first version

config.yaml

@@ -0,0 +1,277 @@
+credentials:
+  user: sre-admin
+  ask_sudo_password: false
+  private_key_file: /home/sre-admin/.ssh/id_rsa
+
+hosts:
+  - hostname: vbox-prod-k8s-master-01
+    ip: "10.250.50.22"
+    roles: [control_plane, etcd]
+
+    # # Optional creds for each host
+    # user: user
+    # password: nF5S8nuKi87Dh42Jnjik
+
+  - hostname: vbox-prod-k8s-slave-01
+    ip: "10.250.50.23"
+    roles: [node]
+
+  - hostname: vbox-prod-k8s-slave-02
+    ip: "10.250.50.21"
+    roles: [node]
+
+default_registry: ""
+
+orchestrator:
+  version: v1.29.0
+  cluster_name: k8s-cluster.local
+  # bin_dir: /usr/local/bin
+  # sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
+  loadbalancer_apiserver_port: 6443
+  dns:
+    servers:
+      - 8.8.8.8
+      - 8.8.4.4
+    disable_host_nameservers: false
+  # cloud_provider: ""  # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
+  # external_cloud_provider: ""  # 'openstack', 'vsphere' and 'hcloud'
+
+  container_engine:
+    type: containerd # docker, crio and containerd
+    install: true
+
+  ping_access_ip: true
+  auto_renew_certificates: true
+  event_ttl: "1h0m0s"
+  pod_security_policy_enabled: true
+
+  network:
+    plugin: calico # cilium, calico, kube-ovn, weave or flannel
+    # service_addresses: 10.233.0.0/18
+    # pods_subnet: 10.233.64.0/18
+
+modules:
+  admin_password: changeit
+
+  # additional_repositories:
+  #   - name: argo-helm
+  #     url: "https://argoproj.github.io/argo-helm"
+
+  observability:
+    enabled: true
+
+    logging:
+      enabled: true
+
+      loki:
+        persistence:
+          storage_size: 10Gi
+          retention: 168h
+
+      events:
+        enabled: true
+        cron:
+          schedule: "*/2 * * * *"
+
+    tracing:
+      enabled: true
+
+      tempo:
+        retention: 24h
+        listen_port: 3100
+
+        persistence:
+          storage_size: 10Gi
+
+        tempo_query:
+          listen_port: 16686
+
+    monitoring:
+      enabled: true
+
+      prometheus:
+        scrape_interval: 15s
+        persistence:
+          storage_size: 3Gi
+          retention: 7d
+
+      alert_manager:
+        enabled: false
+
+        # route:
+        #   receiver: kvazaric_notifications
+        #   group_wait: 1s
+        #   repeat_interval: 180m
+
+        #   routes:
+        #     - receiver: "kvazaric_notifications"
+        #       group_by: ["alertname"]
+        #       group_wait: 1s
+        #       repeat_interval: 8737h
+        #       matchers:
+        #         - fireOnce=true
+        # receivers:
+        #   - name: kvazaric_notifications
+        #     telegram_configs:
+        #       - send_resolved: true
+        #         api_url: https://api.telegram.org
+        #         bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I
+        #         chat_id: -968770779
+        #         parse_mode: HTML
+        #         message: '{{ template "telegram-message" . }}'
+        #         http_config:
+        #           follow_redirects: true
+        #           enable_http2: false
+      blackbox:
+        enabled: true
+        additional_modules: |
+
+      kube_state:
+        enabled: true
+
+      node:
+        enabled: true
+
+    visualization:
+      enabled: true
+
+      grafana:
+        enabled: true
+        expose:
+          type: ingress
+
+          domain: grafana.disk.lt.t1.cloud
+
+          tls:
+            enabled: true
+
+        persistence:
+          storage_size: 2Gi
+
+  cicd:
+    enabled: true
+
+    argo_cd:
+      expose:
+        type: ingress
+        domain: argocd.disk.lt.t1.cloud
+
+        tls:
+          enabled: true
+
+      repositories:
+        {}
+        # harbor-helm:
+        #   enableOCI: "true"
+        #   type: helm
+        #   name: helm-mountbit
+        #   url: harbor.disk.t1.cloud/mountbit-helm
+        #   username: username
+        #   password: password
+      rbac:
+        additional_policies: |
+          p, developer, applications, *, */*, allow
+
+          p, developer, applications, *, */*logging*, deny
+          p, developer, repositories, get, *, allow
+          p, developer, projects, get, *, allow
+
+          p, developer, logs, get, *, allow
+
+          p, guest, applications, get, */*, allow
+          p, guest, projects, get, *, allow
+
+      ha:
+        enabled: false
+        autoscaling: false
+
+    rollouts:
+      enabled: true
+
+    updates_operator:
+      enabled: true
+
+  secrets_storage:
+    enabled: true
+    expose:
+      type: ingress # NodePort
+      domain: vault.disk.lt.t1.cloud
+      node_port: 30004
+
+      tls:
+        enabled: true
+
+    # requires secrets_store_csi_driver in additional modules
+    csi_integration:
+      enabled: true
+      image: hashicorp/vault-csi-provider
+      version: 1.4.1
+    agent:
+      image: hashicorp/vault
+      version: 1.15.6
+    injector:
+      image: hashicorp/vault-k8s
+      version: 1.3.1
+    server:
+      image: "hashicorp/vault"
+      version: 1.15.6
+      persistence:
+        size: 10Gi
+
+  registry:
+    enabled: true
+    expose:
+      type: ingress # ingress or NodePort
+      # if expose_type is "ingress"
+      domain: harbor.disk.lt.t1.cloud
+
+      # if expose_type is "NodePort"
+      node_port_http: 30002
+      node_port_https: 30003
+    tls:
+      enabled: true
+
+    persistence:
+      registry_size: 10Gi
+      jobservice_size: 1Gi
+      database_size: 2Gi
+      redis_size: 1Gi
+      trivy_size: 5Gi
+
+    defaultProjects:
+      - name: harbor-helm
+        public: false
+    enabled_scanner: true
+
+  additional:
+    cert_manager:
+      install: true
+      dns_servers:
+        - "1.1.1.1"
+        - "8.8.8.8"
+      account_email: reversstorm@gmail.com
+
+    ingress:
+      type: nginx # nginx
+      install: true
+      insecure_port: 80
+      secure_port: 443
+      ingress_class_name: nginx
+      host_network: true
+
+    # load_balancer:
+    #   type: metallb
+    #   install: true
+
+    storage:
+      local_path_provisioner:
+        storage_class_name: local-path
+        reclaim_policy: Delete
+
+      longhorn:
+        enabled: true
+
+      secrets_store_csi_driver:
+        enabled: true
+
+      ## TODO: ceph