update kube-forge concept and add ability to change data dir for containerd

.gitlab-ci.yml

@@ -1,173 +0,0 @@
-variables:
-  DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge
-
-  KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug
-  KANIKO_CONTEXT: ${CI_PROJECT_DIR}
-  RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0
-  CICD_MULTITOOL: harbor.kvazaric.ru/postgres-tasks/cicd-multitool:2.4
-  BINARY_BUILDER_IMAGE: harbor.kvazaric.ru/mirror/library/golang:alpine
-
-  PREPARE_RELEASE:
-    options:
-      - "No"
-      - "Yes"
-    value: "No"
-    description: Create release from this build?
-
-  WITHOUT_BUILD:
-    options:
-      - "No"
-      - "Yes"
-    value: "Yes"
-    description: Create release without building?
-
-stages:
-  - prepare
-  - build
-  - release
-
-make-version-name:
-  stage: prepare
-  image:
-    name: ${CICD_MULTITOOL}
-    entrypoint: [""]
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  script:
-    - echo "VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)" > version.env
-  artifacts:
-    reports:
-      dotenv: version.env
-
-build-docker:
-  variables:
-    DOCKERFILE_PATH: Dockerfile
-    IMAGE_DESTINATION: image
-  stage: build
-  image:
-    name: ${KANIKO_IMAGE}
-    entrypoint: [""]
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  before_script:
-    - mkdir -p /kaniko/.docker
-    - echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json
-  script:
-    - |
-      /kaniko/executor --context "${KANIKO_CONTEXT}" \
-        --dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \
-        --destination "${DOCKER_IMAGE}:${VERSION}-${CI_COMMIT_SHORT_SHA}"
-  dependencies:
-    - make-version-name
-  needs:
-    - make-version-name
-  rules:
-    - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
-      when: never
-    - changes:
-        - build/docker/**/*
-        - cmd/**/*
-        - internal/**/*
-        - kubespray/**/*
-        - go.sum
-        - go.mod
-        - requirements.txt
-        - ansible.cfg
-      if: $CI_COMMIT_REF_NAME =~ /^(master)$/
-      when: always
-
-build-binary:
-  stage: build
-  image:
-    name: ${BINARY_BUILDER_IMAGE}
-    entrypoint: [""]
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  script:
-    - CGO_ENABLED=0 GOOS=linux  go build -v -o kube-forge ./cmd/main/main.go
-  artifacts:
-    paths:
-      - ${CI_PROJECT_DIR}/kube-forge
-  rules:
-    - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
-      when: never
-    - changes:
-        - build/docker/**/*
-        - cmd/**/*
-        - internal/**/*
-        - kubespray/**/*
-        - go.sum
-        - go.mod
-        - requirements.txt
-        - ansible.cfg
-      if: $CI_COMMIT_REF_NAME =~ /^(master)$/
-      when: always
-
-prepare-tarball:
-  stage: build
-  image: ${CICD_MULTITOOL}
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  script:
-    - mkdir archive
-    - cp kube-forge archive
-    - cp requirements.txt archive
-    - cp -R kubespray archive
-    - tar zcvf kube-forge-${VERSION}-${CI_COMMIT_SHORT_SHA}.tar.gz archive
-  dependencies:
-    - make-version-name
-    - build-binary
-  needs:
-    - make-version-name
-    - build-binary
-  artifacts:
-    paths:
-      - ${CI_PROJECT_DIR}/kube-forge-${VERSION}-${CI_COMMIT_SHORT_SHA}.tar.gz
-  rules:
-    - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
-      when: never
-    - changes:
-        - build/docker/**/*
-        - cmd/**/*
-        - internal/**/*
-        - kubespray/**/*
-        - go.sum
-        - go.mod
-        - requirements.txt
-        - ansible.cfg
-      if: $CI_COMMIT_REF_NAME =~ /^(master)$/
-      when: always
-
-make-release:
-  stage: release
-  image: ${RELEASE_CLI_IMAGE}
-  dependencies:
-    - make-version-name
-  needs:
-    - make-version-name
-  tags:
-    - build
-    - docker
-  rules:
-    - if: $PREPARE_RELEASE == "Yes"
-  script:
-    - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)
-    - echo "Preparing release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
-  release: # See https://docs.gitlab.com/ee/ci/yaml/#release for available properties
-    name: kube-forge:${VERSION}-${CI_COMMIT_SHORT_SHA}
-    tag_name: "${VERSION}-${CI_COMMIT_SHORT_SHA}"
-    description: "Kube-forge release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
-    assets:
-      links:
-        - name: "Docker image"
-          url: "https://harbor.kvazaric.ru/harbor/projects/4/repositories/kube-forge/artifacts-tab"
-          link_type: "image"
-  when: on_success

README.md

@@ -8,12 +8,10 @@
 
 ```shell
 touch k8s-admin.conf
-touch vault-keys.json
 
 docker run -v $(pwd)/config.yaml:/application/config.yaml \
   -v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \
   --mount type=bind,source=$(pwd)/k8s-admin.conf,target=/application/k8s-admin.conf \
-  --mount type=bind,source=$(pwd)/vault-keys.json,target=/application/vault-keys.json \
   harbor.kvazaric.ru/kube-forge/kube-forge:1.1-f84c27e6 apply
 ```
 

build/README.md

@@ -1,5 +0,0 @@
-## Сборка Docker
-
-## Сборка Linux
-
-### Debian

build/debian/DEBIAN/control

@@ -1,5 +0,0 @@
-Package: kube-forge
-Version: 1.0
-Architecture: amd64
-Maintainer: Kvazaric <kvazaric.official@gmail.com>
-Description: A program to install Kubernetes-based platform  to facilitate the development, desting and dperation of Ccntainerized applications

build/version.txt

@@ -1 +0,0 @@
-1.1

cmd/main/main.go

@@ -3,14 +3,10 @@ package main
 import (
 	"flag"
 	"kube-forge/internal/additional"
-	"kube-forge/internal/cicd"
 	"kube-forge/internal/config"
 	"kube-forge/internal/csi"
 	"kube-forge/internal/kubespray"
 	"kube-forge/internal/logging"
-	"kube-forge/internal/observability"
-	"kube-forge/internal/registry"
-	"kube-forge/internal/secrets_storage"
 	"kube-forge/internal/templates"
 	"os"
 )
@@ -18,10 +14,6 @@ import (
 func installAndConfigureModules() {
 	csi.ApplyCharts()
 	additional.ApplyCharts()
-	registry.ApplyCharts()
-	secrets_storage.ApplyCharts()
-	cicd.ApplyCharts()
-	observability.ApplyCharts()
 }
 
 func main() {
@@ -53,7 +45,10 @@ func main() {
 		case "scale":
 			kubespray.ScaleCluster()
 			return
+		case "reset":
+			kubespray.ResetCluster()
+			return
 		}
 	}
-	logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
+	logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale, reset")
 }

config.sample.yaml

@@ -1,23 +1,36 @@
 credentials:
   user: sre-admin
   ask_sudo_password: false
-  private_key_file: /home/sre-admin/.ssh/id_rsa
+  private_key_file: /Users/georgest/.ssh/id_rsa_bastion_ift
 
 hosts:
-  - hostname: vbox-prod-k8s-master-01
+  - hostname: t1-disk-lt-k8s-test-master-01
-    ip: "10.250.50.22"
+    ip: "10.100.20.49"
     roles: [control_plane, etcd]
-  - hostname: vbox-prod-k8s-slave-01
+
-    ip: "10.250.50.23"
+  - hostname: t1-disk-lt-k8s-test-slave-01
+    ip: "10.100.20.48"
     roles: [node]
-  - hostname: vbox-prod-k8s-slave-02
+
-    ip: "10.250.50.21"
+  - hostname: t1-disk-lt-k8s-test-slave-02
+    ip: "10.100.20.47"
     roles: [node]
 
 orchestrator:
   version: v1.29.0
+  cluster_name: cluster.local
+  kubelet_dir: "/var/lib/kubelet"
   container_engine:
     install: true
+    type: "containerd"
+    data_dir: "/var/lib/containerd"
+    state_dir: "/run/containerd"
+  dns:
+    servers:
+      - 8.8.8.8
+      - 8.8.4.4
+      - 1.1.1.1
+    disable_host_nameservers: false
   ping_access_ip: true
   auto_renew_certificates: true
   pod_security_policy_enabled: true
@@ -28,103 +41,12 @@ orchestrator:
       skip_verify: false
 
 modules:
-  admin_password: changeit
-  observability:
-    enabled: true
-    logging:
-      enabled: true
-      events:
-        enabled: true
-    tracing:
-      enabled: true
-    monitoring:
-      enabled: true
-      alert_manager:
-        enabled: true
-        route:
-          receiver: kvazaric_notifications
-          group_wait: 1s
-          repeat_interval: 180m
-          routes:
-            - receiver: "kvazaric_notifications"
-              group_by: ["alertname"]
-              group_wait: 1s
-              repeat_interval: 8737h
-              matchers:
-                - fireOnce=true
-        receivers:
-          - name: kvazaric_notifications
-            telegram_configs:
-              - send_resolved: true
-                api_url: https://api.telegram.org
-                bot_token: bot_token
-                chat_id: -10000
-                parse_mode: HTML
-                message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
-                http_config:
-                  follow_redirects: true
-                  enable_http2: false
-      blackbox:
-        enabled: true
-      kube_state:
-        enabled: true
-      node:
-        enabled: true
-    visualization:
-      enabled: true
-      grafana:
-        enabled: true
-        expose:
-          type: ingress # ingress or NodePort
-          domain: grafana.disk.lt.t1.cloud
-          # path: "/grafana"
-          tls:
-            enabled: true
-
-  cicd:
-    enabled: true
-    argo_cd:
-      expose:
-        type: ingress # ingress or NodePort
-        domain: argocd.disk.lt.t1.cloud
-        # path: "/cicd"
-        tls:
-          enabled: true
-    rollouts:
-      enabled: true
-    updates_operator:
-      enabled: true
-
-  secrets_storage:
-    enabled: true
-    key_shares: 5
-    key_threshold: 3
-    expose:
-      type: ingress # ingress or NodePort
-      domain: vault.disk.lt.t1.cloud
-      tls:
-        enabled: true
-    csi_integration:
-      enabled: true
-
-  registry:
-    enabled: true
-    expose:
-      type: ingress # ingress or nodePort
-      domain: harbor.disk.lt.t1.cloud
-    tls:
-      enabled: true
-    enabled_scanner: true
-
   additional:
     cert_manager:
       enabled: true
-      account_email: adminmail@gmail.com
+      account_email: g.stykalin@rockitsoft.ru
-    ingress:
-      enabled: true
-      host_network: true
     storage:
       longhorn:
-        enabled: true
+        enabled: false
       secrets_store_csi_driver:
-        enabled: true
+        enabled: false

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/BurntSushi/toml v1.3.2
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/apenella/go-ansible v1.3.0
-	github.com/apenella/go-ansible/v2 v2.0.0
+	github.com/apenella/go-ansible/v2 v2.0.1
 	github.com/ilyakaznacheev/cleanenv v1.5.0
 	github.com/mittwald/go-helm-client v0.12.9
 	github.com/sirupsen/logrus v1.9.3

go.sum

@@ -28,8 +28,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/apenella/go-ansible v1.3.0 h1:INNaVzrgQMNIO9Yvnly6lA5KfN/pY3m1Z37gpmlUzPM=
 github.com/apenella/go-ansible v1.3.0/go.mod h1:qiLWolQqLkCoqFlPvdsKhxk7O0qjIBCPNhUKpH/vjaU=
-github.com/apenella/go-ansible/v2 v2.0.0 h1:9aZkU8dQ2fVITYX5V1CiQ3VX4PnNPBTgv31wJFd2Ito=
+github.com/apenella/go-ansible/v2 v2.0.1 h1:9o3805u4NAIMf1px5EKpRS2LEa2aeQbMtHB7vilt7XE=
-github.com/apenella/go-ansible/v2 v2.0.0/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
+github.com/apenella/go-ansible/v2 v2.0.1/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
 github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df h1:sEikY2P+NZK/7VZUwIsnXIGElhsuFDSxh1bZYwHxdcI=
 github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df/go.mod h1:cLVL6GjUiKG/WyBzX+KD6h/XRV/HnNZIZbMNNiBgQ9o=
 github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df h1:SvlYbjlsSQDS7hbVT1h012/zdgvcwWJ+Yd9XRiiY/8s=

internal/cicd/helm.go

@@ -1,108 +0,0 @@
-package cicd
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/helm_client"
-	"kube-forge/internal/templates"
-	"time"
-
-	go_helm_client "github.com/mittwald/go-helm-client"
-)
-
-var HELM_REPOS = [...]config.RepoSettings{
-	{
-		Name: "kube-forge",
-		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
-	},
-}
-
-func getArgoCdSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "argo-cd",
-		ChartName:       appConfig.Modules.Cicd.ArgoCd.ChartRef,
-		Version:         appConfig.Modules.Cicd.ArgoCd.ChartVersion,
-		Namespace:       appConfig.Modules.Cicd.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"),
-	}
-}
-
-func getArgoRolloutsSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "argo-rollouts",
-		ChartName:       appConfig.Modules.Cicd.Rollouts.ChartRef,
-		Version:         appConfig.Modules.Cicd.Rollouts.ChartVersion,
-		Namespace:       appConfig.Modules.Cicd.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"),
-	}
-}
-
-func getKeelSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "keel",
-		ChartName:       appConfig.Modules.Cicd.UpdatesOperator.ChartRef,
-		Version:         appConfig.Modules.Cicd.UpdatesOperator.ChartVersion,
-		Namespace:       appConfig.Modules.Cicd.UpdatesOperator.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"),
-	}
-}
-
-func getArgoCdIngressSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "argo-cd-ingress",
-		ChartName:       appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef,
-		Version:         appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion,
-		Namespace:       appConfig.Modules.Cicd.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"),
-	}
-}
-
-func addCicdHelmRepos() {
-	appConfig := config.GetConfig()
-	for _, repoSettings := range HELM_REPOS {
-		helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings)
-	}
-}
-
-func ApplyCharts() {
-	addCicdHelmRepos()
-	appConfig := config.GetConfig()
-	if appConfig.Modules.Cicd.Enabled {
-		helm_client.InstallChart(getArgoCdSpec())
-		if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" {
-			helm_client.InstallChart(getArgoCdIngressSpec())
-		} else {
-			helm_client.DeleteChart(getArgoCdIngressSpec())
-		}
-		if appConfig.Modules.Cicd.Rollouts.Enabled {
-			helm_client.InstallChart(getArgoRolloutsSpec())
-		} else {
-			helm_client.DeleteChart(getArgoRolloutsSpec())
-		}
-		if appConfig.Modules.Cicd.UpdatesOperator.Enabled {
-			helm_client.InstallChart(getKeelSpec())
-		} else {
-			helm_client.DeleteChart(getKeelSpec())
-		}
-	} else {
-		helm_client.DeleteChart(getArgoCdIngressSpec())
-		helm_client.DeleteChart(getArgoCdSpec())
-		helm_client.DeleteChart(getArgoRolloutsSpec())
-		helm_client.DeleteChart(getKeelSpec())
-	}
-}

internal/config/config.go

@@ -30,13 +30,7 @@ type Config struct {
 	Orchestrator Orchestrator `yaml:"orchestrator"`
 
 	Modules struct {
-		AdminPassword          string         `yaml:"admin_password"`
+		Additional Additional `yaml:"additional"`
-		AdditionalRepositories interface{}    `yaml:"additional_repositories"`
-		Additional             Additional     `yaml:"additional"`
-		Observability          Observability  `yaml:"observability"`
-		Registry               Registry       `yaml:"registry"`
-		Cicd                   Cicd           `yaml:"cicd"`
-		SecretsStorage         SecretsStorage `yaml:"secrets_storage"`
 	} `yaml:"modules"`
 }
 
@@ -54,9 +48,6 @@ func CreateConfig(configPath string, workDir string, password string) *Config {
 	if password != "" {
 		instance.Credentials.Password = password
 	}
-
-	generateCreds(instance)
-
 	return instance
 }
 

internal/config/modules_cicd.go

@@ -1,96 +0,0 @@
-package config
-
-type Cicd struct {
-	Enabled   bool   `yaml:"enabled"`
-	Namespace string `yaml:"namespace" env-default:"cicd"`
-	ArgoCd    struct {
-		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
-		ChartVersion  string `yaml:"chart_version" env-default:"6.7.10"`
-		AdminPassword string
-		Ha            struct {
-			Enabled     bool `yaml:"enabled"`
-			Autoscaling bool `yaml:"autoscaling"`
-		} `yaml:"ha"`
-		Expose struct {
-			Type          string `yaml:"type"`
-			Domain        string `yaml:"domain"`
-			Path          string `yaml:"path" env-default:"/"`
-			NodePortHttp  int    `yaml:"node_port_http" env-default:"30005"`
-			NodePortHttps int    `yaml:"node_port_https" env-default:"30006"`
-			Tls           struct {
-				Enabled bool `yaml:"enabled"`
-			} `yaml:"tls"`
-		} `yaml:"expose"`
-		Repositories interface{} `yaml:"repositories"`
-		Rbac         struct {
-			AdditionalPolicies string `yaml:"additional_policies"`
-		} `yaml:"argo_cd"`
-		ServiceIngress struct {
-			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
-			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
-		} `yaml:"service_ingress"`
-		Global struct {
-			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
-			Tag   string `yaml:"tag" env-default:"latest"`
-		} `yaml:"global"`
-		Server struct {
-			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
-			Tag   string `yaml:"tag" env-default:"latest"`
-		} `yaml:"server"`
-		Redis struct {
-			Image    string `yaml:"image" env-default:"public.ecr.aws/docker/library/redis"`
-			Tag      string `yaml:"tag" env-default:"7.2.4-alpine"`
-			Exporter struct {
-				Image string `yaml:"image" env-default:"public.ecr.aws/bitnami/redis-exporter"`
-				Tag   string `yaml:"tag" env-default:"1.58.0"`
-			} `yaml:"exporter"`
-		} `yaml:"redis"`
-		ApplicationSet struct {
-			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
-			Tag   string `yaml:"tag" env-default:"latest"`
-		} `yaml:"application_set"`
-		Dex struct {
-			Image string `yaml:"image" env-default:"ghcr.io/dexidp/dex"`
-			Tag   string `yaml:"tag" env-default:"v2.38.0"`
-		} `yaml:"dex"`
-		RepoServer struct {
-			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
-			Tag   string `yaml:"tag" env-default:"latest"`
-		} `yaml:"repo_server"`
-		Notifications struct {
-			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
-			Tag   string `yaml:"tag" env-default:"latest"`
-		} `yaml:"notifications"`
-		Controller struct {
-			Image string `yaml:"image" env-default:"quay.io/argoproj/argocd"`
-			Tag   string `yaml:"tag" env-default:"latest"`
-		} `yaml:"controller"`
-	} `yaml:"argo_cd"`
-	UpdatesOperator struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/keel"`
-		ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
-		Enabled      bool   `yaml:"enabled"`
-		Namespace    string `yaml:"namespace" env-default:"kube-system"`
-		Image        string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
-		Tag          string `yaml:"tag" env-default:"latest"`
-	} `yaml:"updates_operator"`
-	Rollouts struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
-		ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
-		Enabled      bool   `yaml:"enabled"`
-		Registry     string `yaml:"registry" env-default:"quay.io"`
-		Repository   string `yaml:"repository" env-default:"argoproj/argo-rollouts"`
-		Tag          string `yaml:"tag" env-default:"latest"`
-		Ha           struct {
-			Enabled bool `yaml:"enabled"`
-		} `yaml:"ha"`
-		Expose struct {
-			Type     string `yaml:"type"`
-			NodePort int    `yaml:"node_port" env-default:"30010"`
-		} `yaml:"expose"`
-		Controller struct {
-		} `yaml:"controller"`
-		Dashboard struct {
-		} `yaml:"dashboard"`
-	} `yaml:"rollouts"`
-}

internal/config/modules_observability.go

@@ -1,179 +0,0 @@
-package config
-
-type Observability struct {
-	ChartRef      string        `yaml:"chart_ref" env-default:"kube-forge/observability"`
-	ChartVersion  string        `yaml:"chart_version" env-default:"0.1.0"`
-	Enabled       bool          `yaml:"enabled"`
-	Logging       Logging       `yaml:"logging"`
-	Tracing       Tracing       `yaml:"tracing"`
-	Monitoring    Monitoring    `yaml:"monitoring"`
-	Visualization Visualization `yaml:"visualization"`
-	Namespace     string        `yaml:"namespace" env-default:"observability"`
-}
-
-type Logging struct {
-	Enabled  bool `yaml:"enabled"`
-	Operator struct {
-		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/fluent-operator"`
-		ChartVersion  string `yaml:"chart_version" env-default:"2.7.0"`
-		Image         string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"`
-		Tag           string `yaml:"tag" env-default:"v2.7.0"`
-		Namespace     string `yaml:"namespace" env-default:"observability"`
-		InitContainer struct {
-			Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"`
-			Tag   string `yaml:"tag" env-default:"20.10"`
-		} `yaml:"initcontainer"`
-	} `yaml:"operator"`
-	Fluentd struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluentd"`
-		Tag   string `yaml:"tag" env-default:"v1.15.3"`
-	} `yaml:"fluentd"`
-	FluentBit struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-bit"`
-		Tag   string `yaml:"tag" env-default:"v2.2.2"`
-	} `yaml:"fluent_bit"`
-	Loki struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/loki"`
-		ChartVersion string `yaml:"chart_version" env-default:"5.47.2"`
-		Registry     string `yaml:"registry" env-default:"harbor.kvazaric.ru"`
-		Image        string `yaml:"image" env-default:"kube-forge/grafana/loki"`
-		Tag          string `yaml:"tag" env-default:"latest"`
-		Namespace    string `yaml:"namespace" env-default:"observability"`
-		Persistence  struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
-			Retention    string `yaml:"retention" env-default:"168h"`
-		} `yaml:"persistence"`
-		AlertManagerUrl       string `yaml:"alert_manager_u	rl" env-default:"http://observability-alert-manager:9093"`
-		AdditionalRulesGroups string `yaml:"additional_rules_groups" env-default:""`
-	} `yaml:"loki"`
-	Events struct {
-		Enabled  bool `yaml:"enabled"`
-		Exporter struct {
-			Image string `yaml:"image" env-default:"ghcr.io/resmoio/kubernetes-event-exporter"`
-			Tag   string `yaml:"tag" env-default:"v1.4"`
-		} `yaml:"exporter"`
-		Cron struct {
-			Image    string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kubectl"`
-			Tag      string `yaml:"tag" env-default:"1.27.5-debian-11-r8"`
-			Schedule string `yaml:"schedule" env-default:"*/2 * * * *"`
-		} `yaml:"cron"`
-	} `yaml:"events"`
-}
-
-type Tracing struct {
-	Enabled  bool `yaml:"enabled"`
-	Operator struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/opentelemetry-operator"`
-		ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
-		Image        string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
-		Tag          string `yaml:"tag" env-default:""`
-		Namespace    string `yaml:"namespace" env-default:"observability"`
-	} `yaml:"operator"`
-	Collector struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"`
-		Tag   string `yaml:"tag" env-default:"0.95.0"`
-	} `yaml:"collector"`
-	Tempo struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/tempo"`
-		ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
-		Image        string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"`
-		Tag          string `yaml:"tag" env-default:"2.3.1"`
-		Namespace    string `yaml:"namespace" env-default:"observability"`
-		Retention    string `yaml:"retention" env-default:"24h"`
-		ListenPort   int    `yaml:"listen_port" env-default:"3100"`
-		Persistence  struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
-		} `yaml:"persistence"`
-		TempoQuery struct {
-			Image      string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo-query"`
-			Tag        string `yaml:"tag" env-default:"2.3.1"`
-			ListenPort int    `yaml:"listen_port" env-default:"16686"`
-		} `yaml:"tempo_query"`
-	} `yaml:"tempo"`
-}
-
-type Monitoring struct {
-	Enabled    bool `yaml:"enabled"`
-	Prometheus struct {
-		Image          string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/prometheus"`
-		Tag            string `yaml:"tag" env-default:"v2.45.0"`
-		ScrapeInterval string `yaml:"scrape_interval" env-default:"15s"`
-		Persistence    struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"3Gi"`
-			Retention    string `yaml:"retention" env-default:"7d"`
-		} `yaml:"persistence"`
-		Operator struct {
-			Image          string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-operator"`
-			Tag            string `yaml:"tag" env-default:"v0.65.2"`
-			ConfigReloader struct {
-				Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-config-reloader"`
-				Tag   string `yaml:"tag" env-default:"v0.65.2"`
-			} `yaml:"config_reloader"`
-			KubeRbacProxy struct {
-				Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-rbac-proxy"`
-				Tag   string `yaml:"tag" env-default:"0.14.1"`
-			} `yaml:"kube_rbac_proxy"`
-		} `yaml:"operator"`
-	} `yaml:"prometheus"`
-	AlertManager struct {
-		Enabled                    bool        `yaml:"enabled"`
-		Image                      string      `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/alertmanager"`
-		Tag                        string      `yaml:"tag" env-default:"v0.26.0"`
-		AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"`
-		Route                      interface{} `yaml:"route"`
-		Receivers                  interface{} `yaml:"receivers"`
-	} `yaml:"alert_manager"`
-	Blackbox struct {
-		Enabled           bool   `yaml:"enabled"`
-		Image             string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/blackbox-exporter"`
-		Tag               string `yaml:"tag" env-default:"v0.24.0"`
-		AdditionalModules string `yaml:"routes" env-default:""`
-	} `yaml:"blackbox"`
-	KubeState struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/bitnami/kube-state-metrics"`
-		Tag     string `yaml:"tag" env-default:"2.9.2"`
-	} `yaml:"kube_state"`
-	Node struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/prom/node-exporter"`
-		Tag     string `yaml:"tag" env-default:"v1.5.0"`
-	} `yaml:"node"`
-	MetricsServer struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"`
-		ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
-		Image        string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
-		Tag          string `yaml:"tag" env-default:""`
-		Namespace    string `yaml:"namespace" env-default:"kube-system"`
-	}
-}
-
-type Visualization struct {
-	Enabled bool `yaml:"enabled"`
-	Grafana struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana"`
-		Tag     string `yaml:"tag" env-default:"10.4.1-v2"`
-		Expose  struct {
-			Type         string `yaml:"type" env-default:"ingress"`
-			Domain       string `yaml:"domain" env-default:""`
-			Path         string `yaml:"path" env-default:"/"`
-			NodePortHttp int    `yaml:"node_port_http" env-default:"30007"`
-			Tls          struct {
-				Enabled bool `yaml:"enabled"`
-			}
-		} `yaml:"expose"`
-		Persistence struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"2Gi"`
-		} `yaml:"persistence"`
-		Config struct {
-			Auth                  string      `yaml:"auth" env-default:""`
-			AuthGenericAuth       string      `yaml:"auth_generic_auth" env-default:""`
-			AdditionalDatasources interface{} `yaml:"additional_datasources"`
-		} `yaml:"config"`
-	} `yaml:"grafana"`
-}

internal/config/modules_registry.go

@@ -1,66 +0,0 @@
-package config
-
-type Registry struct {
-	ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/harbor"`
-	ChartVersion  string `yaml:"chart_version" env-default:"1.14.2"`
-	Enabled       bool   `yaml:"enabled"`
-	AdminPassword string
-	Namespace     string `yaml:"namespace" env-default:"registry"`
-	Expose        struct {
-		Type          string `yaml:"type" env-default:"nodePort"`
-		Domain        string `yaml:"domain" env-default:""`
-		Path          string `yaml:"path" env-default:"/"`
-		NodePortHttp  int    `yaml:"node_port_http" env-default:"30002"`
-		NodePortHttps int    `yaml:"node_port_https" env-default:"30003"`
-	} `yaml:"expose"`
-	Tls struct {
-		Enabled              bool `yaml:"enabled"`
-		CertificateGenerator struct {
-			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/certificate-generator"`
-			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
-		} `yaml:"certificate_generator"`
-	} `yaml:"tls"`
-	Persistence struct {
-		StorageClass   string `yaml:"storage_class" env-default:"local-path"`
-		RegistrySize   string `yaml:"registry_size" env-default:"10Gi"`
-		JobserviceSize string `yaml:"jobservice_size" env-default:"1Gi"`
-		DatabaseSize   string `yaml:"database_size" env-default:"2Gi"`
-		RedisSize      string `yaml:"redis_size" env-default:"1Gi"`
-		TrivySize      string `yaml:"trivy_size" env-default:"5Gi"`
-	} `yaml:"persistence"`
-	EnabledScanner bool `yaml:"enabled_scanner"`
-	Portal         struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal"`
-		Tag   string `yaml:"tag" env-default:"v2.10.1"`
-	} `yaml:"portal"`
-	Core struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-core"`
-		Tag   string `yaml:"tag" env-default:"v2.10.1"`
-	} `yaml:"core"`
-	Jobservice struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice"`
-		Tag   string `yaml:"tag" env-default:"v2.10.1"`
-	} `yaml:"jobservice"`
-	Registry struct {
-		Registry struct {
-			Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/registry-photon"`
-			Tag   string `yaml:"tag" env-default:"v2.10.1"`
-		} `yaml:"registry"`
-		Controller struct {
-			Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl"`
-			Tag   string `yaml:"tag" env-default:"v2.10.1"`
-		} `yaml:"controller"`
-	} `yaml:"registry"`
-	Trivy struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon"`
-		Tag   string `yaml:"tag" env-default:"v2.10.1"`
-	} `yaml:"trivy"`
-	Database struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/harbor-db"`
-		Tag   string `yaml:"tag" env-default:"v2.10.1"`
-	} `yaml:"database"`
-	Redis struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/goharbor/redis-photon"`
-		Tag   string `yaml:"tag" env-default:"v2.10.1"`
-	} `yaml:"redis"`
-}

internal/config/modules_secrets_storage.go

@@ -1,48 +0,0 @@
-package config
-
-type SecretsStorage struct {
-	ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/vault"`
-	ChartVersion string   `yaml:"chart_version" env-default:"0.1.0"`
-	Namespace    string   `yaml:"namespace" env-default:"secrets-storage"`
-	Enabled      bool     `yaml:"enabled"`
-	KeyShares    int      `yaml:"key_shares" env-default:"5"`
-	KeyThreshold int      `yaml:"key_threshold" env-default:"3"`
-	UnsealKeys   []string `yaml:"unseal_keys" env-default:"[]"`
-	AuthToken    string   `yaml:"auth_token" env-default:""`
-	Expose       struct {
-		Type     string `yaml:"type"`
-		Domain   string `yaml:"domain"`
-		Path     string `yaml:"path" env-default:"/"`
-		NodePort int    `yaml:"node_port"`
-		Tls      struct {
-			Enabled bool `yaml:"enabled"`
-		} `yaml:"tls"`
-	} `yaml:"expose"`
-	CsiIntegration struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-csi-provider"`
-		Tag     string `yaml:"tag" env-default:"1.4.1"`
-	} `yaml:"csi_integration"`
-	Injector struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault-k8s"`
-		Tag   string `yaml:"tag" env-default:"1.3.1"`
-	} `yaml:"injector"`
-	Server struct {
-		Image       string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"`
-		Tag         string `yaml:"tag" env-default:"1.16.0"`
-		Persistence struct {
-			DataStorage struct {
-				StorageClass string `yaml:"storage_class" env-default:"local-path"`
-				Size         string `yaml:"size" env-default:"10Gi"`
-			} `yaml:"data_storage"`
-			AuditStorage struct {
-				StorageClass string `yaml:"storage_class" env-default:"local-path"`
-				Size         string `yaml:"size" env-default:"10Gi"`
-			} `yaml:"audit_storage"`
-		} `yaml:"persistence"`
-	} `yaml:"server"`
-	Agent struct {
-		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/hashicorp/vault"`
-		Tag   string `yaml:"tag" env-default:"1.16.0"`
-	} `yaml:"agent"`
-}

internal/config/orchestrator.go

@@ -12,16 +12,19 @@ type RegistryMirror struct {
 
 type Orchestrator struct {
 	Version                   string `yaml:"version" env-default:"v1.29.0"`
-	ClusterName               string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
+	ClusterName               string `yaml:"cluster_name" env-default:"cluster.local"`
 	BinDir                    string `yaml:"bin_dir" env-default:"/usr/local/bin"`
 	SysctlFilePath            string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
 	LoadbalancerApiserverPort int    `yaml:"loadbalancer_apiserver_port" env-default:"6443"`
 	Dns                       Dns    `yaml:"dns"`
 	CloudProvider             string `yaml:"cloud_provider"`
 	ExgernalCloudProvider     string `yaml:"external_cloud_provider"`
+	KubeletDir                string `yaml:"kubelet_dir" env-default:"/var/lib/kubelet"`
 	ContainerEngine           struct {
-		Type    string `yaml:"type" env-default:"containerd"`
+		Type     string `yaml:"type" env-default:"containerd"`
-		Install bool   `yaml:"install"`
+		Install  bool   `yaml:"install"`
+		DataDir  string `yaml:"data_dir" env-default:"/var/lib/containerd"`
+		StateDir string `yaml:"state_dir" env-default:"/run/containerd"`
 	} `yaml:"container_engine"`
 	PingAccessIp             bool   `yaml:"ping_access_ip"`
 	AutoRenewCertificates    bool   `yaml:"auto_renew_certificates"`

internal/config/utility.go

@@ -11,8 +11,3 @@ func getBcryptHash(input string) string {
 	}
 	return string(hashedPassword)
 }
-
-func generateCreds(config *Config) {
-	config.Modules.Cicd.ArgoCd.AdminPassword = getBcryptHash(config.Modules.AdminPassword)
-	config.Modules.Registry.AdminPassword = config.Modules.AdminPassword
-}

internal/kubespray/cluster.go

@@ -21,3 +21,9 @@ func ScaleCluster() {
 	runPlaybook("kubespray/project/scale.yml", "")
 	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }
+
+func ResetCluster() {
+	appConfig := config.GetConfig()
+	runPlaybook("kubespray/project/reset.yml", "")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
+}

internal/observability/helm.go

@@ -1,122 +0,0 @@
-package observability
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/helm_client"
-	"kube-forge/internal/templates"
-	"time"
-
-	go_helm_client "github.com/mittwald/go-helm-client"
-)
-
-var HELM_REPOS = []config.RepoSettings{
-	{
-		Name: "kube-forge",
-		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
-	},
-}
-
-func getFluentOperatorSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "fluent-operator",
-		ChartName:       appConfig.Modules.Observability.Logging.Operator.ChartRef,
-		Version:         appConfig.Modules.Observability.Logging.Operator.ChartVersion,
-		Namespace:       appConfig.Modules.Observability.Logging.Operator.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		UpgradeCRDs:     true,
-		Timeout:         time.Second * 60,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"),
-	}
-}
-
-func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "opentelemetry-operator",
-		ChartName:       appConfig.Modules.Observability.Tracing.Operator.ChartRef,
-		Version:         appConfig.Modules.Observability.Tracing.Operator.ChartVersion,
-		Namespace:       appConfig.Modules.Observability.Tracing.Operator.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		UpgradeCRDs:     true,
-		Timeout:         time.Second * 60,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"),
-	}
-}
-
-func getMetricsServerSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "metrics-server",
-		ChartName:       appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef,
-		Version:         appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion,
-		Namespace:       appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 60,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"),
-	}
-}
-
-func getTempoSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "tempo",
-		ChartName:       appConfig.Modules.Observability.Tracing.Tempo.ChartRef,
-		Version:         appConfig.Modules.Observability.Tracing.Tempo.ChartVersion,
-		Namespace:       appConfig.Modules.Observability.Tracing.Tempo.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 60,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"),
-	}
-}
-
-func getLokiSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "loki",
-		ChartName:       appConfig.Modules.Observability.Logging.Loki.ChartRef,
-		Version:         appConfig.Modules.Observability.Logging.Loki.ChartVersion,
-		Namespace:       appConfig.Modules.Observability.Logging.Loki.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 60,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"),
-	}
-}
-
-func getObservabilitySpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "observability",
-		ChartName:       appConfig.Modules.Observability.ChartRef,
-		Version:         appConfig.Modules.Observability.ChartVersion,
-		Namespace:       appConfig.Modules.Observability.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"),
-	}
-}
-
-func ApplyCharts() {
-	appConfig := config.GetConfig()
-	helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
-	if appConfig.Modules.Observability.Enabled {
-		if appConfig.Modules.Observability.Logging.Enabled {
-			helm_client.InstallChart(getFluentOperatorSpec())
-			helm_client.InstallChart(getLokiSpec())
-		}
-		if appConfig.Modules.Observability.Tracing.Enabled {
-			helm_client.InstallChart(getOpenTelemetryOperatorSpec())
-			helm_client.InstallChart(getTempoSpec())
-		}
-		if appConfig.Modules.Observability.Monitoring.Enabled {
-			helm_client.InstallChart(getMetricsServerSpec())
-		}
-		helm_client.InstallChart(getObservabilitySpec())
-	}
-}

internal/registry/helm.go

@@ -1,61 +0,0 @@
-package registry
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/helm_client"
-	"kube-forge/internal/templates"
-	"time"
-
-	go_helm_client "github.com/mittwald/go-helm-client"
-)
-
-var HELM_REPOS = []config.RepoSettings{
-	{
-		Name: "kube-forge",
-		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
-	},
-}
-
-func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "harbor-certificate-generator",
-		ChartName:       appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef,
-		Version:         appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion,
-		Namespace:       appConfig.Modules.Registry.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 60,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"),
-	}
-}
-
-func getHarborSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "harbor",
-		ChartName:       appConfig.Modules.Registry.ChartRef,
-		Version:         appConfig.Modules.Registry.ChartVersion,
-		Namespace:       appConfig.Modules.Registry.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"),
-	}
-}
-
-func ApplyCharts() {
-	appConfig := config.GetConfig()
-	helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
-	if appConfig.Modules.Registry.Enabled {
-		if appConfig.Modules.Registry.Expose.Type == "ingress" {
-			helm_client.InstallChart(getHarborCertificateGeneratorSpec())
-		} else {
-			helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
-		}
-		helm_client.InstallChart(getHarborSpec())
-	} else {
-		helm_client.DeleteChart(getHarborSpec())
-		helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
-	}
-}

internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl

@@ -1,24 +0,0 @@
-services:
-  - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
-    path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
-    address: argo-cd-argocd-server
-    port: 80
-    secretName: argo-cd-server-tls
-
-ingress:
-  accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-  class: {{ .Modules.Additional.Ingress.Type }}
-  annotations:
-    {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-    nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-    nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    {{- end }}
-  tls:
-    enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
-    useCertManager: true
-
-    # used if "useCertManager" is false
-    crt: ""
-    key: ""

internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl

@@ -1,170 +0,0 @@
-crds:
-  install: true
-
-global:
-  repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
-  tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
-
-server:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
-  certificateSecret:
-    enabled: false
-  {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
-  service:
-    type: "NodePort"
-    nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
-    nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
-  {{- end }}
-  {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-  {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-  autoscaling:
-    enabled: true
-    minReplicas: 2
-  {{- else }}
-  replicas: 2
-  {{- end }}
-  {{- end }}
-
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    serviceMonitor:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-redis:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
-  exporter:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    image:
-      repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
-      tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    serviceMonitor:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-controller:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
-  replicas: 1
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    serviceMonitor:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-applicationSet:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
-  {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-  replicas: 2
-  {{- end }}
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    serviceMonitor:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-dex:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    ## check later
-    serviceMonitor:
-      enabled: false
-
-repoServer:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
-  {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-  {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-  autoscaling:
-    enabled: true
-    minReplicas: 2
-  {{- else }}
-  replicas: 2
-  {{- end }}
-  {{- end }}
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    serviceMonitor:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-notifications:
-  image:
-    repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
-    tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
-  metrics:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    serviceMonitor:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-configs:
-  params:
-    server.insecure: true
-    {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
-    server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
-    {{- end }}
-
-  secret:
-    argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
-
-  repositories:
-    # add default helm-repository from harbor
-    {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
-
-  cm:
-    create: true
-    url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
-
-    accounts.developer: login
-    accounts.guest: login
-
-    # oidc.config: ""
-
-  rbac:
-    create: true
-    policy.csv: |
-      p, role:admin, applications, create, */*, allow
-      p, role:admin, applications, update, */*, allow
-      p, role:admin, applications, delete, */*, allow
-      p, role:admin, applications, sync, */*, allow
-      p, role:admin, applications, override, */*, allow
-      p, role:admin, applications, action/*, */*, allow
-      p, role:admin, applicationsets, get, */*, allow
-      p, role:admin, applicationsets, create, */*, allow
-      p, role:admin, applicationsets, update, */*, allow
-      p, role:admin, applicationsets, delete, */*, allow
-      p, role:admin, certificates, create, *, allow
-      p, role:admin, certificates, update, *, allow
-      p, role:admin, certificates, delete, *, allow
-      p, role:admin, clusters, create, *, allow
-      p, role:admin, clusters, update, *, allow
-      p, role:admin, clusters, delete, *, allow
-      p, role:admin, repositories, create, *, allow
-      p, role:admin, repositories, update, *, allow
-      p, role:admin, repositories, delete, *, allow
-      p, role:admin, projects, create, *, allow
-      p, role:admin, projects, update, *, allow
-      p, role:admin, projects, delete, *, allow
-      p, role:admin, accounts, update, *, allow
-      p, role:admin, gpgkeys, create, *, allow
-      p, role:admin, gpgkeys, delete, *, allow
-      p, role:admin, exec, create, */*, allow
-
-      {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
-
-
-    policy.default: role:''
-    # scopes: "[roles,email,groups]"
-
-{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-redis-ha:
-  enabled: true
-{{- end }}

internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl

@@ -1,424 +0,0 @@
-installCRDs: true
-keepCRDs: false
-clusterInstall: true
-createClusterAggregateRoles: true
-
-apiVersionOverrides:
-  # -- String to override apiVersion of ingresses rendered by this helm chart
-  ingress: "" # networking.k8s.io/v1beta1
-
-# -- Override the Kubernetes version, which is used to evaluate certain manifests
-kubeVersionOverride: ""
-
-# -- Additional manifests to deploy within the chart. A list of objects.
-## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
-extraObjects: []
-  # - apiVersion: v1
-  #   kind: Secret
-  #   metadata:
-  #     name: datadog
-  #   type: Opaque
-  #   data:
-  #     address: https://api.datadoghq.com
-  #     api-key: <datadog-api-key>
-  #     app-key: <datadog-app-key>
-
-global:
-  # -- Annotations for all deployed Deployments
-  deploymentAnnotations: {}
-
-controller:
-  # -- Value of label `app.kubernetes.io/component`
-  component: rollouts-controller
-  # -- Annotations to be added to the controller deployment
-  deploymentAnnotations: {}
-  # -- Annotations to be added to application controller pods
-  podAnnotations: {}
-  # -- [Node selector]
-  nodeSelector: {}
-  # -- [Tolerations] for use with node taints
-  tolerations: []
-  # -- Assign custom [affinity] rules to the deployment
-  affinity: {}
-  logging:
-    # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-    level: info
-    # -- Set the klog logging level
-    kloglevel: "0"
-    # -- Set the logging format (one of: `text`, `json`)
-    format: "text"
-
-  # -- Assign custom [TopologySpreadConstraints] rules to the controller
-  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-  ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-  topologySpreadConstraints: []
-  # - maxSkew: 1
-  #   topologyKey: topology.kubernetes.io/zone
-  #   whenUnsatisfiable: DoNotSchedule
-
-  # -- [priorityClassName] for the controller
-  priorityClassName: ""
-  # -- The number of controller pods to run
-  {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-  replicas: 3
-  {{- else }}
-  replicas: 1
-  {{- end }}
-  image:
-    # -- Registry to use
-    registry: {{ .Modules.Cicd.Rollouts.Registry }}
-    # -- Repository to use
-    repository: {{ .Modules.Cicd.Rollouts.Repository }}
-    # -- Overrides the image tag (default is the chart appVersion)
-    tag: {{ .Modules.Cicd.Rollouts.Tag }}
-    # -- Image pull policy
-    pullPolicy: IfNotPresent
-
-  # -- flag to enable creation of cluster controller role (requires cluster RBAC)
-  createClusterRole: true
-
-  # Controller container ports
-  containerPorts:
-    # -- Metrics container port
-    metrics: 8090
-    # -- Healthz container port
-    healthz: 8080
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-  metrics:
-    # -- Deploy metrics service
-    enabled: true
-    service:
-      # -- Metrics service port name
-      portName: metrics
-      # -- Metrics service port
-      port: 8090
-      # -- Service annotations
-      annotations: {}
-    serviceMonitor:
-      # -- Enable a prometheus ServiceMonitor
-      enabled: true
-      # -- Namespace to be used for the ServiceMonitor
-      namespace: ""
-      # -- Labels to be added to the ServiceMonitor
-      additionalLabels: {}
-      # -- Annotations to be added to the ServiceMonitor
-      additionalAnnotations: {}
-      # -- RelabelConfigs to apply to samples before scraping
-      relabelings: []
-      # -- MetricRelabelConfigs to apply to samples before ingestion
-      metricRelabelings: []
-  {{- end }}
-
-  # -- Configure liveness [probe] for the controller
-  # @default -- See [values.yaml]
-  livenessProbe:
-    httpGet:
-      path: /healthz
-      port: healthz
-    initialDelaySeconds: 30
-    periodSeconds: 20
-    failureThreshold: 3
-    successThreshold: 1
-    timeoutSeconds: 10
-
-  # -- Configure readiness [probe] for the controller
-  # @default -- See [values.yaml]
-  readinessProbe:
-    httpGet:
-      path: /metrics
-      port: metrics
-    initialDelaySeconds: 15
-    periodSeconds: 5
-    failureThreshold: 3
-    successThreshold: 1
-    timeoutSeconds: 4
-
-  ## Configure Pod Disruption Budget for the controller
-  pdb:
-    # -- Labels to be added to controller [Pod Disruption Budget]
-    labels: {}
-    # -- Annotations to be added to controller [Pod Disruption Budget]
-    annotations: {}
-    # -- Deploy a [Pod Disruption Budget] for the controller
-    enabled: false
-    # -- Minimum number / percentage of pods that should remain scheduled
-    minAvailable: # 1
-    # -- Maximum number / percentage of pods that may be made unavailable
-    maxUnavailable: # 0
-
-  # -- Additional volumes to add to the controller pod
-  volumes: []
-    # - configMap:
-    #     name: my-certs-cm
-    #   name: my-certs
-
-  # -- Additional volumeMounts to add to the controller container
-  volumeMounts: []
-    # - mountPath: /etc/ssl/certs
-    #   name: my-certs
-
-  # -- Configures 3rd party metric providers for controller
-  ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
-  metricProviderPlugins: {}
-    # metricProviderPlugins: |-
-    #   - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
-    #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-  # -- Configures 3rd party traffic router plugins for controller
-  ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
-  trafficRouterPlugins: {}
-    # trafficRouterPlugins: |-
-    #   - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
-    #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-serviceAccount:
-  # -- Specifies whether a service account should be created
-  create: true
-  # -- Annotations to add to the service account
-  annotations: {}
-  # -- The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name: ""
-
-# -- Annotations to be added to all CRDs
-crdAnnotations: {}
-
-# -- Annotations for the all deployed pods
-podAnnotations: {}
-
-# -- Security Context to set on pod level
-podSecurityContext:
-  runAsNonRoot: true
-
-# -- Security Context to set on container level
-containerSecurityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
-
-# -- Annotations to be added to the Rollout service
-serviceAnnotations: {}
-
-# -- Labels to be added to the Rollout pods
-podLabels: {}
-
-# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
-imagePullSecrets: []
-# - name: argo-pull-secret
-
-providerRBAC:
-  # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
-  enabled: true
-  # providerRBAC.enabled must be true in order to toggle the individual providers
-  providers:
-    # -- Adds RBAC rules for the Istio provider
-    istio: true
-    # -- Adds RBAC rules for the SMI provider
-    smi: true
-    # -- Adds RBAC rules for the Ambassador provider
-    ambassador: true
-    # -- Adds RBAC rules for the AWS Load Balancer Controller provider
-    awsLoadBalancerController: true
-    # -- Adds RBAC rules for the AWS App Mesh provider
-    awsAppMesh: true
-    # -- Adds RBAC rules for the Traefik provider
-    traefik: true
-    # -- Adds RBAC rules for the Apisix provider
-    apisix: true
-    # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
-    contour: true
-    # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
-    glooPlatform: true
-  # -- Additional RBAC rules for others providers
-  additionalRules: []
-
-dashboard:
-  # -- Deploy dashboard server
-  enabled: true
-  # -- Set cluster role to readonly
-  readonly: false
-  # -- Value of label `app.kubernetes.io/component`
-  component: rollouts-dashboard
-  # -- Annotations to be added to the dashboard deployment
-  deploymentAnnotations: {}
-  # -- Annotations to be added to application dashboard pods
-  podAnnotations: {}
-  # -- [Node selector]
-  nodeSelector: {}
-  # -- [Tolerations] for use with node taints
-  tolerations: []
-  # -- Assign custom [affinity] rules to the deployment
-  affinity: {}
-  logging:
-    # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-    level: info
-    # -- Set the klog logging level
-    kloglevel: "0"
-
-  # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
-  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-  ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-  topologySpreadConstraints: []
-  # - maxSkew: 1
-  #   topologyKey: topology.kubernetes.io/zone
-  #   whenUnsatisfiable: DoNotSchedule
-
-  # -- [priorityClassName] for the dashboard server
-  priorityClassName: ""
-
-  # -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
-  createClusterRole: true
-
-  # -- The number of dashboard pods to run
-  {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-  replicas: 3
-  {{- else }}
-  replicas: 1
-  {{- end }}
-  image:
-    # -- Registry to use
-    registry: quay.io
-    # --  Repository to use
-    repository: argoproj/kubectl-argo-rollouts
-    # -- Overrides the image tag (default is the chart appVersion)
-    tag: ""
-    # -- Image pull policy
-    pullPolicy: IfNotPresent
-  # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
-  extraArgs: []
-  # -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
-  extraEnv: []
-    # - name: FOO
-    #   value: bar
-  # -- Resource limits and requests for the dashboard pods.
-  resources: {}
-  # -- Security Context to set on pod level
-  podSecurityContext:
-    runAsNonRoot: true
-  # -- Security Context to set on container level
-  containerSecurityContext: {}
-  service:
-    # -- Sets the type of the Service
-    {{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
-    type: NodePort
-    nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
-    {{- else }}
-    type: ClusterIP
-    nodePort:
-    {{- end }}
-    # -- LoadBalancer will get created with the IP specified in this field
-    loadBalancerIP: ""
-    # -- Source IP ranges to allow access to service from
-    loadBalancerSourceRanges: []
-    # -- Dashboard service external IPs
-    externalIPs: []
-    # -- Service annotations
-    annotations: {}
-    # -- Service labels
-    labels: {}
-    # -- Service port name
-    portName: dashboard
-    # -- Service port
-    port: 3100
-    # -- Service target port
-    targetPort: 3100
-    # -- (int) Service nodePort
-
-  serviceAccount:
-    # -- Specifies whether a dashboard service account should be created
-    create: true
-    # -- Annotations to add to the dashboard service account
-    annotations: {}
-    # -- The name of the service account to use.
-    # If not set and create is true, a name is generated using the fullname template
-    name: ""
-
-  ## Configure Pod Disruption Budget for the dashboard
-  pdb:
-    # -- Labels to be added to dashboard [Pod Disruption Budget]
-    labels: {}
-    # -- Annotations to be added to dashboard [Pod Disruption Budget]
-    annotations: {}
-    # -- Deploy a [Pod Disruption Budget] for the dashboard
-    enabled: false
-    # -- Minimum number / percentage of pods that should remain scheduled
-    minAvailable: # 1
-    # -- Maximum number / percentage of pods that may be made unavailable
-    maxUnavailable: # 0
-
-  ## Ingress configuration.
-  ## ref: https://kubernetes.io/docs/user-guide/ingress/
-  ##
-  ingress:
-    # -- Enable dashboard ingress support
-    enabled: false
-    # -- Dashboard ingress annotations
-    annotations: {}
-    # -- Dashboard ingress labels
-    labels: {}
-    # -- Dashboard ingress class name
-    ingressClassName: ""
-
-    # -- Dashboard ingress hosts
-    ## Argo Rollouts Dashboard Ingress.
-    ## Hostnames must be provided if Ingress is enabled.
-    ## Secrets must be manually created in the namespace
-    hosts: []
-      # - argorollouts.example.com
-
-    # -- Dashboard ingress paths
-    paths:
-      - /
-    # -- Dashboard ingress path type
-    pathType: Prefix
-    # -- Dashboard ingress extra paths
-    extraPaths: []
-      # - path: /*
-      #   backend:
-      #     serviceName: ssl-redirect
-      #     servicePort: use-annotation
-      ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
-      # - path: /*
-      #   pathType: Prefix
-      #   backend:
-      #     service
-      #       name: ssl-redirect
-      #       port:
-      #         name: use-annotation
-
-    # -- Dashboard ingress tls
-    tls: []
-      # - secretName: argorollouts-example-tls
-      #   hosts:
-      #     - argorollouts.example.com
-
-  # -- Additional volumes to add to the dashboard pod
-  volumes: []
-
-  # -- Additional volumeMounts to add to the dashboard container
-  volumeMounts: []
-
-notifications:
-  secret:
-    # -- Whether to create notifications secret
-    create: false
-    # -- Generic key:value pairs to be inserted into the notifications secret
-    items: {}
-      # slack-token:
-
-  # -- Configures notification services
-  notifiers: {}
-    # service.slack: |
-    #   token: $slack-token
-
-  # -- Notification templates
-  templates: {}
-
-  # -- The trigger defines the condition when the notification should be sent
-  triggers: {}
-    # trigger.on-purple: |
-    #   - send: [my-purple-template]
-    #     when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'

internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl

@@ -1,245 +0,0 @@
-image:
-  repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
-  tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
-  pullPolicy: Always
-
-# Enable insecure registries
-insecureRegistry: false
-
-# Polling is enabled by default,
-# you can disable it setting value below to false
-polling:
-  enabled: true
-  defaultSchedule: "@every 1m"
-
-# Extra Containers to run alongside Keel
-# extraContainers:
-#   - name: busybox
-#     image: busybox
-#     imagePullPolicy: IfNotPresent
-#     command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
-
-# Helm provider support
-helmProvider:
-  enabled: true
-  # set to version "v3" for Helm v3
-  version: "v2"
-  tillerNamespace: "kube-system"
-  # optional Tiller address (if portforwarder tunnel doesn't work),
-  # if you are using default configuration, setting it to
-  # 'tiller-deploy:44134' is usually fine
-  tillerAddress: 'tiller-deploy:44134'
-#  helmDriver: ''
-#  helmDriverSqlConnectionString: ''
-
-# Google Container Registry
-# GCP Project ID
-gcr:
-  enabled: false
-  projectId: ""
-  gcpServiceAccount: ""
-  clusterName: ""
-  pubSub:
-    enabled: false
-
-# Notification level (debug, info, success, warn, error, fatal)
-notificationLevel: info
-
-# AWS Elastic Container Registry
-# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
-ecr:
-  enabled: false
-  roleArn: ""
-  accessKeyId: ""
-  secretAccessKey: ""
-  region: ""
-
-# Webhook Notification
-# Remote webhook endpoint for notification delivery
-webhook:
-  enabled: false
-  endpoint: ""
-
-# Slack Notification
-# bot name (default keel) must exist!
-slack:
-  enabled: false
-  botName: ""
-  token: ""
-  channel: ""
-  approvalsChannel: ""
-
-# Hipchat notification and approvals
-hipchat:
-  enabled: false
-  token: ""
-  channel: ""
-  approvalsChannel: ""
-  botName: ""
-  userName: ""
-  password: ""
-
-# Mattermost notifications
-mattermost:
-  enabled: false
-  endpoint: ""
-
-# MS Teams notifications
-teams:
-  enabled: false
-  webhookUrl: ""
-
-# Discord notifications
-discord:
-  enabled: false
-  webhookUrl: ""
-
-# Mail notifications
-mail:
-  enabled: false
-  from: ""
-  to: ""
-  smtp:
-    server: ""
-    port: 25
-    user: ""
-    pass: ""
-
-# Basic auth on approvals
-basicauth:
-  enabled: true
-  user: "admin"
-  password: "{{ .Modules.AdminPassword }}"
-
-# Keel service
-# Enable to receive webhooks from Docker registries
-service:
-  enabled: false
-  type: LoadBalancer
-  externalPort: 9300
-  clusterIP: ""
-
-# Webhook Relay service
-# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
-# which can deliver webhooks to your internal Keel service through Keel sidecar container.
-webhookRelay:
-  enabled: false
-  bucket: ""
-  # webhookrelay.com credentials
-  # Set the key and secret values here to create the keel-webhookrelay secret with this
-  # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
-  key: ""
-  secret: ""
-  # webhookrelay docker image
-  image:
-    repository: webhookrelay/webhookrelayd
-    tag: latest
-    pullPolicy: IfNotPresent
-
-# Use a secret file to define passwords and tokens of third parties.
-secret:
-  # Leave blank to use `keel.fullname`
-  name: ""
-  # Set to false to manage your own secret file, with terraform for example.
-  create: true
-
-# Keel self-update
-# uncomment lines below if you want Keel to automaticly
-# self-update to the latest release version
-# keel:
-#   # keel policy (all/major/minor/patch/force)
-#   policy: patch
-#   # trigger type, defaults to events such as pubsub, webhooks
-#   trigger: poll
-#   # polling schedule
-#   pollSchedule: "@every 3m"
-#   # images to track and update
-#   images:
-#     - repository: image.repository
-#       tag: image.tag
-
-# RBAC manifests management
-rbac:
-  enabled: true
-  serviceAccount:
-    # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
-    # name:
-    # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
-    # If rbac.serviceAccount.name is not set, a new name for the service account is generated
-    create: true
-
-# Resources
-resources:
-  limits:
-    cpu: 100m
-    memory: 128Mi
-  requests:
-    cpu: 50m
-    memory: 64Mi
-
-# NodeSelector
-nodeSelector: {}
-
-affinity: {}
-
-tolerations: {}
-
-# base64 encoded json of GCP service account
-# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
-# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
-googleApplicationCredentials: ""
-
-# Enable DEBUG logging
-debug: false
-
-# This is used by the static manifest generator in order to create a static
-# namespace manifest for the namespace that keel is being installed
-# within. It should **not** be used if you are using Helm for deployment.
-createNamespaceResource: false
-
-podAnnotations: {}
-
-serviceAnnotations: {}
-# Useful for making the load balancer internal
-# serviceAnnotations:
-#    cloud.google.com/load-balancer-type: Internal
-
-aws:
-  region: null
-
-podDisruptionBudget:
-  enabled: false
-  maxUnavailable: 1
-  minAvailable: null
-
-# Google Cloud Certificates
-gcloud:
-  managedCertificates:
-    enabled: false
-    domains:
-      - ""
-
-ingress:
-  enabled: false
-  labels: {}
-  annotations: {}
-#    kubernetes.io/ingress.class: nginx
-#    kubernetes.io/tls-acme: "true"
-  hosts: []
-#    - host: chart-example.local
-#      paths:
-#        - /
-  tls: []
-#    - secretName: chart-example-tls
-#      hosts:
-#        - chart-example.local
-
-dockerRegistry:
-  enabled: false
-  name: ""
-  key: ""
-
-persistence:
-  enabled: false
-  storageClass: "-"
-  size: 1Gi

internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl

@@ -1,55 +0,0 @@
-# Set this to containerd or crio if you want to collect CRI format logs
-containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-Kubernetes: false
-
-operator:
-  initcontainer:
-    repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
-    tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
-
-    resources:
-      limits:
-        cpu: 100m
-        memory: 100Mi
-
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  container:
-    repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
-    tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
-  resources:
-    limits:
-      cpu: 100m
-      memory: 100Mi
-    requests:
-      cpu: 100m
-      memory: 60Mi
-  imagePullSecrets: []
-  labels: {}
-  logPath:
-    # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
-    # crio: /var/log
-    containerd: /var/log
-  disableComponentControllers: ""
-
-fluentbit:
-  crdsEnable: true
-  enable: false
-
-fluentd:
-  crdsEnable: true
-  enable: false
-  name: fluentd
-  # Valid modes include "collector" and "agent".
-  # The "collector" mode will deploy Fluentd as a StatefulSet as before.
-  # The new "agent" mode will deploy Fluentd as a DaemonSet.
-  mode: "agent"
-  port: 24224
-  image:
-    repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
-    tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
-
-nameOverride: ""
-fullnameOverride: ""
-namespaceOverride: ""

internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl

@@ -1,188 +0,0 @@
-loki:
-  image:
-    registry: {{ .Modules.Observability.Logging.Loki.Registry }}
-    repository: {{ .Modules.Observability.Logging.Loki.Image }}
-    tag: {{ .Modules.Observability.Logging.Loki.Tag }}
-  podAnnotations:
-    app.kubernetes.io/component: "loki"
-  auth_enabled: false
-  commonConfig:
-    replication_factor: 1
-  storage:
-    type: 'filesystem'
-
-  frontend:
-    max_outstanding_per_tenant: 10000
-
-  limits_config:
-    reject_old_samples: false
-    split_queries_by_interval: 15m
-    max_query_parallelism: 32
-    max_query_series: 10000
-    retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
-
-  compactor:
-    compaction_interval: 10m
-    retention_enabled: true
-    retention_delete_delay: 2h
-
-  querier:
-    max_concurrent: 2048
-
-  query_scheduler:
-    max_outstanding_requests_per_tenant: 10000
-
-  rulerConfig:
-    storage:
-      type: local
-      local:
-        directory: /var/loki/rules
-    rule_path: /tmp/rules
-
-    alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
-
-
-singleBinary:
-  replicas: 1
-
-  extraVolumes:
-    - name: loki-default-rules
-      configMap:
-        name: loki-default-alerting-rules
-
-  extraVolumeMounts:
-    - name: loki-default-rules
-      mountPath: /var/loki/rules
-
-
-write:
-  persistence:
-    volumeClaimsEnabled: true
-    storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
-    size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
-
-test:
-  enabled: false
-
-gateway:
-  enabled: false
-
-monitoring:
-  selfMonitoring:
-    enabled: false
-    grafanaAgent:
-      installOperator: false
-  lokiCanary:
-    enabled: false
-  rules:
-    enabled: true
-    alerting: true
-
-extraObjects:
-  - apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: loki-default-alerting-rules
-      labels:
-        loki_rule: ""
-
-    data:
-      loki-default-alerting-rules.yaml: |-
-        groups:
-          {{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
-          - name: kube-events-alerts
-            rules:
-              - alert: FailedEventsOccured
-                expr: |
-                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
-                for: 1m
-                labels:
-                  severity: critical
-                annotations:
-                  alertname: FailedEventsOccured
-                  instance: kube-cluster
-                  jobName: kube_events
-                  summary: Failed events occured in cluster
-                  addDefaultUrl: "true"
-
-              - alert: OOMKilledEventsOccured
-                expr: |
-                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
-                for: 1m
-                labels:
-                  severity: critical
-                annotations:
-                  alertname: OOMKilledEventsOccured
-                  instance: kube-cluster
-                  jobName: kube_events
-                  summary: OOMKilled events occured in cluster
-                  addDefaultUrl: "true"
-
-              - alert: EvictedEventsOccured
-                expr: |
-                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
-                for: 1m
-                labels:
-                  severity: critical
-                annotations:
-                  alertname: EvictedEventsOccured
-                  instance: kube-cluster
-                  jobName: kube_events
-                  summary: Evicted events occured in cluster
-                  addDefaultUrl: "true"
-
-              - alert: ImagePullBackOffEventsOccured
-                expr: |
-                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
-                for: 1m
-                labels:
-                  severity: critical
-                annotations:
-                  alertname: ImagePullBackOffEventsOccured
-                  instance: kube-cluster
-                  jobName: kube_events
-                  summary: ImagePullBackOff events occured in cluster
-                  addDefaultUrl: "true"
-
-              - alert: BackOffEventsOccured
-                expr: |
-                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
-                for: 1m
-                labels:
-                  severity: critical
-                annotations:
-                  alertname: BackOffEventsOccured
-                  instance: kube-cluster
-                  jobName: kube_events
-                  summary: BackOff events occured in cluster
-                  addDefaultUrl: "true"
-sidecar:
-  rules:
-    enabled: true
-    # -- Label that the configmaps/secrets with rules will be marked with.
-    label: loki_rule
-    # -- Label value that the configmaps/secrets with rules will be set to.
-    labelValue: ""
-    # -- Folder into which the rules will be placed.
-    folder: /var/loki/rules
-    # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
-    # Otherwise the namespace in which the sidecar is running will be used.
-    # It's also possible to specify 'ALL' to search in all namespaces.
-    searchNamespace: 'ALL'
-    # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-    watchMethod: WATCH
-    # -- Search in configmap, secret, or both.
-    resource: both
-    # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
-    script: null
-    # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
-    # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
-    watchServerTimeout: 60
-    #
-    # -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
-    # If you have a network outage dropping all packets with no RST/FIN,
-    # this is how long your client waits before realizing & dropping the connection.
-    # Defaults to 66sec.
-    watchClientTimeout: 60
-    # -- Log level of the sidecar container.
-    logLevel: INFO

internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl

@@ -1,192 +0,0 @@
-image:
-  repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
-  tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
-  pullPolicy: IfNotPresent
-
-imagePullSecrets: []
-# - name: registrySecretName
-
-nameOverride: ""
-fullnameOverride: ""
-
-serviceAccount:
-  # Specifies whether a service account should be created
-  create: true
-  # Annotations to add to the service account
-  annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name: ""
-  # The list of secrets mountable by this service account.
-  # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
-  secrets: []
-
-rbac:
-  # Specifies whether RBAC resources should be created
-  create: true
-  pspEnabled: false
-
-apiService:
-  create: true
-  # Annotations to add to the API service
-  annotations: {}
-  # Specifies whether to skip TLS verification
-  insecureSkipTLSVerify: true
-  # The PEM encoded CA bundle for TLS verification
-  caBundle: ""
-
-commonLabels: {}
-podLabels:
-  "app.kubernetes.io/component": "metrics-server"
-podAnnotations: {}
-
-podSecurityContext: {}
-
-securityContext:
-  allowPrivilegeEscalation: false
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-  runAsUser: 1000
-  seccompProfile:
-    type: RuntimeDefault
-  capabilities:
-    drop:
-      - ALL
-
-priorityClassName: system-cluster-critical
-
-containerPort: 10250
-
-hostNetwork:
-  # Specifies if metrics-server should be started in hostNetwork mode.
-  #
-  # You would require this enabled if you use alternate overlay networking for pods and
-  # API server unable to communicate with metrics-server. As an example, this is required
-  # if you use Weave network on EKS
-  enabled: false
-
-replicas: 1
-
-revisionHistoryLimit:
-
-updateStrategy: {}
-#   type: RollingUpdate
-#   rollingUpdate:
-#     maxSurge: 0
-#     maxUnavailable: 1
-
-podDisruptionBudget:
-  # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-  enabled: false
-  minAvailable:
-  maxUnavailable:
-
-defaultArgs:
-  - --cert-dir=/tmp
-  - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
-  - --kubelet-use-node-status-port
-  - --metric-resolution=15s
-  - --kubelet-insecure-tls
-
-args: []
-
-livenessProbe:
-  httpGet:
-    path: /livez
-    port: https
-    scheme: HTTPS
-  initialDelaySeconds: 0
-  periodSeconds: 10
-  failureThreshold: 3
-
-readinessProbe:
-  httpGet:
-    path: /readyz
-    port: https
-    scheme: HTTPS
-  initialDelaySeconds: 20
-  periodSeconds: 10
-  failureThreshold: 3
-
-service:
-  type: ClusterIP
-  port: 443
-  annotations: {}
-  labels: {}
-  #  Add these labels to have metrics-server show up in `kubectl cluster-info`
-  #  kubernetes.io/cluster-service: "true"
-  #  kubernetes.io/name: "Metrics-server"
-
-addonResizer:
-  enabled: false
-  image:
-    repository: registry.k8s.io/autoscaling/addon-resizer
-    tag: 1.8.20
-  securityContext:
-    allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: true
-    runAsNonRoot: true
-    runAsUser: 1000
-    seccompProfile:
-      type: RuntimeDefault
-    capabilities:
-      drop:
-        - ALL
-  resources:
-    requests:
-      cpu: 40m
-      memory: 25Mi
-    limits:
-      cpu: 40m
-      memory: 25Mi
-  nanny:
-    cpu: 0m
-    extraCpu: 1m
-    memory: 0Mi
-    extraMemory: 2Mi
-    minClusterSize: 100
-    pollPeriod: 300000
-    threshold: 5
-
-metrics:
-  enabled: true
-
-serviceMonitor:
-  enabled: true
-  additionalLabels: {}
-  interval: 1m
-  scrapeTimeout: 10s
-  metricRelabelings: []
-  relabelings: []
-
-# See https://github.com/kubernetes-sigs/metrics-server#scaling
-resources:
-  requests:
-    cpu: 100m
-    memory: 200Mi
-  # limits:
-  #   cpu:
-  #   memory:
-
-extraVolumeMounts: []
-
-extraVolumes: []
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}
-
-topologySpreadConstraints: []
-
-dnsConfig: {}
-
-# Annotations to add to the deployment
-deploymentAnnotations: {}
-
-schedulerName: ""
-
-tmpVolume:
-  emptyDir: {}
-

internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl

@@ -1,391 +0,0 @@
-prometheus:
-  enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-  serviceMonitor: true
-  image:
-    repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
-    tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
-    pullPolicy: IfNotPresent
-
-  clustering:
-    enabled: false
-    replicas: 3
-    shards: 1
-
-  persistence:
-    enabled: true
-
-    storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
-    storageResources:
-      requests:
-        storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
-
-  scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
-  retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
-  # serviceNodePort: 30008
-
-  additionalConfigs: |
-    - job_name: "kubelet"
-      scheme: https
-      metrics_path: /metrics/cadvisor
-      tls_config:
-        insecure_skip_verify: true
-      authorization:
-        credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-      kubernetes_sd_configs:
-        - role: node
-      relabel_configs:
-        - action: labelmap
-          regex: __meta_kubernetes_node_label_(.+)
-
-    - job_name: "kubernetes-apiservers"
-      kubernetes_sd_configs:
-        - role: endpoints
-      scheme: https
-      tls_config:
-        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-      authorization:
-        credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-      relabel_configs:
-        - source_labels:
-            [
-              __meta_kubernetes_namespace,
-              __meta_kubernetes_service_name,
-              __meta_kubernetes_endpoint_port_name,
-            ]
-          action: keep
-          regex: default;kubernetes;https
-
-    - job_name: "coredns"
-      kubernetes_sd_configs:
-        - role: endpoints
-      scheme: http
-      relabel_configs:
-        - source_labels:
-            [
-              __meta_kubernetes_namespace,
-              __meta_kubernetes_service_name,
-              __meta_kubernetes_endpoint_port_name,
-            ]
-          action: keep
-          regex: kube-system;.*dns.*;metrics
-
-    {{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
-    - job_name: 'ingress-endpoints'
-      metrics_path: /probe
-      params:
-        module: [https_ok]
-      kubernetes_sd_configs:
-        - role: ingress
-      relabel_configs:
-        - source_labels: [__address__]
-          target_label: __param_target
-        - source_labels: [__param_target]
-          target_label: instance
-        - source_labels:
-            [
-              __meta_kubernetes_ingress_scheme,
-              __address__,
-              __meta_kubernetes_ingress_path,
-            ]
-          regex: (.+);(.+);(.+)
-          replacement: https://${2}${3}/
-          target_label: __param_target
-        - target_label: __address__
-          replacement: observability-blackbox-exporter:9115
-      {{- end }}
-
-alertManager:
-  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
-  serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-  enableDefaultRules: true
-  image:
-    repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
-    tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
-    pullPolicy: IfNotPresent
-
-  # serviceNodePort: 30009
-
-  configPath: /etc/alertmanager
-  {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
-  additionalMessageTemplates:
-    {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
-  {{- end }}
-  {{- if .Modules.Observability.Monitoring.AlertManager.Route }}
-  route:
-    {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
-  {{- end }}
-  {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
-  receivers:
-    {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
-  {{- end }}
-
-blackboxExporter:
-  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
-  serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-  image:
-    repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
-    tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
-    pullPolicy: IfNotPresent
-
-  # serviceNodePort: 30012
-
-  configPath: /etc/blackbox_exporter
-  additionalModules:
-
-
-kubeStateMetrics:
-  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
-  image:
-    repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
-    tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
-    pullPolicy: IfNotPresent
-  resources:
-    requests:
-      cpu: 30m
-      memory: 120Mi
-    limits:
-      memory: 240Mi
-      cpu: 60m
-
-prometheusOperator:
-  enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-  image:
-    repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
-    tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
-    pullPolicy: IfNotPresent
-
-  prometheusConfigReloader:
-    image:
-      repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
-      tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
-      pullPolicy: IfNotPresent
-
-  kubeRbacProxy:
-    image:
-      repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
-      tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
-      pullPolicy: IfNotPresent
-
-nodeExporter:
-  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
-  image:
-    repository: {{ .Modules.Observability.Monitoring.Node.Image }}
-    tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
-    pullPolicy: IfNotPresent
-
-kubeEventsExporter:
-  enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
-  image:
-    repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
-    tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
-    pullPolicy: IfNotPresent
-  lokiAddress: http://loki.observability.svc.cluster.local:3100
-  logLevel: warn
-  logFormat: json
-  kubeQPS: 100
-  kubeBurst: 500
-  maxEventAgeSeconds: 120
-  metricsNamePrefix: event_exporter_
-
-  cron:
-    restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
-    image:
-      repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
-      tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
-      pullPolicy: IfNotPresent
-  additionalRoutes:
-  additionalReceivers:
-
-grafana:
-  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
-  serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-  domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-  path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
-  {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
-  serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
-  {{- end }}
-  image:
-    repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
-    tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
-    pullPolicy: IfNotPresent
-
-  storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
-  storageResources:
-    requests:
-      storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
-
-  config:
-    server: |
-      enable_gzip = true
-      root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
-      {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path  "/") }}
-      serve_from_sub_path = true
-      {{- end }}
-
-    security: |
-      admin_user = admin
-      admin_password = {{ .Modules.AdminPassword }}
-
-    auth: |
-      {{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
-
-    authGenericAuth: |
-      {{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
-
-    additionalDatasources:
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-      - name: Kube-loki
-        type: loki
-        uid: P2895588539814C92
-        access: proxy
-        url: http://loki:3100
-        editable: false
-        basicAuth: false
-        isDefault: false
-        jsonData:
-          maxLines: 1000
-      {{- end }}
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      - name: Kube-jaeger-query
-        type: jaeger
-        access: proxy
-        url: http://tempo:16686
-        editable: false
-        basicAuth: false
-        isDefault: false
-      {{- end }}
-      {{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
-      {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
-      {{- end }}
-
-opentelemetryCollector:
-  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  serviceMonitor: true
-  config: |
-    receivers:
-      otlp:
-        protocols:
-          grpc:
-          http:
-    exporters:
-      otlphttp:
-        endpoint: http://tempo:4318
-    service:
-      telemetry:
-        logs:
-          level: "debug"
-      pipelines:
-        traces:
-          receivers: [otlp]
-          exporters: [otlphttp]
-
-ingress:
-  {{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
-  enabled: true
-  {{- else }}
-  enabled: false
-  {{- end }}
-  accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-  class: {{ .Modules.Additional.Ingress.Type }}
-  annotations:
-    {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-    nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-    nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-    {{- end }}
-  tls:
-    {{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
-    enabled: true
-    {{- end }}
-    hosts:
-      - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-        secretName: grafana-tls
-
-containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-
-fluentbit:
-  enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-  serviceMonitor: true
-  image:
-    repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
-    tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
-
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-          - matchExpressions:
-              - key: node-role.kubernetes.io/edge
-                operator: DoesNotExist
-  tolerations:
-    - operator: Exists
-
-  input:
-    tail:
-      enable: true
-      refreshIntervalSeconds: 10
-      memBufLimit: 100MB
-      bufferMaxSize: ""
-      path: "/var/log/containers/*.log"
-      skipLongLines: true
-      readFromHead: false
-      storageType: memory
-      pauseOnChunksOverlimit: "off"
-    systemd:
-      enable: true
-      systemdFilter:
-        enable: true
-        filters: []
-      path: "/var/log/journal"
-      includeKubelet: true
-      stripUnderscores: "off"
-      storageType: memory
-      pauseOnChunksOverlimit: "off"
-
-    nodeExporterMetrics: {}
-    fluentBitMetrics: {}
-
-  output:
-    es:
-      enable: false
-      host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
-      port: 9200
-      logstashPrefix: ks-logstash-log
-      bufferSize: 20MB
-      traceError: true
-    kafka:
-      enable: false
-      brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
-      topics: ks-log
-    opentelemetry: {}
-    opensearch:
-      enable: false
-    stdout:
-      enable: false
-    loki:
-      enable: true
-      host: loki
-      port: 3100
-
-    stackdriver: {}
-
-  service:
-    storage: {}
-
-  filter:
-    kubernetes:
-      enable: true
-      labels: true
-      annotations: true
-    containerd:
-      enable: true
-    systemd:
-      enable: true
-
-  kubeedge:
-    enable: false
-    prometheusRemoteWrite:
-      # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
-      host: "<cloud-prometheus-service-host>"
-      # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
-      port: "<cloud-prometheus-service-port>"

internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl

@@ -1,134 +0,0 @@
-replicaCount: 1
-nameOverride: ""
-imagePullSecrets: []
-pdb:
-  create: false
-  minAvailable: 1
-  maxUnavailable: ""
-
-manager:
-  image:
-    repository: {{ .Modules.Observability.Tracing.Operator.Image }}
-    tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
-  collectorImage:
-    repository: {{ .Modules.Observability.Tracing.Collector.Image }}
-    tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
-
-  featureGates: ""
-  ports:
-    metricsPort: 8080
-    webhookPort: 9443
-    healthzPort: 8081
-  resources:
-    limits:
-      cpu: 100m
-      memory: 128Mi
-    requests:
-      cpu: 100m
-      memory: 64Mi
-  env:
-    ENABLE_WEBHOOKS: "true"
-
-  serviceAccount:
-    create: true
-    annotations: {}
-
-  serviceMonitor:
-    enabled: true
-    metricsEndpoints:
-      - port: metrics
-
-  prometheusRule:
-    enabled: true
-    groups: []
-    defaultRules:
-      enabled: true
-
-  extraArgs: []
-
-  leaderElection:
-    enabled: true
-
-  verticalPodAutoscaler:
-    enabled: false
-    controlledResources: []
-    maxAllowed: {}
-    minAllowed: {}
-
-    updatePolicy:
-      updateMode: Auto
-      minReplicas: 2
-  rolling: false
-
-  securityContext: {}
-
-kubeRBACProxy:
-  enabled: true
-  image:
-    repository: quay.io/brancz/kube-rbac-proxy
-    tag: v0.15.0
-  ports:
-    proxyPort: 8443
-  resources:
-    limits:
-      cpu: 500m
-      memory: 128Mi
-    requests:
-      cpu: 5m
-      memory: 64Mi
-
-  extraArgs: []
-
-  securityContext: {}
-
-admissionWebhooks:
-  create: true
-  servicePort: 443
-  failurePolicy: Fail
-  secretName: ""
-  pods:
-    failurePolicy: Ignore
-
-  namePrefix: ""
-
-  timeoutSeconds: 10
-
-  namespaceSelector: {}
-  objectSelector: {}
-  certManager:
-    enabled: true
-    issuerRef: {}
-    certificateAnnotations: {}
-    issuerAnnotations: {}
-
-  autoGenerateCert:
-    enabled: true
-    recreate: true
-
-  secretAnnotations: {}
-  secretLabels: {}
-
-role:
-  create: true
-
-clusterRole:
-  create: true
-
-affinity: {}
-tolerations: []
-nodeSelector: {}
-topologySpreadConstraints: []
-hostNetwork: false
-
-priorityClassName: ""
-
-securityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  fsGroup: 65532
-
-testFramework:
-  image:
-    repository: busybox
-    tag: latest

internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl

@@ -1,68 +0,0 @@
-replicas: 1
-
-tempo:
-  repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
-  tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
-  pullPolicy: IfNotPresent
-
-  updateStrategy: RollingUpdate
-
-  memBallastSizeMbs: 1024
-  multitenancyEnabled: false
-  reportingEnabled: false
-
-  metricsGenerator:
-    enabled: false
-    remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
-  retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
-  global_overrides:
-    per_tenant_override_config: /conf/overrides.yaml
-
-  server:
-    http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
-  storage:
-    trace:
-      backend: local
-      local:
-        path: /var/tempo/traces
-      wal:
-        path: /var/tempo/wal
-  receivers:
-    otlp:
-      protocols:
-        grpc:
-          endpoint: "0.0.0.0:4317"
-        http:
-          endpoint: "0.0.0.0:4318"
-
-tempoQuery:
-  repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
-  tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
-  pullPolicy: IfNotPresent
-
-  enabled: true
-
-  service:
-    port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
-
-  ingress:
-    enabled: false
-
-serviceAccount:
-  create: true
-  automountServiceAccountToken: true
-
-service:
-  type: ClusterIP
-
-serviceMonitor:
-  enabled: true
-
-persistence:
-  enabled: true
-  storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
-  accessModes:
-    - ReadWriteOnce
-  size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
-
-priorityClassName: null

internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl

@@ -1,6 +0,0 @@
-issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
-solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
-
-certificates:
-  - name: harbor-tls
-    domain: {{ .Modules.Registry.Expose.Domain }}

internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl

@@ -1,371 +0,0 @@
-expose:
-  type: {{ .Modules.Registry.Expose.Type }}
-  tls:
-    enabled: {{ .Modules.Registry.Tls.Enabled }}
-    certSource: secret
-    secret:
-      secretName: harbor-tls
-  ingress:
-    hosts:
-      core: {{ .Modules.Registry.Expose.Domain }}
-    controller: default
-    kubeVersionOverride: ""
-    className: "{{ .Modules.Additional.Ingress.Type }}"
-    annotations:
-      ingress.kubernetes.io/ssl-redirect: "true"
-      ingress.kubernetes.io/proxy-body-size: "0"
-      {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-      nginx.ingress.kubernetes.io/ssl-redirect: "true"
-      nginx.ingress.kubernetes.io/proxy-body-size: "0"
-      {{- end }}
-    labels: {}
-
-  nodePort:
-    name: harbor
-    ports:
-      http:
-        port: 80
-        nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
-      https:
-        port: 443
-        nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
-
-externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}{{ if not (eq  .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
-persistence:
-  resourcePolicy: "keep"
-  persistentVolumeClaim:
-    registry:
-      existingClaim: ""
-      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-      subPath: ""
-      accessMode: ReadWriteOnce
-      size: {{ .Modules.Registry.Persistence.RegistrySize  }}
-      annotations: {}
-    jobservice:
-      jobLog:
-        existingClaim: ""
-        storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-        subPath: ""
-        accessMode: ReadWriteOnce
-        size: {{ .Modules.Registry.Persistence.JobserviceSize  }}
-        annotations: {}
-    database:
-      existingClaim: ""
-      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-      subPath: ""
-      accessMode: ReadWriteOnce
-      size: {{ .Modules.Registry.Persistence.DatabaseSize  }}
-      annotations: {}
-    redis:
-      existingClaim: ""
-      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-      subPath: ""
-      accessMode: ReadWriteOnce
-      size: {{ .Modules.Registry.Persistence.RedisSize }}
-      annotations: {}
-    trivy:
-      existingClaim: ""
-      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-      subPath: ""
-      accessMode: ReadWriteOnce
-      size: {{ .Modules.Registry.Persistence.TrivySize }}
-      annotations: {}
-
-  imageChartStorage:
-    disableredirect: false
-
-    type: filesystem
-    filesystem:
-      rootdirectory: /storage
-      #maxthreads: 100
-
-imagePullPolicy: IfNotPresent
-
-updateStrategy:
-  type: RollingUpdate
-
-harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
-
-logLevel: info
-
-metrics:
-  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-  core:
-    path: /metrics
-    port: 8001
-  registry:
-    path: /metrics
-    port: 8001
-  jobservice:
-    path: /metrics
-    port: 8001
-  exporter:
-    path: /metrics
-    port: 8001
-
-  serviceMonitor:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-trace:
-  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  provider: otel
-  sample_rate: 1
-  attributes:
-    application: harbor
-  jaeger:
-    endpoint: http://hostname:14268/api/traces
-  otel:
-    endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
-    url_path: /v1/traces
-    compression: false
-    insecure: true
-    timeout: 10
-
-portal:
-  image:
-    repository: {{ .Modules.Registry.Portal.Image }}
-    tag: {{ .Modules.Registry.Portal.Tag }}
-  serviceAccountName: ""
-  automountServiceAccountToken: false
-  replicas: 1
-  revisionHistoryLimit: 10
-
-  topologySpreadConstraints: []
-
-  podLabels:
-    "app.kubernetes.io/component": "harbor-portal"
-  priorityClassName:
-
-core:
-  image:
-    repository: {{ .Modules.Registry.Core.Image }}
-    tag: {{ .Modules.Registry.Portal.Tag }}
-  serviceAccountName: ""
-  automountServiceAccountToken: false
-  replicas: 1
-  revisionHistoryLimit: 10
-  startupProbe:
-    enabled: true
-    initialDelaySeconds: 10
-  extraEnvVars: []
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
-  topologySpreadConstraints: []
-  podLabels:
-    "app.kubernetes.io/component": "harbor-core"
-  serviceAnnotations: {}
-  priorityClassName:
-  configureUserSettings:
-  quotaUpdateProvider: db # Or redis
-  secret: ""
-  existingSecret: ""
-  secretName: ""
-  tokenKey: ""
-
-  tokenCert: ""
-
-  xsrfKey: ""
-  existingXsrfSecret: ""
-  existingXsrfSecretKey: CSRF_KEY
-  artifactPullAsyncFlushDuration:
-  gdpr:
-    deleteUser: false
-    auditLogsCompliant: false
-
-
-jobservice:
-  image:
-    repository: {{ .Modules.Registry.Jobservice.Image }}
-    tag: {{ .Modules.Registry.Jobservice.Tag }}
-  serviceAccountName: ""
-  automountServiceAccountToken: false
-  replicas: 1
-  revisionHistoryLimit: 10
-  topologySpreadConstraints:
-  podLabels:
-    "app.kubernetes.io/component": "harbor-jobservice"
-  priorityClassName:
-  maxJobWorkers: 10
-  jobLoggers:
-    - file
-    # - database
-    # - stdout
-  loggerSweeperDuration: 14 #days
-  notification:
-    webhook_job_max_retry: 3
-    webhook_job_http_client_timeout: 3 # in seconds
-  reaper:
-    max_update_hours: 24
-    max_dangling_hours: 168
-  secret: ""
-  existingSecret: ""
-  existingSecretKey: JOBSERVICE_SECRET
-
-registry:
-  registry:
-    image:
-      repository: {{ .Modules.Registry.Registry.Registry.Image }}
-      tag: {{ .Modules.Registry.Registry.Registry.Tag }}
-    extraEnvVars: []
-  controller:
-    image:
-      repository: {{ .Modules.Registry.Registry.Controller.Image }}
-      tag: {{ .Modules.Registry.Registry.Controller.Tag }}
-    extraEnvVars: []
-  serviceAccountName: ""
-  automountServiceAccountToken: false
-  replicas: 1
-  revisionHistoryLimit: 10
-  topologySpreadConstraints: []
-  podLabels:
-    "app.kubernetes.io/component": "harbor-registry"
-  priorityClassName:
-  secret: ""
-  existingSecret: ""
-  existingSecretKey: REGISTRY_HTTP_SECRET
-  relativeurls: false
-  credentials:
-    # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
-    existingSecret: ""
-    # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
-    # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
-    # htpasswdString: ""
-  middleware:
-    enabled: false
-    type: cloudFront
-    cloudFront:
-      baseurl: example.cloudfront.net
-      keypairid: KEYPAIRID
-      duration: 3000s
-      ipfilteredby: none
-      # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
-      # that allows access to CloudFront
-      privateKeySecret: "my-secret"
-  # enable purge _upload directories
-  upload_purging:
-    enabled: true
-    # remove files in _upload directories which exist for a period of time, default is one week.
-    age: 168h
-    # the interval of the purge operations
-    interval: 24h
-    dryrun: false
-
-trivy:
-  enabled: {{ .Modules.Registry.EnabledScanner }}
-  image:
-    repository: {{ .Modules.Registry.Trivy.Image }}
-    tag: {{ .Modules.Registry.Trivy.Tag }}
-  serviceAccountName: ""
-  automountServiceAccountToken: false
-  resources:
-    requests:
-      cpu: 200m
-      memory: 512Mi
-    limits:
-      cpu: 1
-      memory: 1Gi
-
-
-database:
-  # if external database is used, set "type" to "external"
-  # and fill the connection information in "external" section
-  type: internal
-  internal:
-    image:
-      repository: {{ .Modules.Registry.Database.Image }}
-      tag: {{ .Modules.Registry.Database.Tag }}
-    serviceAccountName: ""
-    automountServiceAccountToken: false
-    livenessProbe:
-      timeoutSeconds: 1
-    readinessProbe:
-      timeoutSeconds: 1
-    priorityClassName:
-    # The initial superuser password for internal database
-    # password: "changeit"
-    # The size limit for Shared memory, pgSQL use it for shared_buffer
-    # More details see:
-    # https://github.com/goharbor/harbor/issues/15034
-    shmSizeLimit: 512Mi
-    initContainer:
-      migrator: {}
-      # resources:
-      #  requests:
-      #    memory: 128Mi
-      #    cpu: 100m
-      permissions: {}
-      # resources:
-      #  requests:
-      #    memory: 128Mi
-      #    cpu: 100m
-  external:
-    host: "192.168.0.1"
-    port: "5432"
-    username: "user"
-    password: "password"
-    coreDatabase: "registry"
-    # if using existing secret, the key must be "password"
-    existingSecret: ""
-    # "disable" - No SSL
-    # "require" - Always SSL (skip verification)
-    # "verify-ca" - Always SSL (verify that the certificate presented by the
-    # server was signed by a trusted CA)
-    # "verify-full" - Always SSL (verify that the certification presented by the
-    # server was signed by a trusted CA and the server host name matches the one
-    # in the certificate)
-    sslmode: "disable"
-  # The maximum number of connections in the idle connection pool per pod (core+exporter).
-  # If it <=0, no idle connections are retained.
-  maxIdleConns: 100
-  # The maximum number of open connections to the database per pod (core+exporter).
-  # If it <= 0, then there is no limit on the number of open connections.
-  # Note: the default number of connections is 1024 for postgre of harbor.
-  maxOpenConns: 900
-  ## Additional deployment annotations
-  podAnnotations: {}
-  ## Additional deployment labels
-  podLabels: {}
-
-
-redis:
-  type: internal
-  internal:
-    image:
-      repository: {{ .Modules.Registry.Redis.Image }}
-      tag: {{ .Modules.Registry.Redis.Tag }}
-    serviceAccountName: ""
-    automountServiceAccountToken: false
-    extraEnvVars: []
-    nodeSelector: {}
-    tolerations: []
-    affinity: {}
-    priorityClassName:
-    jobserviceDatabaseIndex: "1"
-    registryDatabaseIndex: "2"
-    trivyAdapterIndex: "5"
-    # harborDatabaseIndex: "6"
-    # cacheLayerDatabaseIndex: "7"
-  external:
-    # support redis, redis+sentinel
-    # addr for redis: <host_redis>:<port_redis>
-    # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
-    addr: "192.168.0.2:6379"
-    # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
-    sentinelMasterSet: ""
-    # The "coreDatabaseIndex" must be "0" as the library Harbor
-    # used doesn't support configuring it
-    # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
-    # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
-    coreDatabaseIndex: "0"
-    jobserviceDatabaseIndex: "1"
-    registryDatabaseIndex: "2"
-    trivyAdapterIndex: "5"
-    # harborDatabaseIndex: "6"
-    # cacheLayerDatabaseIndex: "7"
-    # username field can be an empty string, and it will be authenticated against the default user
-    username: ""
-    password: ""
-    existingSecret: ""
-  podAnnotations: {}
-  podLabels: {}

internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl

@@ -1,873 +0,0 @@
-global:
-  enabled: true
-
-  imagePullSecrets: []
-  tlsDisable: true
-
-  externalVaultAddr: ""
-
-  openshift: false
-
-  # Create PodSecurityPolicy for pods
-  psp:
-    enable: false
-    # Annotation for PodSecurityPolicy.
-    # This is a multi-line templated string map, and can also be set as YAML.
-    annotations: |
-      seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-      apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-      seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
-      apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
-
-  serverTelemetry:
-    # Enable integration with the Prometheus Operator
-    # See the top level serverTelemetry section below before enabling this feature.
-    prometheusOperator: false
-
-injector:
-  enabled: true
-
-  replicas: 1
-
-  # Configures the port the injector should listen on
-  port: 8080
-
-  # If multiple replicas are specified, by default a leader will be determined
-  # so that only one injector attempts to create TLS certificates.
-  leaderElector:
-    enabled: true
-
-  # If true, will enable a node exporter metrics endpoint at /metrics.
-  metrics:
-    enabled: false
-
-  # Deprecated: Please use global.externalVaultAddr instead.
-  externalVaultAddr: ""
-
-  # image sets the repo and tag of the vault-k8s image to use for the injector.
-  image:
-    repository: "{{ .Modules.SecretsStorage.Injector.Image }}"
-    tag: "{{ .Modules.SecretsStorage.Injector.Tag }}"
-    pullPolicy: IfNotPresent
-
-  # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
-  # containers.  This should be set to the official Vault image.  Vault 1.3.1+ is
-  # required.
-  agentImage:
-    repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
-    tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
-  agentDefaults:
-    cpuLimit: "500m"
-    cpuRequest: "250m"
-    memLimit: "128Mi"
-    memRequest: "64Mi"
-    # ephemeralLimit: "128Mi"
-    # ephemeralRequest: "64Mi"
-
-    # Default template type for secrets when no custom template is specified.
-    # Possible values include: "json" and "map".
-    template: "map"
-
-    # Default values within Agent's template_config stanza.
-    templateConfig:
-      exitOnRetryFailure: true
-      staticSecretRenderInterval: ""
-
-  # Used to define custom livenessProbe settings
-  livenessProbe:
-    # When a probe fails, Kubernetes will try failureThreshold times before giving up
-    failureThreshold: 2
-    # Number of seconds after the container has started before probe initiates
-    initialDelaySeconds: 5
-    # How often (in seconds) to perform the probe
-    periodSeconds: 2
-    # Minimum consecutive successes for the probe to be considered successful after having failed
-    successThreshold: 1
-    # Number of seconds after which the probe times out.
-    timeoutSeconds: 5
-  # Used to define custom readinessProbe settings
-  readinessProbe:
-    # When a probe fails, Kubernetes will try failureThreshold times before giving up
-    failureThreshold: 2
-    # Number of seconds after the container has started before probe initiates
-    initialDelaySeconds: 5
-    # How often (in seconds) to perform the probe
-    periodSeconds: 2
-    # Minimum consecutive successes for the probe to be considered successful after having failed
-    successThreshold: 1
-    # Number of seconds after which the probe times out.
-    timeoutSeconds: 5
-  # Used to define custom startupProbe settings
-  startupProbe:
-    # When a probe fails, Kubernetes will try failureThreshold times before giving up
-    failureThreshold: 12
-    # Number of seconds after the container has started before probe initiates
-    initialDelaySeconds: 5
-    # How often (in seconds) to perform the probe
-    periodSeconds: 5
-    # Minimum consecutive successes for the probe to be considered successful after having failed
-    successThreshold: 1
-    # Number of seconds after which the probe times out.
-    timeoutSeconds: 5
-
-  # Mount Path of the Vault Kubernetes Auth Method.
-  authPath: "auth/kubernetes"
-
-  # Configures the log verbosity of the injector.
-  # Supported log levels include: trace, debug, info, warn, error
-  logLevel: "info"
-
-  # Configures the log format of the injector. Supported log formats: "standard", "json".
-  logFormat: "standard"
-
-  # Configures all Vault Agent sidecars to revoke their token when shutting down
-  revokeOnShutdown: false
-
-  webhook:
-    # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
-    # API Tag of the WebHook.
-    # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
-    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
-    #
-    failurePolicy: Ignore
-
-    # matchPolicy specifies the approach to accepting changes based on the rules of
-    # the MutatingWebhookConfiguration.
-    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
-    # for more details.
-    #
-    matchPolicy: Exact
-
-    # timeoutSeconds is the amount of seconds before the webhook request will be ignored
-    # or fails.
-    # If it is ignored or fails depends on the failurePolicy
-    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
-    # for more details.
-    #
-    timeoutSeconds: 30
-
-    # namespaceSelector is the selector for restricting the webhook to only
-    # specific namespaces.
-    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
-    # for more details.
-    # Example:
-    # namespaceSelector:
-    #    matchLabels:
-    #      sidecar-injector: enabled
-    namespaceSelector: {}
-
-    # objectSelector is the selector for restricting the webhook to only
-    # specific labels.
-    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
-    # for more details.
-    # Example:
-    # objectSelector:
-    #    matchLabels:
-    #      vault-sidecar-injector: enabled
-
-    # Extra annotations to attach to the webhook
-    annotations: {}
-
-  # Deprecated: please use 'webhook.failurePolicy' instead
-  # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
-  # API Tag of the WebHook.
-  # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
-  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
-  #
-  failurePolicy: Ignore
-
-  # Deprecated: please use 'webhook.namespaceSelector' instead
-  # namespaceSelector is the selector for restricting the webhook to only
-  # specific namespaces.
-  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
-  # for more details.
-  # Example:
-  # namespaceSelector:
-  #    matchLabels:
-  #      sidecar-injector: enabled
-  namespaceSelector: {}
-
-  # Deprecated: please use 'webhook.objectSelector' instead
-  # objectSelector is the selector for restricting the webhook to only
-  # specific labels.
-  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
-  # for more details.
-  # Example:
-  # objectSelector:
-  #    matchLabels:
-  #      vault-sidecar-injector: enabled
-  objectSelector: {}
-
-  # Deprecated: please use 'webhook.annotations' instead
-  # Extra annotations to attach to the webhook
-  webhookAnnotations: {}
-
-  certs:
-    # secretName is the name of the secret that has the TLS certificate and
-    # private key to serve the injector webhook. If this is null, then the
-    # injector will default to its automatic management mode that will assign
-    # a service account to the injector to generate its own certificates.
-    secretName: null
-
-    # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
-    # that signed the TLS certificate that the webhook serves. This must be set
-    # if secretName is non-null unless an external service like cert-manager is
-    # keeping the caBundle updated.
-    caBundle: ""
-
-    # certName and keyName are the names of the files within the secret for
-    # the TLS cert and private key, respectively. These have reasonable
-    # defaults but can be customized if necessary.
-    certName: tls.crt
-    keyName: tls.key
-
-  securityContext:
-    pod: {}
-    container: {}
-
-  resources: {}
-
-  # extraEnvironmentVars is a list of extra environment variables to set in the
-  # injector deployment.
-  extraEnvironmentVars: {}
-    # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
-
-  topologySpreadConstraints: []
-
-  tolerations: []
-
-  nodeSelector: {}
-
-  priorityClassName: ""
-
-  annotations: {}
-
-  extraLabels: {}
-
-  hostNetwork: false
-
-
-  service:
-    # Extra annotations to attach to the injector service
-    annotations: {}
-
-  # Injector serviceAccount specific config
-  serviceAccount:
-    # Extra annotations to attach to the injector serviceAccount
-    annotations: {}
-
-  # A disruption budget limits the number of pods of a replicated application
-  # that are down simultaneously from voluntary disruptions
-  podDisruptionBudget: {}
-  # podDisruptionBudget:
-  #   maxUnavailable: 1
-
-  # strategy for updating the deployment. This can be a multi-line string or a
-  # YAML map.
-  strategy: {}
-  # strategy: |
-  #   rollingUpdate:
-  #     maxSurge: 25%
-  #     maxUnavailable: 25%
-  #   type: RollingUpdate
-
-server:
-  enabled: true
-  enterpriseLicense:
-    # The name of the Kubernetes secret that holds the enterprise license. The
-    # secret must be in the same namespace that Vault is installed into.
-    secretName: ""
-    # The key within the Kubernetes secret that holds the enterprise license.
-    secretKey: "license"
-
-  image:
-    repository: "{{ .Modules.SecretsStorage.Server.Image }}"
-    tag: "{{ .Modules.SecretsStorage.Server.Tag }}"
-    # Overrides the default Image Pull Policy
-    pullPolicy: IfNotPresent
-
-  updateStrategyType: "RollingUpdate"
-
-  # Supported log levels include: trace, debug, info, warn, error
-  logLevel: ""
-
-  # Supported log formats include: standard, json
-  logFormat: ""
-
-  resources: {}
-
-  hostAliases: []
-  # - ip: 127.0.0.1
-  #   hostnames:
-  #     - chart-example.local
-
-  route:
-    enabled: false
-
-    # When HA mode is enabled and K8s service registration is being used,
-    # configure the route to point to the Vault active service.
-    activeService: true
-
-    labels: {}
-    annotations: {}
-    host: chart-example.local
-    # tls will be passed directly to the route's TLS config, which
-    # can be used to configure other termination methods that terminate
-    # TLS at the router
-    tls:
-      termination: passthrough
-
-  # authDelegator enables a cluster role binding to be attached to the service
-  # account.  This cluster role binding can be used to setup Kubernetes auth
-  # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
-  authDelegator:
-    enabled: true
-
-  extraInitContainers: null
-  extraContainers: null
-  shareProcessNamespace: false
-  extraArgs: ""
-
-  extraPorts: null
-    # - containerPort: 8300
-    #   name: http-monitoring
-
-  readinessProbe:
-    enabled: false
-    # If you need to use a http path instead of the default exec
-    # path: /v1/sys/health?standbyok=true
-
-    # Port number on which readinessProbe will be checked.
-    port: 8200
-    # When a probe fails, Kubernetes will try failureThreshold times before giving up
-    failureThreshold: 2
-    # Number of seconds after the container has started before probe initiates
-    initialDelaySeconds: 5
-    # How often (in seconds) to perform the probe
-    periodSeconds: 5
-    # Minimum consecutive successes for the probe to be considered successful after having failed
-    successThreshold: 1
-    # Number of seconds after which the probe times out.
-    timeoutSeconds: 3
-  # Used to enable a livenessProbe for the pods
-  livenessProbe:
-    enabled: false
-    # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
-    execCommand: []
-    # - /bin/sh
-    # - -c
-    # - /vault/userconfig/mylivenessscript/run.sh
-    # Path for the livenessProbe to use httpGet as the livenessProbe handler
-    path: "/v1/sys/health?standbyok=true"
-    # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
-    port: 8200
-    # When a probe fails, Kubernetes will try failureThreshold times before giving up
-    failureThreshold: 2
-    # Number of seconds after the container has started before probe initiates
-    initialDelaySeconds: 60
-    # How often (in seconds) to perform the probe
-    periodSeconds: 5
-    # Minimum consecutive successes for the probe to be considered successful after having failed
-    successThreshold: 1
-    # Number of seconds after which the probe times out.
-    timeoutSeconds: 3
-
-  terminationGracePeriodSeconds: 10
-
-  # Used to set the sleep time during the preStop step
-  preStopSleepSeconds: 5
-
-  extraEnvironmentVars: {}
-
-  extraSecretEnvironmentVars: []
-
-  extraVolumes: []
-
-  volumes: null
-
-  volumeMounts: null
-
-  topologySpreadConstraints: []
-
-  tolerations: []
-  nodeSelector: {}
-
-  # Enables network policy for server pods
-  networkPolicy:
-    enabled: false
-    egress: []
-    # egress:
-    # - to:
-    #   - ipBlock:
-    #       cidr: 10.0.0.0/24
-    #   ports:
-    #   - protocol: TCP
-    #     port: 443
-    ingress:
-      - from:
-        - namespaceSelector: {}
-        ports:
-        - port: 8200
-          protocol: TCP
-        - port: 8201
-          protocol: TCP
-
-  priorityClassName: ""
-  extraLabels: {}
-
-  annotations: {}
-
-  service:
-    enabled: true
-    # Enable or disable the vault-active service, which selects Vault pods that
-    # have labeled themselves as the cluster leader with `vault-active: "true"`.
-    active:
-      enabled: true
-      # Extra annotations for the service definition. This can either be YAML or a
-      # YAML-formatted multi-line templated string map of the annotations to apply
-      # to the active service.
-      annotations: {}
-    # Enable or disable the vault-standby service, which selects Vault pods that
-    # have labeled themselves as a cluster follower with `vault-active: "false"`.
-    standby:
-      enabled: true
-      # Extra annotations for the service definition. This can either be YAML or a
-      # YAML-formatted multi-line templated string map of the annotations to apply
-      # to the standby service.
-      annotations: {}
-    # When disabled, services may select Vault pods not deployed from the chart.
-    # Does not affect the headless vault-internal service with `ClusterIP: None`
-    instanceSelector:
-      enabled: true
-    # clusterIP controls whether a Cluster IP address is attached to the
-    # Vault service within Kubernetes.  By default, the Vault service will
-    # be given a Cluster IP address, set to None to disable.  When disabled
-    # Kubernetes will create a "headless" service.  Headless services can be
-    # used to communicate with pods directly through DNS instead of a round-robin
-    # load balancer.
-    # clusterIP: None
-
-    # Configures the service type for the main Vault service.  Can be ClusterIP
-    # or NodePort.
-    #type: ClusterIP
-
-    # The IP family and IP families options are to set the behaviour in a dual-stack environment.
-    # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
-    # should be.
-    # These are only supported for kubernetes versions >=1.23.0
-    #
-    # Configures the service's supported IP family policy, can be either:
-    #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
-    #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
-    #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
-    ipFamilyPolicy: ""
-
-    # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
-    # Can be IPv4 and/or IPv6.
-    ipFamilies: []
-
-    # Do not wait for pods to be ready before including them in the services'
-    # targets. Does not apply to the headless service, which is used for
-    # cluster-internal communication.
-    publishNotReadyAddresses: true
-
-    # The externalTrafficPolicy can be set to either Cluster or Local
-    # and is only valid for LoadBalancer and NodePort service types.
-    # The default value is Cluster.
-    # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
-    externalTrafficPolicy: Cluster
-
-    # If type is set to "NodePort", a specific nodePort value can be configured,
-    # will be random if left blank.
-    #nodePort: 30000
-
-    # When HA mode is enabled
-    # If type is set to "NodePort", a specific nodePort value can be configured,
-    # will be random if left blank.
-    #activeNodePort: 30001
-
-    # When HA mode is enabled
-    # If type is set to "NodePort", a specific nodePort value can be configured,
-    # will be random if left blank.
-    #standbyNodePort: 30002
-
-    # Port on which Vault server is listening
-    port: 8200
-    # Target port to which the service should be mapped to
-    targetPort: 8200
-    # Extra annotations for the service definition. This can either be YAML or a
-    # YAML-formatted multi-line templated string map of the annotations to apply
-    # to the service.
-    annotations: {}
-
-  dataStorage:
-    enabled: true
-    size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }}
-    mountPath: "/vault/data"
-    storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }}
-    accessMode: ReadWriteOnce
-    annotations: {}
-    labels: {}
-
-  persistentVolumeClaimRetentionPolicy: {}
-
-  # required for ha installation
-  auditStorage:
-    enabled: false
-    # Size of the PVC created
-    size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }}
-    # Location where the PVC will be mounted.
-    mountPath: "/vault/audit"
-    # Name of the storage class to use.  If null it will use the
-    # configured default Storage Class.
-    storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }}
-    # Access Mode of the storage device being used for the PVC
-    accessMode: ReadWriteOnce
-    # Annotations to apply to the PVC
-    annotations: {}
-    # Labels to apply to the PVC
-    labels: {}
-
-  dev:
-    enabled: false
-
-    # Set VAULT_DEV_ROOT_TOKEN_ID value
-    devRootToken: "root"
-
-  # Run Vault in "standalone" mode. This is the default mode that will deploy if
-  # no arguments are given to helm. This requires a PVC for data storage to use
-  # the "file" backend.  This mode is not highly available and should not be scaled
-  # past a single replica.
-  standalone:
-    enabled: "-"
-
-    # config is a raw string of default configuration when using a Stateful
-    # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
-    # and store data there. This is only used when using a Replica count of 1, and
-    # using a stateful set. This should be HCL.
-
-    # Note: Configuration files are stored in ConfigMaps so sensitive data
-    # such as passwords should be either mounted through extraSecretEnvironmentVars
-    # or through a Kube secret.  For more information see:
-    # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
-    config: |
-      ui = true
-
-      listener "tcp" {
-        tls_disable = 1
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-
-        {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        telemetry {
-          unauthenticated_metrics_access = "true"
-        }
-        {{- end }}
-      }
-      storage "file" {
-        path = "/vault/data"
-      }
-
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      telemetry {
-        prometheus_retention_time = "30s"
-        disable_hostname = true
-      }
-      {{- end }}
-
-  # Run Vault in "HA" mode. There are no storage requirements unless the audit log
-  # persistence is required.  In HA mode Vault will configure itself to use Consul
-  # for its storage backend.  The default configuration provided will work the Consul
-  # Helm project by default.  It is possible to manually configure Vault to use a
-  # different HA backend.
-  ha:
-    enabled: false
-    replicas: 3
-
-    # Set the api_addr configuration for Vault HA
-    # See https://developer.hashicorp.com/vault/docs/configuration#api_addr
-    # If set to null, this will be set to the Pod IP Address
-    apiAddr: null
-
-    # Set the cluster_addr confuguration for Vault HA
-    # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
-    clusterAddr: null
-
-    # Enables Vault's integrated Raft storage.  Unlike the typical HA modes where
-    # Vault's persistence is external (such as Consul), enabling Raft mode will create
-    # persistent volumes for Vault to store data according to the configuration under server.dataStorage.
-    # The Vault cluster will coordinate leader elections and failovers internally.
-    raft:
-      # Enables Raft integrated storage
-      enabled: false
-      # Set the Node Raft ID to the name of the pod
-      setNodeId: false
-
-      config: |
-        ui = true
-
-        listener "tcp" {
-          tls_disable = 1
-          address = "[::]:8200"
-          cluster_address = "[::]:8201"
-
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          telemetry {
-            unauthenticated_metrics_access = "true"
-          }
-          {{- end }}
-        }
-
-        storage "raft" {
-          path = "/vault/data"
-        }
-
-        service_registration "kubernetes" {}
-
-    # config is a raw string of default configuration when using a Stateful
-    # deployment. Default is to use a Consul for its HA storage backend.
-    # This should be HCL.
-
-    # Note: Configuration files are stored in ConfigMaps so sensitive data
-    # such as passwords should be either mounted through extraSecretEnvironmentVars
-    # or through a Kube secret.  For more information see:
-    # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
-    config: |
-      ui = true
-
-      listener "tcp" {
-        tls_disable = 1
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-        {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        telemetry {
-          unauthenticated_metrics_access = "true"
-        }
-        {{- end }}
-      }
-      storage "consul" {
-        path = "vault"
-        address = "HOST_IP:8500"
-      }
-
-      service_registration "kubernetes" {}
-
-      # Example configuration for using auto-unseal, using Google Cloud KMS. The
-      # GKMS keys must already exist, and the cluster must have a service account
-      # that is authorized to access GCP KMS.
-      #seal "gcpckms" {
-      #   project     = "vault-helm-dev-246514"
-      #   region      = "global"
-      #   key_ring    = "vault-helm-unseal-kr"
-      #   crypto_key  = "vault-helm-unseal-key"
-      #}
-
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      telemetry {
-        prometheus_retention_time = "30s"
-        disable_hostname = true
-      }
-      {{- end }}
-
-    # A disruption budget limits the number of pods of a replicated application
-    # that are down simultaneously from voluntary disruptions
-    disruptionBudget:
-      enabled: true
-
-    # maxUnavailable will default to (n/2)-1 where n is the number of
-    # replicas. If you'd like a custom value, you can specify an override here.
-      maxUnavailable: null
-
-  serviceAccount:
-    create: true
-    name: ""
-    createSecret: false
-    annotations: {}
-    extraLabels: {}
-    serviceDiscovery:
-      enabled: true
-
-  statefulSet:
-    annotations: {}
-    securityContext:
-      pod: {}
-      container: {}
-
-  hostNetwork: false
-
-# Vault UI
-ui:
-  enabled: true
-  domain: {{ .Modules.SecretsStorage.Expose.Domain }}
-  path: {{ .Modules.SecretsStorage.Expose.Path }}
-  publishNotReadyAddresses: true
-  # The service should only contain selectors for active Vault pod
-  activeVaultPodOnly: false
-  {{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }}
-  serviceType: "NodePort"
-  serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }}
-  {{- else }}
-  serviceType: "ClusterIP"
-  serviceNodePort: null
-  {{- end }}
-  externalPort: 8200
-  targetPort: 8200
-
-  serviceIPFamilyPolicy: ""
-
-  serviceIPFamilies: []
-
-  externalTrafficPolicy: Cluster
-
-  #loadBalancerSourceRanges:
-  #   - 10.0.0.0/16
-  #   - 1.78.23.3/32
-
-  # loadBalancerIP:
-
-  annotations: {}
-
-csi:
-  # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
-  #
-  # Requires installing the secrets-store-csi-driver separately, see:
-  # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
-  #
-  # With the driver and provider installed, you can mount Vault secrets into volumes
-  # similar to the Vault Agent injector, and you can also sync those secrets into
-  # Kubernetes secrets.
-  enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }}
-
-  image:
-    repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}"
-    tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}"
-    pullPolicy: IfNotPresent
-
-  volumes: null
-
-  volumeMounts: null
-
-  resources: {}
-
-  # Override the default secret name for the CSI Provider's HMAC key used for
-  # generating secret versions.
-  hmacSecretName: ""
-
-  daemonSet:
-    updateStrategy:
-      type: RollingUpdate
-      maxUnavailable: ""
-    # Extra annotations for the daemonSet. This can either be YAML or a
-    # YAML-formatted multi-line templated string map of the annotations to apply
-    # to the daemonSet.
-    annotations: {}
-    # Provider host path (must match the CSI provider's path)
-    providersDir: "/etc/kubernetes/secrets-store-csi-providers"
-    # Kubelet host path
-    kubeletRootDir: "/var/lib/kubelet"
-    # Extra labels to attach to the vault-csi-provider daemonSet
-    # This should be a YAML map of the labels to apply to the csi provider daemonSet
-    extraLabels: {}
-    # security context for the pod template and container in the csi provider daemonSet
-    securityContext:
-      pod: {}
-      container: {}
-
-  pod:
-    annotations: {}
-    tolerations:
-      - key: node-role.kubernetes.io/master
-        effect: NoSchedule
-      - key: node-role.kubernetes.io/control-plane
-        effect: NoSchedule
-    nodeSelector: {}
-    affinity: {}
-    extraLabels: {}
-
-  agent:
-    enabled: true
-    extraArgs: []
-
-    image:
-      repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
-      tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
-      pullPolicy: IfNotPresent
-
-    logFormat: standard
-    logLevel: info
-
-    resources: {}
-
-  priorityClassName: ""
-
-  serviceAccount:
-    annotations: {}
-    extraLabels: {}
-
-  readinessProbe:
-    enabled: true
-    failureThreshold: 2
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    successThreshold: 1
-    timeoutSeconds: 3
-
-  livenessProbe:
-    failureThreshold: 2
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    successThreshold: 1
-    timeoutSeconds: 3
-
-  debug: false
-  extraArgs: []
-
-serverTelemetry:
-  # Enable support for the Prometheus Operator. Currently, this chart does not support
-  # authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
-  # in the `listener "tcp"{}` stanza
-  #  telemetry {
-  #    unauthenticated_metrics_access = "true"
-  #  }
-  #
-  # See the `standalone.config` for a more complete example of this.
-  #
-  # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
-  #
-  # example:
-  #  telemetry {
-  #    prometheus_retention_time = "30s"
-  #    disable_hostname = true
-  #  }
-  #
-  # Configuration for monitoring the Vault server.
-  serviceMonitor:
-    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-    selectors: {}
-    interval: 30s
-    scrapeTimeout: 10s
-
-  prometheusRules:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      selectors: {}
-      rules: []
-
-ingress:
-  {{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
-  enabled: true
-  {{- end }}
-  accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-  class: {{ .Modules.Additional.Ingress.Type }}
-  annotations:
-    {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-    nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-    nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-    {{- end }}
-  tls:
-    {{- if .Modules.SecretsStorage.Expose.Tls.Enabled }}
-    enabled: true
-    {{- end }}
-    hosts:
-      - host: {{ .Modules.SecretsStorage.Expose.Domain }}
-        secretName: vault-tls

internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl

@@ -135,7 +135,5 @@ unsafe_show_logs: false
 ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
 allow_unsupported_distribution_setup: false
 
-## Containerd settings
+## Kubelet additional settings
-# containerd_metadata_root_dir: /app/lib/containerd
+kubelet_custom_flags: "--root-dir={{ .Orchestrator.KubeletDir }}"
-# The state directory for containerd
-# containerd_state_dir: /app/run/containerd

internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl

@@ -0,0 +1,60 @@
+---
+# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
+
+containerd_storage_dir: {{ .Orchestrator.ContainerEngine.DataDir }}
+containerd_state_dir:  {{ .Orchestrator.ContainerEngine.StateDir }}
+
+# containerd_oom_score: 0
+
+# containerd_default_runtime: "runc"
+# containerd_snapshotter: "native"
+
+# containerd_runc_runtime:
+#   name: runc
+#   type: "io.containerd.runc.v2"
+#   engine: ""
+#   root: ""
+
+# containerd_additional_runtimes:
+# Example for Kata Containers as additional runtime:
+#   - name: kata
+#     type: "io.containerd.kata.v2"
+#     engine: ""
+#     root: ""
+
+# containerd_grpc_max_recv_message_size: 16777216
+# containerd_grpc_max_send_message_size: 16777216
+
+# Containerd debug socket location: unix or tcp format
+# containerd_debug_address: ""
+
+# Containerd log level
+# containerd_debug_level: "info"
+
+# Containerd logs format, supported values: text, json
+# containerd_debug_format: ""
+
+# Containerd debug socket UID
+# containerd_debug_uid: 0
+
+# Containerd debug socket GID
+# containerd_debug_gid: 0
+
+# containerd_metrics_address: ""
+
+# containerd_metrics_grpc_histogram: false
+
+# Registries defined within containerd.
+# containerd_registries_mirrors:
+#  - prefix: docker.io
+#    mirrors:
+#     - host: https://registry-1.docker.io
+#       capabilities: ["pull", "resolve"]
+#       skip_verify: false
+
+# containerd_max_container_log_line_size: -1
+
+# containerd_registry_auth:
+#   - registry: 10.0.0.2:5000
+#     username: user
+#     password: pass

internal/resources/templates/secrets-storage/vault-keys.json.tmpl

@@ -1,8 +0,0 @@
-{
-  "keys": [
-    {{- range $index, $key := .Modules.SecretsStorage.UnsealKeys }}
-     "{{ $key }}",
-    {{- end }}
-  ],
-  "root_token": "{{ .Modules.SecretsStorage.AuthToken }}"
-}

internal/secrets_storage/commands.go

@@ -1,130 +0,0 @@
-package secrets_storage
-
-import (
-	"fmt"
-	"kube-forge/internal/config"
-	"kube-forge/internal/kubernetes_client"
-	"kube-forge/internal/logging"
-	"kube-forge/internal/templates"
-	"regexp"
-	"strings"
-)
-
-func initVault() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		logging.Log.Error(err.Error())
-		return
-	}
-	err = commandToInitVault()
-	if err != nil {
-		logging.Log.Warn(err.Error())
-		return
-	}
-	logging.Log.Info("Vault initialized")
-	templates.ApplyVaultInitKeysTemplate()
-}
-
-func addKubernetesLocalIntegration() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		logging.Log.Error(err.Error())
-		return
-	}
-	err = commandToAddKubernetesLocalIntegration()
-	if err != nil {
-		logging.Log.Error(err.Error())
-		return
-	}
-	logging.Log.Info("Vault local Kubernetes integration added")
-}
-
-func unsealVault() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		logging.Log.Error(err.Error())
-		return
-	}
-	commandToUnsealVault()
-}
-
-func commandToInitVault() error {
-	config := config.GetConfig()
-	commandArray := []string{
-		"vault", "operator", "init",
-		fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
-		fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
-	}
-	output, err := kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	if err != nil && strings.Contains(output, "Vault is already initialized") {
-		return VaultAlreadyInitialised
-	}
-
-	unsealKeys, rootToken := parseVaultInitKeys(output)
-	config.Modules.SecretsStorage.UnsealKeys = unsealKeys
-	config.Modules.SecretsStorage.AuthToken = rootToken
-	return nil
-}
-
-func parseVaultInitKeys(input string) ([]string, string) {
-	unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
-	rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
-
-	unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
-	var unsealKeys []string
-	for _, match := range unsealKeysMatches {
-		unsealKeys = append(unsealKeys, match[1])
-	}
-
-	rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
-	rootToken := rootTokenMatches[1]
-
-	return unsealKeys, rootToken
-}
-
-func commandToUnsealVault() {
-	config := config.GetConfig()
-
-	for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
-		commandArray := []string{"vault", "operator", "unseal", unsealKey}
-		kubernetes_client.ExecuteCommandInPodContainer(
-			commandArray, "secrets-storage", "vault-0", "vault",
-		)
-	}
-	logging.Log.Info("Vault unsealed")
-}
-
-func commandToAddKubernetesLocalIntegration() error {
-	config := config.GetConfig()
-
-	commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
-	output, err := kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	if err != nil && strings.Contains(output, "permission denied") {
-		return IncorrectCredentials
-	}
-	commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
-	output, err = kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
-		"KUBERNETES_PORT_443_TCP_ADDR",
-		"secrets-storage",
-		"vault-0",
-		"vault",
-	)
-	if err != nil {
-		return err
-	}
-	commandArray = []string{
-		"vault", "write", "auth/kubernetes-local/config",
-		fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
-	}
-	output, err = kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	return nil
-}

internal/secrets_storage/errors.go

@@ -1,6 +0,0 @@
-package secrets_storage
-
-import "errors"
-
-var VaultAlreadyInitialised = errors.New("Vault already initialised")
-var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!")

internal/secrets_storage/helm.go

@@ -1,44 +0,0 @@
-package secrets_storage
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/helm_client"
-	"kube-forge/internal/templates"
-	"time"
-
-	go_helm_client "github.com/mittwald/go-helm-client"
-)
-
-var HELM_REPOS = []config.RepoSettings{
-	{
-		Name: "kube-forge",
-		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
-	},
-}
-
-func getVaultSpec() go_helm_client.ChartSpec {
-	appConfig := config.GetConfig()
-	return go_helm_client.ChartSpec{
-		ReleaseName:     "vault",
-		ChartName:       appConfig.Modules.SecretsStorage.ChartRef,
-		Version:         appConfig.Modules.SecretsStorage.ChartVersion,
-		Namespace:       appConfig.Modules.SecretsStorage.Namespace,
-		CreateNamespace: true,
-		Atomic:          true,
-		Timeout:         time.Second * 600,
-		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"),
-	}
-}
-
-func ApplyCharts() {
-	appConfig := config.GetConfig()
-	helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS)
-	if appConfig.Modules.SecretsStorage.Enabled {
-		helm_client.InstallChart(getVaultSpec())
-		initVault()
-		unsealVault()
-		addKubernetesLocalIntegration()
-	} else {
-		helm_client.DeleteChart(getVaultSpec())
-	}
-}

internal/templates/kubespray.go

@@ -5,6 +5,7 @@ var K8S_TEMPLATES = [...][2]string{
 	{"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"},
 	{"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"},
 	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"},
+	{"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"},
 }
 
 func ApplyK8sTemplates() {

kubespray/inventory/group_vars/all.yml

@@ -32,6 +32,7 @@ disable_host_nameservers: false
 upstream_dns_servers:
   - 8.8.8.8
   - 8.8.4.4
+  - 1.1.1.1
 
 ## There are some changes specific to the cloud providers
 ## for instance we need to encapsulate packets with some network plugins
@@ -128,7 +129,5 @@ unsafe_show_logs: false
 ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
 allow_unsupported_distribution_setup: false
 
-## Containerd settings
+## Kubelet additional settings
-# containerd_metadata_root_dir: /app/lib/containerd
+kubelet_custom_flags: "--root-dir=/var/lib/kubelet"
-# The state directory for containerd
-# containerd_state_dir: /app/run/containerd

kubespray/inventory/group_vars/all/containerd.yml

@@ -0,0 +1,60 @@
+---
+# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
+
+containerd_storage_dir: /var/lib/containerd
+containerd_state_dir:  /run/containerd
+
+# containerd_oom_score: 0
+
+# containerd_default_runtime: "runc"
+# containerd_snapshotter: "native"
+
+# containerd_runc_runtime:
+#   name: runc
+#   type: "io.containerd.runc.v2"
+#   engine: ""
+#   root: ""
+
+# containerd_additional_runtimes:
+# Example for Kata Containers as additional runtime:
+#   - name: kata
+#     type: "io.containerd.kata.v2"
+#     engine: ""
+#     root: ""
+
+# containerd_grpc_max_recv_message_size: 16777216
+# containerd_grpc_max_send_message_size: 16777216
+
+# Containerd debug socket location: unix or tcp format
+# containerd_debug_address: ""
+
+# Containerd log level
+# containerd_debug_level: "info"
+
+# Containerd logs format, supported values: text, json
+# containerd_debug_format: ""
+
+# Containerd debug socket UID
+# containerd_debug_uid: 0
+
+# Containerd debug socket GID
+# containerd_debug_gid: 0
+
+# containerd_metrics_address: ""
+
+# containerd_metrics_grpc_histogram: false
+
+# Registries defined within containerd.
+# containerd_registries_mirrors:
+#  - prefix: docker.io
+#    mirrors:
+#     - host: https://registry-1.docker.io
+#       capabilities: ["pull", "resolve"]
+#       skip_verify: false
+
+# containerd_max_container_log_line_size: -1
+
+# containerd_registry_auth:
+#   - registry: 10.0.0.2:5000
+#     username: user
+#     password: pass

kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml

@@ -157,7 +157,7 @@ kube_encrypt_secret_data: false
 
 # DNS configuration.
 # Kubernetes cluster name, also will be used as DNS domain
-cluster_name: k8s-cluster.local
+cluster_name: cluster.local
 # Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
 ndots: 2
 # dns_timeout: 2

kubespray/inventory/hosts

@@ -1,17 +1,17 @@
 
-vbox-prod-k8s-master-01 ansible_host=10.250.50.22 ip=10.250.50.22  
+t1-disk-lt-k8s-test-master-01 ansible_host=10.100.20.49 ip=10.100.20.49  
-vbox-prod-k8s-slave-01 ansible_host=10.250.50.23 ip=10.250.50.23  
+t1-disk-lt-k8s-test-slave-01 ansible_host=10.100.20.48 ip=10.100.20.48  
-vbox-prod-k8s-slave-02 ansible_host=10.250.50.21 ip=10.250.50.21  
+t1-disk-lt-k8s-test-slave-02 ansible_host=10.100.20.47 ip=10.100.20.47  
 
 [kube_control_plane]
-vbox-prod-k8s-master-01
+t1-disk-lt-k8s-test-master-01
 
 [etcd]
-vbox-prod-k8s-master-01
+t1-disk-lt-k8s-test-master-01
 
 [kube_node]
-vbox-prod-k8s-slave-01
+t1-disk-lt-k8s-test-slave-01
-vbox-prod-k8s-slave-02
+t1-disk-lt-k8s-test-slave-02
 
 [k8s_cluster:children]
 kube_control_plane
@@ -20,4 +20,4 @@ kube_node
 [all:vars]
 ansible_connection=ssh
 ansible_user=sre-admin
-ansible_ssh_private_key_file=/root/.ssh/id_rsa
+ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa_bastion_ift