gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update configuration and example config

Browse Source
This commit is contained in:
George Stykalin
2024-05-13 00:04:00 +03:00
parent 502552be32
commit be7ea89318
6 changed files with 23 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files

175
config.sample.yaml
View File

@@ -7,102 +7,39 @@ hosts:
- hostname: vbox-prod-k8s-master-01
ip: "10.250.50.22"
roles: [control_plane, etcd]
# # Optional creds for each host
# user: user
# password: nF5S8nuKi87Dh42Jnjik
- hostname: vbox-prod-k8s-slave-01
ip: "10.250.50.23"
roles: [node]
- hostname: vbox-prod-k8s-slave-02
ip: "10.250.50.21"
roles: [node]
orchestrator:
version: v1.29.0
cluster_name: k8s-cluster.local
# bin_dir: /usr/local/bin
# sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
loadbalancer_apiserver_port: 6443
dns:
servers:
- 8.8.8.8
- 8.8.4.4
disable_host_nameservers: false
# cloud_provider: "" # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
# external_cloud_provider: "" # 'openstack', 'vsphere' and 'hcloud'
container_engine:
type: containerd # docker, crio and containerd
install: true
ping_access_ip: true
auto_renew_certificates: true
event_ttl: "1h0m0s"
pod_security_policy_enabled: true
network:
plugin: calico # cilium, calico, kube-ovn, weave or flannel
# service_addresses: 10.233.0.0/18
# pods_subnet: 10.233.64.0/18
modules:
admin_password: changeit
## Add additional helm repositories before installation
# additional_repositories:
# - name: argo-helm
# url: "https://argoproj.github.io/argo-helm"
observability:
enabled: true
logging:
enabled: true
loki:
persistence:
storage_size: 10Gi
retention: 168h
events:
enabled: true
cron:
schedule: "*/2 * * * *"
tracing:
enabled: true
tempo:
retention: 24h
listen_port: 3100
persistence:
storage_size: 10Gi
tempo_query:
listen_port: 16686
monitoring:
enabled: true
prometheus:
scrape_interval: 15s
persistence:
storage_size: 3Gi
retention: 7d
alert_manager:
enabled: true
# additionalMessageTemplates: {}
route:
receiver: kvazaric_notifications
group_wait: 1s
repeat_interval: 180m
routes:
- receiver: "kvazaric_notifications"
group_by: ["alertname"]
@@ -116,87 +53,38 @@ modules:
- send_resolved: true
api_url: https://api.telegram.org
bot_token: bot_token
chat_id: chat_id # int
chat_id: -10000
parse_mode: HTML
message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
http_config:
follow_redirects: true
enable_http2: false
blackbox:
enabled: true
additional_modules: |
kube_state:
enabled: true
node:
enabled: true
visualization:
enabled: true
grafana:
enabled: true
expose:
type: ingress # ingress or NodePort
domain: grafana.disk.lt.t1.cloud
node_port_http: 30007
tls:
enabled: true
persistence:
storage_size: 2Gi
cicd:
enabled: true
argo_cd:
expose:
type: ingress # ingress or NodePort
domain: argocd.disk.lt.t1.cloud
node_port_http: 30005
node_port_https: 30006
tls:
enabled: true
repositories:
{}
# harbor-helm:
# enableOCI: "true"
# type: helm
# name: helm-mountbit
# url: harbor.disk.t1.cloud/mountbit-helm
# username: username
# password: password
rbac:
additional_policies: |
p, developer, applications, *, */*, allow
p, developer, applications, *, */*logging*, deny
p, developer, repositories, get, *, allow
p, developer, projects, get, *, allow
p, developer, logs, get, *, allow
p, guest, applications, get, */*, allow
p, guest, projects, get, *, allow
ha:
enabled: false
autoscaling: false
rollouts:
enabled: true
ha:
enabled: true
expose:
type: "NodePort" # now only NodePort supported
node_port: 30010
updates_operator:
enabled: true
@@ -204,91 +92,32 @@ modules:
enabled: true
key_shares: 5
key_threshold: 3
# specify unseal keys to auto-unseal after updates or restarts
unseal_keys:
- "abc"
- "abc"
- "abc"
expose:
type: ingress # ingress or NodePort
domain: vault.disk.lt.t1.cloud
node_port: 30004
tls:
enabled: true
# requires secrets_store_csi_driver in additional modules
csi_integration:
enabled: true
agent:
image: hashicorp/vault
tag: 1.16.0
server:
image: "hashicorp/vault"
tag: 1.16.0
persistence:
size: 10Gi
registry:
enabled: true
expose:
type: ingress # ingress or nodePort
# if expose_type is "ingress"
domain: harbor.disk.lt.t1.cloud
# if expose_type is "NodePort"
node_port_http: 30002
node_port_https: 30003
tls:
enabled: true
persistence:
registry_size: 10Gi
jobservice_size: 1Gi
database_size: 2Gi
redis_size: 1Gi
trivy_size: 5Gi
enabled_scanner: true
additional:
cert_manager:
enabled: true
ha_enabled: false
dns_servers:
- "1.1.1.1"
- "8.8.8.8"
account_email: reversstorm@gmail.com
account_email: adminmail@gmail.com
ingress:
type: nginx # nginx
enabled: true
ingress_class_name: nginx
host_network: true
# load_balancer:
# type: metallb
# install: true
# docker_secrets:
# repositories:
# - name: registry
# repository: registry.example.com
# username: admin
# password: admin
# namespaces:
# - default
storage:
local_path_provisioner:
storage_class_name: local-path
reclaim_policy: Delete
longhorn:
enabled: true
secrets_store_csi_driver:
enabled: true
## TODO: ceph

3
internal/config/modules_additional.go
View File

@@ -6,7 +6,7 @@ type Additional struct {
ChartVersion string `yaml:"chart_version" env-default:"v1.14.5"`
Enabled bool `yaml:"enabled"`
HaEnabled bool `yaml:"ha_enabled"`
DnsServers []string `yaml:"dns_servers" env-default:"[8.8.8.8,1.1.1.1]"`
DnsServers []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
AccountEmail string `yaml:"account_email"`
Controller struct {
Image string `yaml:"image" env-default:"quay.io/jetstack/cert-manager-controller"`
@@ -47,7 +47,6 @@ type Additional struct {
Storage struct {
LocalPathProvisioner struct {
Enabled bool `yaml:"enabled"`
StorageClassName string `yaml:"storage_class_name" env-default:"local-path"`
ReclaimPolicy string `yaml:"reclaim_policy" env-default:"Delete"`
} `yaml:"local_path_provisioner"`

4
internal/config/modules_secrets_storage.go
View File

@@ -27,7 +27,7 @@ type SecretsStorage struct {
} `yaml:"injector"`
Server struct {
Image string `yaml:"image" env-default:"hashicorp/vault"`
Tag string `yaml:"tag" env-default:"1.15.6"`
Tag string `yaml:"tag" env-default:"1.16.0"`
Persistence struct {
DataStorage struct {
StorageClass string `yaml:"storage_class" env-default:"local-path"`
@@ -41,6 +41,6 @@ type SecretsStorage struct {
} `yaml:"server"`
Agent struct {
Image string `yaml:"image" env-default:"hashicorp/vault"`
Tag string `yaml:"tag" env-default:"1.15.6"`
Tag string `yaml:"tag" env-default:"1.16.0"`
} `yaml:"agent"`
}

14
internal/config/orchestrator.go
View File

@@ -1,12 +1,12 @@
package config
type Dns struct {
Servers []string `yaml:"servers" env-default:"[8.8.8.8,8.8.4.4]"`
DisableHostNameservers bool `yaml:"disable_host_nameservers" env-default:"false"`
Servers []string `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
DisableHostNameservers bool `yaml:"disable_host_nameservers"`
}
type Orchestrator struct {
Version string `yaml:"version" env-default:"v1.28.0"`
Version string `yaml:"version" env-default:"v1.29.0"`
ClusterName string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
BinDir string `yaml:"bin_dir" env-default:"/usr/local/bin"`
SysctlFilePath string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
@@ -16,12 +16,12 @@ type Orchestrator struct {
ExgernalCloudProvider string `yaml:"external_cloud_provider"`
ContainerEngine struct {
Type string `yaml:"type" env-default:"containerd"`
Install bool `yaml:"install" env-default:"true"`
Install bool `yaml:"install"`
} `yaml:"container_engine"`
PingAccessIp bool `yaml:"ping_access_ip" env-default:"true"`
AutoRenewCertificates bool `yaml:"auto_renew_certificates" env-default:"false"`
PingAccessIp bool `yaml:"ping_access_ip"`
AutoRenewCertificates bool `yaml:"auto_renew_certificates"`
EventTtl string `yaml:"event_ttl" env-default:"1h0m0s"`
PodSecurityPolicyEnabled bool `yaml:"pod_security_policy_enabled" env-default:"false"`
PodSecurityPolicyEnabled bool `yaml:"pod_security_policy_enabled"`
Network struct {
Plugin string `yaml:"plugin" env-default:"calico"`

4
internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl
View File

@@ -290,7 +290,9 @@
# +docs:property
podDnsConfig:
nameservers:
{{- .Modules.Additional.CertManager.DnsServers | toYaml | nindent 8 }}
{{- range $index,$value := .Modules.Additional.CertManager.DnsServers }}
- "{{ $value }}"
{{- end }}
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
# matching labels.

16
kubespray/inventory/group_vars/k8s_cluster/addons.yml
View File

@@ -1016,8 +1016,8 @@ releases:
# +docs:property
podDnsConfig:
nameservers:
- 1.1.1.1
- 8.8.8.8
- "8.8.8.8"
- "1.1.1.1"
# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
# matching labels.
@@ -3659,7 +3659,7 @@ releases:
ingress:
enabled: true
accountEmail: reversstorm@gmail.com
accountEmail: adminmail@gmail.com
class: nginx
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
@@ -3767,7 +3767,7 @@ releases:
chart_version: 0.1.0
release_state: "present"
values:
issuer_email: reversstorm@gmail.com
issuer_email: adminmail@gmail.com
solver_ingress_class: nginx
certificates:
@@ -4213,11 +4213,11 @@ releases:
server.insecure: true
secret:
argocdServerAdminPassword: $2a$10$A6C0LMJpyH6Jx1CF570MxuCc/CYRauqjv3Z.31IcwEnf3h1E02QnG
argocdServerAdminPassword: $2a$10$emopmT/u2bzVYRDmFQnyH.xLNrVsLkqn61BDfx4Evzq.V8OfApXa2
repositories:
# add default helm-repository from harbor
{}
null
cm:
create: true
@@ -4945,7 +4945,7 @@ releases:
secretName: argo-cd-server-tls
ingress:
accountEmail: reversstorm@gmail.com
accountEmail: adminmail@gmail.com
class: nginx
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
@@ -5799,7 +5799,7 @@ releases:
ingress:
enabled: true
accountEmail: reversstorm@gmail.com
accountEmail: adminmail@gmail.com
class: nginx
annotations:
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"