diff --git a/config.sample.yaml b/config.sample.yaml index 860efb5..fd79af4 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -7,102 +7,39 @@ hosts: - hostname: vbox-prod-k8s-master-01 ip: "10.250.50.22" roles: [control_plane, etcd] - - # # Optional creds for each host - # user: user - # password: nF5S8nuKi87Dh42Jnjik - - hostname: vbox-prod-k8s-slave-01 ip: "10.250.50.23" roles: [node] - - hostname: vbox-prod-k8s-slave-02 ip: "10.250.50.21" roles: [node] orchestrator: version: v1.29.0 - cluster_name: k8s-cluster.local - # bin_dir: /usr/local/bin - # sysctl_file_path: /etc/sysctl.d/99-sysctl.conf - loadbalancer_apiserver_port: 6443 - dns: - servers: - - 8.8.8.8 - - 8.8.4.4 - disable_host_nameservers: false - # cloud_provider: "" # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external' - # external_cloud_provider: "" # 'openstack', 'vsphere' and 'hcloud' - container_engine: - type: containerd # docker, crio and containerd install: true - ping_access_ip: true auto_renew_certificates: true - event_ttl: "1h0m0s" pod_security_policy_enabled: true - network: - plugin: calico # cilium, calico, kube-ovn, weave or flannel - # service_addresses: 10.233.0.0/18 - # pods_subnet: 10.233.64.0/18 - modules: admin_password: changeit - - ## Add additional helm repositories before installation - # additional_repositories: - # - name: argo-helm - # url: "https://argoproj.github.io/argo-helm" - observability: enabled: true - logging: enabled: true - - loki: - persistence: - storage_size: 10Gi - retention: 168h - events: enabled: true - cron: - schedule: "*/2 * * * *" - tracing: enabled: true - - tempo: - retention: 24h - listen_port: 3100 - - persistence: - storage_size: 10Gi - - tempo_query: - listen_port: 16686 - monitoring: enabled: true - - prometheus: - scrape_interval: 15s - persistence: - storage_size: 3Gi - retention: 7d - alert_manager: enabled: true - # additionalMessageTemplates: {} - route: receiver: kvazaric_notifications group_wait: 1s repeat_interval: 180m - routes: - receiver: "kvazaric_notifications" group_by: ["alertname"] @@ -116,87 +53,38 @@ modules: - send_resolved: true api_url: https://api.telegram.org bot_token: bot_token - chat_id: chat_id # int + chat_id: -10000 parse_mode: HTML message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}' http_config: follow_redirects: true enable_http2: false - blackbox: enabled: true - additional_modules: | - kube_state: enabled: true - node: enabled: true - visualization: enabled: true - grafana: enabled: true expose: type: ingress # ingress or NodePort domain: grafana.disk.lt.t1.cloud - node_port_http: 30007 - tls: enabled: true - persistence: - storage_size: 2Gi - cicd: enabled: true - argo_cd: expose: type: ingress # ingress or NodePort domain: argocd.disk.lt.t1.cloud - - node_port_http: 30005 - node_port_https: 30006 - tls: enabled: true - - repositories: - {} - # harbor-helm: - # enableOCI: "true" - # type: helm - # name: helm-mountbit - # url: harbor.disk.t1.cloud/mountbit-helm - # username: username - # password: password - rbac: - additional_policies: | - p, developer, applications, *, */*, allow - - p, developer, applications, *, */*logging*, deny - p, developer, repositories, get, *, allow - p, developer, projects, get, *, allow - - p, developer, logs, get, *, allow - - p, guest, applications, get, */*, allow - p, guest, projects, get, *, allow - - ha: - enabled: false - autoscaling: false - rollouts: enabled: true - ha: - enabled: true - expose: - type: "NodePort" # now only NodePort supported - node_port: 30010 - updates_operator: enabled: true @@ -204,91 +92,32 @@ modules: enabled: true key_shares: 5 key_threshold: 3 - - # specify unseal keys to auto-unseal after updates or restarts - unseal_keys: - - "abc" - - "abc" - - "abc" expose: type: ingress # ingress or NodePort domain: vault.disk.lt.t1.cloud - node_port: 30004 - tls: enabled: true - - # requires secrets_store_csi_driver in additional modules csi_integration: enabled: true - agent: - image: hashicorp/vault - tag: 1.16.0 - server: - image: "hashicorp/vault" - tag: 1.16.0 - persistence: - size: 10Gi registry: enabled: true expose: type: ingress # ingress or nodePort - # if expose_type is "ingress" domain: harbor.disk.lt.t1.cloud - - # if expose_type is "NodePort" - node_port_http: 30002 - node_port_https: 30003 tls: enabled: true - - persistence: - registry_size: 10Gi - jobservice_size: 1Gi - database_size: 2Gi - redis_size: 1Gi - trivy_size: 5Gi - enabled_scanner: true additional: cert_manager: enabled: true - ha_enabled: false - dns_servers: - - "1.1.1.1" - - "8.8.8.8" - account_email: reversstorm@gmail.com - + account_email: adminmail@gmail.com ingress: - type: nginx # nginx enabled: true - ingress_class_name: nginx host_network: true - - # load_balancer: - # type: metallb - # install: true - - # docker_secrets: - # repositories: - # - name: registry - # repository: registry.example.com - # username: admin - # password: admin - # namespaces: - # - default - storage: - local_path_provisioner: - storage_class_name: local-path - reclaim_policy: Delete - longhorn: enabled: true - secrets_store_csi_driver: enabled: true - - ## TODO: ceph diff --git a/internal/config/modules_additional.go b/internal/config/modules_additional.go index e5a566f..9cbac18 100644 --- a/internal/config/modules_additional.go +++ b/internal/config/modules_additional.go @@ -6,7 +6,7 @@ type Additional struct { ChartVersion string `yaml:"chart_version" env-default:"v1.14.5"` Enabled bool `yaml:"enabled"` HaEnabled bool `yaml:"ha_enabled"` - DnsServers []string `yaml:"dns_servers" env-default:"[8.8.8.8,1.1.1.1]"` + DnsServers []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"` AccountEmail string `yaml:"account_email"` Controller struct { Image string `yaml:"image" env-default:"quay.io/jetstack/cert-manager-controller"` @@ -47,7 +47,6 @@ type Additional struct { Storage struct { LocalPathProvisioner struct { - Enabled bool `yaml:"enabled"` StorageClassName string `yaml:"storage_class_name" env-default:"local-path"` ReclaimPolicy string `yaml:"reclaim_policy" env-default:"Delete"` } `yaml:"local_path_provisioner"` diff --git a/internal/config/modules_secrets_storage.go b/internal/config/modules_secrets_storage.go index e0d5ab2..006edf5 100644 --- a/internal/config/modules_secrets_storage.go +++ b/internal/config/modules_secrets_storage.go @@ -27,7 +27,7 @@ type SecretsStorage struct { } `yaml:"injector"` Server struct { Image string `yaml:"image" env-default:"hashicorp/vault"` - Tag string `yaml:"tag" env-default:"1.15.6"` + Tag string `yaml:"tag" env-default:"1.16.0"` Persistence struct { DataStorage struct { StorageClass string `yaml:"storage_class" env-default:"local-path"` @@ -41,6 +41,6 @@ type SecretsStorage struct { } `yaml:"server"` Agent struct { Image string `yaml:"image" env-default:"hashicorp/vault"` - Tag string `yaml:"tag" env-default:"1.15.6"` + Tag string `yaml:"tag" env-default:"1.16.0"` } `yaml:"agent"` } diff --git a/internal/config/orchestrator.go b/internal/config/orchestrator.go index 132ecaf..feefd54 100644 --- a/internal/config/orchestrator.go +++ b/internal/config/orchestrator.go @@ -1,12 +1,12 @@ package config type Dns struct { - Servers []string `yaml:"servers" env-default:"[8.8.8.8,8.8.4.4]"` - DisableHostNameservers bool `yaml:"disable_host_nameservers" env-default:"false"` + Servers []string `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"` + DisableHostNameservers bool `yaml:"disable_host_nameservers"` } type Orchestrator struct { - Version string `yaml:"version" env-default:"v1.28.0"` + Version string `yaml:"version" env-default:"v1.29.0"` ClusterName string `yaml:"cluster_name" env-default:"k8s-cluster.local"` BinDir string `yaml:"bin_dir" env-default:"/usr/local/bin"` SysctlFilePath string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"` @@ -16,12 +16,12 @@ type Orchestrator struct { ExgernalCloudProvider string `yaml:"external_cloud_provider"` ContainerEngine struct { Type string `yaml:"type" env-default:"containerd"` - Install bool `yaml:"install" env-default:"true"` + Install bool `yaml:"install"` } `yaml:"container_engine"` - PingAccessIp bool `yaml:"ping_access_ip" env-default:"true"` - AutoRenewCertificates bool `yaml:"auto_renew_certificates" env-default:"false"` + PingAccessIp bool `yaml:"ping_access_ip"` + AutoRenewCertificates bool `yaml:"auto_renew_certificates"` EventTtl string `yaml:"event_ttl" env-default:"1h0m0s"` - PodSecurityPolicyEnabled bool `yaml:"pod_security_policy_enabled" env-default:"false"` + PodSecurityPolicyEnabled bool `yaml:"pod_security_policy_enabled"` Network struct { Plugin string `yaml:"plugin" env-default:"calico"` diff --git a/internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl b/internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl index f0de71d..742aabc 100644 --- a/internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl @@ -290,7 +290,9 @@ # +docs:property podDnsConfig: nameservers: - {{- .Modules.Additional.CertManager.DnsServers | toYaml | nindent 8 }} + {{- range $index,$value := .Modules.Additional.CertManager.DnsServers }} + - "{{ $value }}" + {{- end }} # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with # matching labels. diff --git a/kubespray/inventory/group_vars/k8s_cluster/addons.yml b/kubespray/inventory/group_vars/k8s_cluster/addons.yml index d1fb88d..1fbab7d 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/addons.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/addons.yml @@ -1016,8 +1016,8 @@ releases: # +docs:property podDnsConfig: nameservers: - - 1.1.1.1 - - 8.8.8.8 + - "8.8.8.8" + - "1.1.1.1" # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with # matching labels. @@ -3659,7 +3659,7 @@ releases: ingress: enabled: true - accountEmail: reversstorm@gmail.com + accountEmail: adminmail@gmail.com class: nginx annotations: nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" @@ -3767,7 +3767,7 @@ releases: chart_version: 0.1.0 release_state: "present" values: - issuer_email: reversstorm@gmail.com + issuer_email: adminmail@gmail.com solver_ingress_class: nginx certificates: @@ -4213,11 +4213,11 @@ releases: server.insecure: true secret: - argocdServerAdminPassword: $2a$10$A6C0LMJpyH6Jx1CF570MxuCc/CYRauqjv3Z.31IcwEnf3h1E02QnG + argocdServerAdminPassword: $2a$10$emopmT/u2bzVYRDmFQnyH.xLNrVsLkqn61BDfx4Evzq.V8OfApXa2 repositories: # add default helm-repository from harbor - {} + null cm: create: true @@ -4945,7 +4945,7 @@ releases: secretName: argo-cd-server-tls ingress: - accountEmail: reversstorm@gmail.com + accountEmail: adminmail@gmail.com class: nginx annotations: nginx.ingress.kubernetes.io/proxy-buffer-size: "128k" @@ -5799,7 +5799,7 @@ releases: ingress: enabled: true - accountEmail: reversstorm@gmail.com + accountEmail: adminmail@gmail.com class: nginx annotations: nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"