update configuration and example config

config.sample.yaml

@@ -7,102 +7,39 @@ hosts:
   - hostname: vbox-prod-k8s-master-01
     ip: "10.250.50.22"
     roles: [control_plane, etcd]
-
-    # # Optional creds for each host
-    # user: user
-    # password: nF5S8nuKi87Dh42Jnjik
-
   - hostname: vbox-prod-k8s-slave-01
     ip: "10.250.50.23"
     roles: [node]
-
   - hostname: vbox-prod-k8s-slave-02
     ip: "10.250.50.21"
     roles: [node]
 
 orchestrator:
   version: v1.29.0
-  cluster_name: k8s-cluster.local
-  # bin_dir: /usr/local/bin
-  # sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
-  loadbalancer_apiserver_port: 6443
-  dns:
-    servers:
-      - 8.8.8.8
-      - 8.8.4.4
-    disable_host_nameservers: false
-  # cloud_provider: ""  # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
-  # external_cloud_provider: ""  # 'openstack', 'vsphere' and 'hcloud'
-
   container_engine:
-    type: containerd # docker, crio and containerd
     install: true
-
   ping_access_ip: true
   auto_renew_certificates: true
-  event_ttl: "1h0m0s"
   pod_security_policy_enabled: true
 
-  network:
-    plugin: calico # cilium, calico, kube-ovn, weave or flannel
-    # service_addresses: 10.233.0.0/18
-    # pods_subnet: 10.233.64.0/18
-
 modules:
   admin_password: changeit
-
-  ## Add additional helm repositories before installation
-  # additional_repositories:
-  #   - name: argo-helm
-  #     url: "https://argoproj.github.io/argo-helm"
-
   observability:
     enabled: true
-
     logging:
       enabled: true
-
-      loki:
-        persistence:
-          storage_size: 10Gi
-          retention: 168h
-
       events:
         enabled: true
-        cron:
-          schedule: "*/2 * * * *"
-
     tracing:
       enabled: true
-
-      tempo:
-        retention: 24h
-        listen_port: 3100
-
-        persistence:
-          storage_size: 10Gi
-
-        tempo_query:
-          listen_port: 16686
-
     monitoring:
       enabled: true
-
-      prometheus:
-        scrape_interval: 15s
-        persistence:
-          storage_size: 3Gi
-          retention: 7d
-
       alert_manager:
         enabled: true
-        # additionalMessageTemplates: {}
-
         route:
           receiver: kvazaric_notifications
           group_wait: 1s
           repeat_interval: 180m
-
           routes:
             - receiver: "kvazaric_notifications"
               group_by: ["alertname"]
@@ -116,87 +53,38 @@ modules:
               - send_resolved: true
                 api_url: https://api.telegram.org
                 bot_token: bot_token
-                chat_id: chat_id # int
+                chat_id: -10000
                 parse_mode: HTML
                 message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
                 http_config:
                   follow_redirects: true
                   enable_http2: false
-
       blackbox:
         enabled: true
-        additional_modules: |
-
       kube_state:
         enabled: true
-
       node:
         enabled: true
-
     visualization:
       enabled: true
-
       grafana:
         enabled: true
         expose:
           type: ingress # ingress or NodePort
           domain: grafana.disk.lt.t1.cloud
-          node_port_http: 30007
-
           tls:
             enabled: true
 
-        persistence:
-          storage_size: 2Gi
-
   cicd:
     enabled: true
-
     argo_cd:
       expose:
         type: ingress # ingress or NodePort
         domain: argocd.disk.lt.t1.cloud
-
-        node_port_http: 30005
-        node_port_https: 30006
-
         tls:
           enabled: true
-
-      repositories:
-        {}
-        # harbor-helm:
-        #   enableOCI: "true"
-        #   type: helm
-        #   name: helm-mountbit
-        #   url: harbor.disk.t1.cloud/mountbit-helm
-        #   username: username
-        #   password: password
-      rbac:
-        additional_policies: |
-          p, developer, applications, *, */*, allow
-
-          p, developer, applications, *, */*logging*, deny
-          p, developer, repositories, get, *, allow
-          p, developer, projects, get, *, allow
-
-          p, developer, logs, get, *, allow
-
-          p, guest, applications, get, */*, allow
-          p, guest, projects, get, *, allow
-
-      ha:
-        enabled: false
-        autoscaling: false
-
     rollouts:
       enabled: true
-      ha:
-        enabled: true
-      expose:
-        type: "NodePort" # now only NodePort supported
-        node_port: 30010
-
     updates_operator:
       enabled: true
 
@@ -204,91 +92,32 @@ modules:
     enabled: true
     key_shares: 5
     key_threshold: 3
-
-    # specify unseal keys to auto-unseal after updates or restarts
-    unseal_keys:
-      - "abc"
-      - "abc"
-      - "abc"
     expose:
       type: ingress # ingress or NodePort
       domain: vault.disk.lt.t1.cloud
-      node_port: 30004
-
       tls:
         enabled: true
-
-    # requires secrets_store_csi_driver in additional modules
     csi_integration:
       enabled: true
-    agent:
-      image: hashicorp/vault
-      tag: 1.16.0
-    server:
-      image: "hashicorp/vault"
-      tag: 1.16.0
-      persistence:
-        size: 10Gi
 
   registry:
     enabled: true
     expose:
       type: ingress # ingress or nodePort
-      # if expose_type is "ingress"
       domain: harbor.disk.lt.t1.cloud
-
-      # if expose_type is "NodePort"
-      node_port_http: 30002
-      node_port_https: 30003
     tls:
       enabled: true
-
-    persistence:
-      registry_size: 10Gi
-      jobservice_size: 1Gi
-      database_size: 2Gi
-      redis_size: 1Gi
-      trivy_size: 5Gi
-
     enabled_scanner: true
 
   additional:
     cert_manager:
       enabled: true
-      ha_enabled: false
+      account_email: adminmail@gmail.com
-      dns_servers:
-        - "1.1.1.1"
-        - "8.8.8.8"
-      account_email: reversstorm@gmail.com
-
     ingress:
-      type: nginx # nginx
       enabled: true
-      ingress_class_name: nginx
       host_network: true
-
-    # load_balancer:
-    #   type: metallb
-    #   install: true
-
-    # docker_secrets:
-    #   repositories:
-    #     - name: registry
-    #       repository: registry.example.com
-    #       username: admin
-    #       password: admin
-    #       namespaces:
-    #         - default
-
     storage:
-      local_path_provisioner:
-        storage_class_name: local-path
-        reclaim_policy: Delete
-
       longhorn:
         enabled: true
-
       secrets_store_csi_driver:
         enabled: true
-
-      ## TODO: ceph

internal/config/modules_additional.go

@@ -6,7 +6,7 @@ type Additional struct {
 		ChartVersion string   `yaml:"chart_version" env-default:"v1.14.5"`
 		Enabled      bool     `yaml:"enabled"`
 		HaEnabled    bool     `yaml:"ha_enabled"`
-		DnsServers   []string `yaml:"dns_servers" env-default:"[8.8.8.8,1.1.1.1]"`
+		DnsServers   []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
 		AccountEmail string   `yaml:"account_email"`
 		Controller   struct {
 			Image string `yaml:"image" env-default:"quay.io/jetstack/cert-manager-controller"`
@@ -47,7 +47,6 @@ type Additional struct {
 
 	Storage struct {
 		LocalPathProvisioner struct {
-			Enabled          bool   `yaml:"enabled"`
 			StorageClassName string `yaml:"storage_class_name" env-default:"local-path"`
 			ReclaimPolicy    string `yaml:"reclaim_policy" env-default:"Delete"`
 		} `yaml:"local_path_provisioner"`

internal/config/modules_secrets_storage.go

@@ -27,7 +27,7 @@ type SecretsStorage struct {
 	} `yaml:"injector"`
 	Server struct {
 		Image       string `yaml:"image" env-default:"hashicorp/vault"`
-		Tag         string `yaml:"tag" env-default:"1.15.6"`
+		Tag         string `yaml:"tag" env-default:"1.16.0"`
 		Persistence struct {
 			DataStorage struct {
 				StorageClass string `yaml:"storage_class" env-default:"local-path"`
@@ -41,6 +41,6 @@ type SecretsStorage struct {
 	} `yaml:"server"`
 	Agent struct {
 		Image string `yaml:"image" env-default:"hashicorp/vault"`
-		Tag   string `yaml:"tag" env-default:"1.15.6"`
+		Tag   string `yaml:"tag" env-default:"1.16.0"`
 	} `yaml:"agent"`
 }

internal/config/orchestrator.go

@@ -1,12 +1,12 @@
 package config
 
 type Dns struct {
-	Servers                []string `yaml:"servers" env-default:"[8.8.8.8,8.8.4.4]"`
+	Servers                []string `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
-	DisableHostNameservers bool     `yaml:"disable_host_nameservers" env-default:"false"`
+	DisableHostNameservers bool     `yaml:"disable_host_nameservers"`
 }
 
 type Orchestrator struct {
-	Version                   string `yaml:"version" env-default:"v1.28.0"`
+	Version                   string `yaml:"version" env-default:"v1.29.0"`
 	ClusterName               string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
 	BinDir                    string `yaml:"bin_dir" env-default:"/usr/local/bin"`
 	SysctlFilePath            string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
@@ -16,12 +16,12 @@ type Orchestrator struct {
 	ExgernalCloudProvider     string `yaml:"external_cloud_provider"`
 	ContainerEngine           struct {
 		Type    string `yaml:"type" env-default:"containerd"`
-		Install bool   `yaml:"install" env-default:"true"`
+		Install bool   `yaml:"install"`
 	} `yaml:"container_engine"`
-	PingAccessIp             bool   `yaml:"ping_access_ip" env-default:"true"`
+	PingAccessIp             bool   `yaml:"ping_access_ip"`
-	AutoRenewCertificates    bool   `yaml:"auto_renew_certificates" env-default:"false"`
+	AutoRenewCertificates    bool   `yaml:"auto_renew_certificates"`
 	EventTtl                 string `yaml:"event_ttl" env-default:"1h0m0s"`
-	PodSecurityPolicyEnabled bool   `yaml:"pod_security_policy_enabled" env-default:"false"`
+	PodSecurityPolicyEnabled bool   `yaml:"pod_security_policy_enabled"`
 
 	Network struct {
 		Plugin           string `yaml:"plugin" env-default:"calico"`

internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl

@@ -290,7 +290,9 @@
     # +docs:property
     podDnsConfig:
       nameservers:
-        {{- .Modules.Additional.CertManager.DnsServers | toYaml | nindent 8 }}
+        {{- range $index,$value := .Modules.Additional.CertManager.DnsServers }}
+        - "{{ $value }}"
+        {{- end }}
 
     # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
     # matching labels.

kubespray/inventory/group_vars/k8s_cluster/addons.yml

@@ -1016,8 +1016,8 @@ releases:
       # +docs:property
       podDnsConfig:
         nameservers:
-          - 1.1.1.1
+          - "8.8.8.8"
-          - 8.8.8.8
+          - "1.1.1.1"
   
       # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
       # matching labels.
@@ -3659,7 +3659,7 @@ releases:
   
       ingress:
         enabled: true
-        accountEmail: reversstorm@gmail.com
+        accountEmail: adminmail@gmail.com
         class: nginx
         annotations:
           nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
@@ -3767,7 +3767,7 @@ releases:
     chart_version: 0.1.0
     release_state: "present"
     values:
-      issuer_email: reversstorm@gmail.com
+      issuer_email: adminmail@gmail.com
       solver_ingress_class: nginx
   
       certificates:
@@ -4213,11 +4213,11 @@ releases:
           server.insecure: true
   
         secret:
-          argocdServerAdminPassword: $2a$10$A6C0LMJpyH6Jx1CF570MxuCc/CYRauqjv3Z.31IcwEnf3h1E02QnG
+          argocdServerAdminPassword: $2a$10$emopmT/u2bzVYRDmFQnyH.xLNrVsLkqn61BDfx4Evzq.V8OfApXa2
   
         repositories:
           # add default helm-repository from harbor
-          {}
+          null
   
         cm:
           create: true
@@ -4945,7 +4945,7 @@ releases:
           secretName: argo-cd-server-tls
   
       ingress:
-        accountEmail: reversstorm@gmail.com
+        accountEmail: adminmail@gmail.com
         class: nginx
         annotations:
           nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
@@ -5799,7 +5799,7 @@ releases:
   
       ingress:
         enabled: true
-        accountEmail: reversstorm@gmail.com
+        accountEmail: adminmail@gmail.com
         class: nginx
         annotations:
           nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"