add docker building in pipeline

.gitlab-ci.yml

@@ -0,0 +1,42 @@
+variables:
+  DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge
+  KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug
+  KANIKO_CONTEXT: ${CI_PROJECT_DIR}
+
+stages:
+  - build
+
+build-docker:
+  variables:
+    DOCKERFILE_PATH: Dockerfile
+    IMAGE_DESTINATION: image
+  stage: build
+  image:
+    name: ${KANIKO_IMAGE}
+    entrypoint: [""]
+  allow_failure: true
+  tags:
+    - build
+    - docker
+  before_script:
+    - mkdir -p /kaniko/.docker
+    - echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json
+    - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)
+  script:
+    - |
+      /kaniko/executor --context "${KANIKO_CONTEXT}" \
+        --dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \
+        --destination "${DOCKER_IMAGE}:{VERSION}-${CI_COMMIT_SHORT_SHA}"
+  dependencies: []
+  rules:
+    - changes:
+        - build/docker/**/*
+        - cmd/**/*
+        - internal/**/*
+        - kubespray/**/*
+        - go.sum
+        - go.mod
+        - requirements.txt
+        - ansible.cfg
+      if: $CI_COMMIT_REF_NAME =~ /^(main)$/
+      when: always

README.md

@@ -0,0 +1,13 @@
+## Устнановка
+
+### Docker-образ
+
+## Примеры запуска
+
+### Docker-образ
+
+```shell
+docker run -v $(pwd)/config.yaml:/application/config.yaml \
+  -v $(pwd)/id_rsa:/root/.ssh/id_rsa \
+  -v $(pwd)/config:/root/.ssh/config <kube_forge_image> apply
+```

ansible.cfg

@@ -0,0 +1,22 @@
+[ssh_connection]
+pipelining=True
+ssh_args = -o ControlMaster=auto -o ControlPersist=30m -o ConnectionAttempts=100 -o UserKnownHostsFile=/dev/null
+#control_path = ~/.ssh/ansible-%%r@%%h:%%p
+[defaults]
+# https://github.com/ansible/ansible/issues/56930 (to ignore group names with - and .)
+force_valid_group_names = ignore
+
+host_key_checking=False
+gathering = smart
+fact_caching = jsonfile
+fact_caching_connection = /tmp
+fact_caching_timeout = 86400
+stdout_callback = dense
+display_skipped_hosts = no
+library = ./library
+callbacks_enabled = profile_tasks,ara_default
+roles_path = roles:$VIRTUAL_ENV/usr/local/share/kubespray/roles:$VIRTUAL_ENV/usr/local/share/ansible/roles:/usr/share/kubespray/roles
+deprecation_warnings=False
+inventory_ignore_extensions = ~, .orig, .bak, .ini, .cfg, .retry, .pyc, .pyo, .creds, .gpg
+[inventory]
+ignore_patterns = artifacts, credentials

build/README.md

@@ -0,0 +1,5 @@
+## Сборка Docker
+
+## Сборка Linux
+
+### Debian

build/debian/DEBIAN/control

@@ -0,0 +1,5 @@
+Package: kube-forge
+Version: 1.0
+Architecture: amd64
+Maintainer: Kvazaric <kvazaric.official@gmail.com>
+Description: A program to install Kubernetes-based platform  to facilitate the development, desting and dperation of Ccntainerized applications

build/docker/.dockerignore

@@ -0,0 +1,4 @@
+k8s-admin.conf
+docs
+*/build
+examples

build/docker/Dockerfile

@@ -0,0 +1,28 @@
+## Install dependencies
+FROM python:3.12 as deps
+
+WORKDIR /application
+COPY ./requirements.txt ./
+
+RUN apt-get update -y && \
+    apt-get install sshpass -y && \
+    pip3 install -r requirements.txt
+
+## Build executable
+FROM golang:alpine as builder
+
+WORKDIR /application
+COPY go.mod go.sum ./
+RUN go mod download
+
+WORKDIR /application
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux  go build -v -o kube-forge ./cmd/main/main.go
+
+FROM deps
+
+WORKDIR /application
+COPY . .
+COPY --from=builder /application/kube-forge /application/kube-forge
+
+ENTRYPOINT ["./kube-forge", "-c", "config.yaml", "-d", "."]

build/version.txt

@@ -0,0 +1 @@
+1.0

internal/config/modules_observability.go

@@ -137,6 +137,12 @@ type Monitoring struct {
 		Image   string `yaml:"image" env-default:"prom/node-exporter"`
 		Tag     string `yaml:"tag" env-default:"v1.5.0"`
 	} `yaml:"node"`
+	MetricsServer struct {
+		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"`
+		ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
+		Image        string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
+		Tag          string `yaml:"tag" env-default:""`
+	}
 }
 
 type Visualization struct {

internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl

@@ -0,0 +1,203 @@
+- name: metrics-server
+  namespace: kube-system
+  create_namespace: true
+  chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
+  chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
+  {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+  release_state: "present"
+  {{- else }}
+  release_state: "absent"
+  {{- end }}
+  values:
+    image:
+      repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
+      tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
+      pullPolicy: IfNotPresent
+
+    imagePullSecrets: []
+    # - name: registrySecretName
+
+    nameOverride: ""
+    fullnameOverride: ""
+
+    serviceAccount:
+      # Specifies whether a service account should be created
+      create: true
+      # Annotations to add to the service account
+      annotations: {}
+      # The name of the service account to use.
+      # If not set and create is true, a name is generated using the fullname template
+      name: ""
+      # The list of secrets mountable by this service account.
+      # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
+      secrets: []
+
+    rbac:
+      # Specifies whether RBAC resources should be created
+      create: true
+      pspEnabled: false
+
+    apiService:
+      create: true
+      # Annotations to add to the API service
+      annotations: {}
+      # Specifies whether to skip TLS verification
+      insecureSkipTLSVerify: true
+      # The PEM encoded CA bundle for TLS verification
+      caBundle: ""
+
+    commonLabels: {}
+    podLabels:
+      "app.kubernetes.io/component": "metrics-server"
+    podAnnotations: {}
+
+    podSecurityContext: {}
+
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+      capabilities:
+        drop:
+          - ALL
+
+    priorityClassName: system-cluster-critical
+
+    containerPort: 10250
+
+    hostNetwork:
+      # Specifies if metrics-server should be started in hostNetwork mode.
+      #
+      # You would require this enabled if you use alternate overlay networking for pods and
+      # API server unable to communicate with metrics-server. As an example, this is required
+      # if you use Weave network on EKS
+      enabled: false
+
+    replicas: 1
+
+    revisionHistoryLimit:
+
+    updateStrategy: {}
+    #   type: RollingUpdate
+    #   rollingUpdate:
+    #     maxSurge: 0
+    #     maxUnavailable: 1
+
+    podDisruptionBudget:
+      # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+      enabled: false
+      minAvailable:
+      maxUnavailable:
+
+    defaultArgs:
+      - --cert-dir=/tmp
+      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+      - --kubelet-use-node-status-port
+      - --metric-resolution=15s
+      - --kubelet-insecure-tls
+
+    args: []
+
+    livenessProbe:
+      httpGet:
+        path: /livez
+        port: https
+        scheme: HTTPS
+      initialDelaySeconds: 0
+      periodSeconds: 10
+      failureThreshold: 3
+
+    readinessProbe:
+      httpGet:
+        path: /readyz
+        port: https
+        scheme: HTTPS
+      initialDelaySeconds: 20
+      periodSeconds: 10
+      failureThreshold: 3
+
+    service:
+      type: ClusterIP
+      port: 443
+      annotations: {}
+      labels: {}
+      #  Add these labels to have metrics-server show up in `kubectl cluster-info`
+      #  kubernetes.io/cluster-service: "true"
+      #  kubernetes.io/name: "Metrics-server"
+
+    addonResizer:
+      enabled: false
+      image:
+        repository: registry.k8s.io/autoscaling/addon-resizer
+        tag: 1.8.20
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
+      resources:
+        requests:
+          cpu: 40m
+          memory: 25Mi
+        limits:
+          cpu: 40m
+          memory: 25Mi
+      nanny:
+        cpu: 0m
+        extraCpu: 1m
+        memory: 0Mi
+        extraMemory: 2Mi
+        minClusterSize: 100
+        pollPeriod: 300000
+        threshold: 5
+
+    metrics:
+      enabled: true
+
+    serviceMonitor:
+      enabled: true
+      additionalLabels: {}
+      interval: 1m
+      scrapeTimeout: 10s
+      metricRelabelings: []
+      relabelings: []
+
+    # See https://github.com/kubernetes-sigs/metrics-server#scaling
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+      # limits:
+      #   cpu:
+      #   memory:
+
+    extraVolumeMounts: []
+
+    extraVolumes: []
+
+    nodeSelector: {}
+
+    tolerations: []
+
+    affinity: {}
+
+    topologySpreadConstraints: []
+
+    dnsConfig: {}
+
+    # Annotations to add to the deployment
+    deploymentAnnotations: {}
+
+    schedulerName: ""
+
+    tmpVolume:
+      emptyDir: {}
+

internal/templates/helm_apps.go

@@ -14,6 +14,7 @@ var HELM_APPS_TEMPLATES = [...]string{
 	"templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl",
 	"templates/helm-apps/releases/observability/fluent-operator.yml.tmpl",
 	"templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",
+	"templates/helm-apps/releases/observability/metrics-server.yml.tmpl",
 	"templates/helm-apps/releases/observability/tempo.yml.tmpl",
 	"templates/helm-apps/releases/observability/loki.yml.tmpl",
 	"templates/helm-apps/releases/observability/observability.yml.tmpl",

kubespray/inventory/group_vars/k8s_cluster/addons.yml

@@ -3101,6 +3101,206 @@ releases:
           repository: busybox
           tag: latest
   
+  - name: metrics-server
+    namespace: kube-system
+    create_namespace: true
+    chart_ref: kube-forge/metrics-server
+    chart_version: 3.12.1
+    release_state: "present"
+    values:
+      image:
+        repository: registry.k8s.io/metrics-server/metrics-server
+        tag: ""
+        pullPolicy: IfNotPresent
+  
+      imagePullSecrets: []
+      # - name: registrySecretName
+  
+      nameOverride: ""
+      fullnameOverride: ""
+  
+      serviceAccount:
+        # Specifies whether a service account should be created
+        create: true
+        # Annotations to add to the service account
+        annotations: {}
+        # The name of the service account to use.
+        # If not set and create is true, a name is generated using the fullname template
+        name: ""
+        # The list of secrets mountable by this service account.
+        # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
+        secrets: []
+  
+      rbac:
+        # Specifies whether RBAC resources should be created
+        create: true
+        pspEnabled: false
+  
+      apiService:
+        create: true
+        # Annotations to add to the API service
+        annotations: {}
+        # Specifies whether to skip TLS verification
+        insecureSkipTLSVerify: true
+        # The PEM encoded CA bundle for TLS verification
+        caBundle: ""
+  
+      commonLabels: {}
+      podLabels:
+        "app.kubernetes.io/component": "metrics-server"
+      podAnnotations: {}
+  
+      podSecurityContext: {}
+  
+      securityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+        capabilities:
+          drop:
+            - ALL
+  
+      priorityClassName: system-cluster-critical
+  
+      containerPort: 10250
+  
+      hostNetwork:
+        # Specifies if metrics-server should be started in hostNetwork mode.
+        #
+        # You would require this enabled if you use alternate overlay networking for pods and
+        # API server unable to communicate with metrics-server. As an example, this is required
+        # if you use Weave network on EKS
+        enabled: false
+  
+      replicas: 1
+  
+      revisionHistoryLimit:
+  
+      updateStrategy: {}
+      #   type: RollingUpdate
+      #   rollingUpdate:
+      #     maxSurge: 0
+      #     maxUnavailable: 1
+  
+      podDisruptionBudget:
+        # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+        enabled: false
+        minAvailable:
+        maxUnavailable:
+  
+      defaultArgs:
+        - --cert-dir=/tmp
+        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+        - --kubelet-use-node-status-port
+        - --metric-resolution=15s
+        - --kubelet-insecure-tls
+  
+      args: []
+  
+      livenessProbe:
+        httpGet:
+          path: /livez
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 0
+        periodSeconds: 10
+        failureThreshold: 3
+  
+      readinessProbe:
+        httpGet:
+          path: /readyz
+          port: https
+          scheme: HTTPS
+        initialDelaySeconds: 20
+        periodSeconds: 10
+        failureThreshold: 3
+  
+      service:
+        type: ClusterIP
+        port: 443
+        annotations: {}
+        labels: {}
+        #  Add these labels to have metrics-server show up in `kubectl cluster-info`
+        #  kubernetes.io/cluster-service: "true"
+        #  kubernetes.io/name: "Metrics-server"
+  
+      addonResizer:
+        enabled: false
+        image:
+          repository: registry.k8s.io/autoscaling/addon-resizer
+          tag: 1.8.20
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+          capabilities:
+            drop:
+              - ALL
+        resources:
+          requests:
+            cpu: 40m
+            memory: 25Mi
+          limits:
+            cpu: 40m
+            memory: 25Mi
+        nanny:
+          cpu: 0m
+          extraCpu: 1m
+          memory: 0Mi
+          extraMemory: 2Mi
+          minClusterSize: 100
+          pollPeriod: 300000
+          threshold: 5
+  
+      metrics:
+        enabled: true
+  
+      serviceMonitor:
+        enabled: true
+        additionalLabels: {}
+        interval: 1m
+        scrapeTimeout: 10s
+        metricRelabelings: []
+        relabelings: []
+  
+      # See https://github.com/kubernetes-sigs/metrics-server#scaling
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+        # limits:
+        #   cpu:
+        #   memory:
+  
+      extraVolumeMounts: []
+  
+      extraVolumes: []
+  
+      nodeSelector: {}
+  
+      tolerations: []
+  
+      affinity: {}
+  
+      topologySpreadConstraints: []
+  
+      dnsConfig: {}
+  
+      # Annotations to add to the deployment
+      deploymentAnnotations: {}
+  
+      schedulerName: ""
+  
+      tmpVolume:
+        emptyDir: {}
+  
+  
   - name: tempo
     namespace: observability
     create_namespace: true
@@ -4213,7 +4413,7 @@ releases:
           server.insecure: true
   
         secret:
-          argocdServerAdminPassword: $2a$10$emopmT/u2bzVYRDmFQnyH.xLNrVsLkqn61BDfx4Evzq.V8OfApXa2
+          argocdServerAdminPassword: $2a$10$fjTEgJLT1tC82Z8rxrnJBegIoLFXBvpbdbbCvqSONU34yD2w6H.wS
   
         repositories:
           # add default helm-repository from harbor

kubespray/inventory/hosts

@@ -20,4 +20,4 @@ kube_node
 [all:vars]
 ansible_connection=ssh
 ansible_user=sre-admin
-ansible_ssh_private_key_file=/home/sre-admin/.ssh/id_rsa
+ansible_ssh_private_key_file=/root/.ssh/id_rsa