client.ExecuteCommandInPodContainer(
commandArray, "secrets-storage", "vault-0", "vault",
)
return nil
}

6
internal/secrets_storage/errors.go
View File

@@ -1,6 +0,0 @@
package secrets_storage
import "errors"
var VaultAlreadyInitialised = errors.New("Vault already initialised")
var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!")

44
internal/secrets_storage/helm.go
View File

@@ -1,44 +0,0 @@
package secrets_storage
import (
"kube-forge/internal/config"
"kube-forge/internal/helm_client"
"kube-forge/internal/templates"
"time"
go_helm_client "github.com/mittwald/go-helm-client"
)
var HELM_REPOS = []config.RepoSettings{
{
Name: "kube-forge",
URL: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
},
}
func getVaultSpec() go_helm_client.ChartSpec {
appConfig := config.GetConfig()
return go_helm_client.ChartSpec{
ReleaseName: "vault",
ChartName: appConfig.Modules.SecretsStorage.ChartRef,
Version: appConfig.Modules.SecretsStorage.ChartVersion,
Namespace: appConfig.Modules.SecretsStorage.Namespace,
CreateNamespace: true,
Atomic: true,
Timeout: time.Second * 600,
ValuesYaml: templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"),
}
}
func ApplyCharts() {
appConfig := config.GetConfig()
helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS)
if appConfig.Modules.SecretsStorage.Enabled {
helm_client.InstallChart(getVaultSpec())
initVault()
unsealVault()
addKubernetesLocalIntegration()
} else {
helm_client.DeleteChart(getVaultSpec())
}
}

1
internal/templates/kubespray.go
View File

@@ -5,6 +5,7 @@ var K8S_TEMPLATES = [...][2]string{
{"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"},
{"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"},
{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"},
{"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"},
}
func ApplyK8sTemplates() {