From f84c27e622c3c3efe3d10c7ddcb74b4dc7d45364 Mon Sep 17 00:00:00 2001 From: George Stykalin Date: Sat, 25 May 2024 21:31:10 +0300 Subject: [PATCH] add ability to specify paths for argocd and grafana (https://git.kvazaric.ru/gstykalin/kube-forge/-/issues/1) --- README.md | 9 +- config.sample.yaml | 2 + internal/config/modules_additional.go | 2 +- internal/config/modules_cicd.go | 3 +- internal/config/modules_observability.go | 1 + internal/config/modules_registry.go | 1 + internal/config/modules_secrets_storage.go | 1 + .../secrets-store-csi-driver.yml.tmpl | 245 ++++++++++++++++ .../releases/authentication/keycloak.yml.tmpl | 0 .../releases/cicd/argo-cd-ingress.yml.tmpl | 1 + .../helm-apps/releases/cicd/argo-cd.yml.tmpl | 3 + .../observability/observability.yml.tmpl | 6 +- .../releases/registry/harbor.yml.tmpl | 2 +- .../releases/secrets-storage/vault.yml.tmpl | 7 +- .../group_vars/k8s_cluster/addons.yml.tmpl | 2 +- .../k8s_cluster/k8s-cluster.yml.tmpl | 2 +- .../group_vars/k8s_cluster/addons.yml | 263 +++++++++++++++++- 17 files changed, 534 insertions(+), 16 deletions(-) create mode 100644 internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl diff --git a/README.md b/README.md index afd5f6b..f8107c0 100644 --- a/README.md +++ b/README.md @@ -7,11 +7,12 @@ ### Docker-образ ```shell +touch k8s-admin.conf + docker run -v $(pwd)/config.yaml:/application/config.yaml \ -v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \ - -v $(pwd)/config:/root/.ssh/config \ - -v $(pwd)/k8s-admin.conf:/application/k8s-admin.conf \ - harbor.kvazaric.ru/kube-forge/kube-forge:1.0-71bd08d2 apply + -v type=bind,src=$(pwd)/k8s-admin.conf,dst=/application/k8s-admin.conf\ + harbor.kvazaric.ru/kube-forge/kube-forge:1.1-36d886d9 apply ``` ## С помощью исполняемого файла @@ -20,6 +21,8 @@ docker run -v $(pwd)/config.yaml:/application/config.yaml \ - sshpass +А также установить Python-библиотеки из списка "requirements.txt" + ```shell ./kube-forge -c config.yaml -d . apply ``` diff --git a/config.sample.yaml b/config.sample.yaml index fd79af4..24f3a9c 100644 --- a/config.sample.yaml +++ b/config.sample.yaml @@ -72,6 +72,7 @@ modules: expose: type: ingress # ingress or NodePort domain: grafana.disk.lt.t1.cloud + # path: "/grafana" tls: enabled: true @@ -81,6 +82,7 @@ modules: expose: type: ingress # ingress or NodePort domain: argocd.disk.lt.t1.cloud + # path: "/cicd" tls: enabled: true rollouts: diff --git a/internal/config/modules_additional.go b/internal/config/modules_additional.go index 9cbac18..d763101 100644 --- a/internal/config/modules_additional.go +++ b/internal/config/modules_additional.go @@ -36,7 +36,7 @@ type Additional struct { LoadBalancer struct { Type string `yaml:"type" env-default:"metallb"` - Install bool `yaml:"install"` + Enabled bool `yaml:"enabled"` } `yaml:"load_balancer"` DockerSecrets struct { diff --git a/internal/config/modules_cicd.go b/internal/config/modules_cicd.go index 6bb2a8c..7112b1e 100644 --- a/internal/config/modules_cicd.go +++ b/internal/config/modules_cicd.go @@ -4,7 +4,7 @@ type Cicd struct { Enabled bool `yaml:"enabled"` ArgoCd struct { ChartRef string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"` - ChartVersion string `yaml:"chart_version" env-default:"5.46.7"` + ChartVersion string `yaml:"chart_version" env-default:"6.7.10"` AdminPassword string Ha struct { Enabled bool `yaml:"enabled"` @@ -13,6 +13,7 @@ type Cicd struct { Expose struct { Type string `yaml:"type"` Domain string `yaml:"domain"` + Path string `yaml:"path" env-default:"/"` NodePortHttp int `yaml:"node_port_http" env-default:"30005"` NodePortHttps int `yaml:"node_port_https" env-default:"30006"` Tls struct { diff --git a/internal/config/modules_observability.go b/internal/config/modules_observability.go index 75e5f36..44dffd2 100644 --- a/internal/config/modules_observability.go +++ b/internal/config/modules_observability.go @@ -154,6 +154,7 @@ type Visualization struct { Expose struct { Type string `yaml:"type" env-default:"ingress"` Domain string `yaml:"domain" env-default:""` + Path string `yaml:"path" env-default:"/"` NodePortHttp int `yaml:"node_port_http" env-default:"30007"` Tls struct { Enabled bool `yaml:"enabled"` diff --git a/internal/config/modules_registry.go b/internal/config/modules_registry.go index bbb5f56..7841b09 100644 --- a/internal/config/modules_registry.go +++ b/internal/config/modules_registry.go @@ -10,6 +10,7 @@ type Registry struct { Expose struct { Type string `yaml:"type" env-default:"nodePort"` Domain string `yaml:"domain" env-default:""` + Path string `yaml:"path" env-default:"/"` NodePortHttp int `yaml:"node_port_http" env-default:"30002"` NodePortHttps int `yaml:"node_port_https" env-default:"30003"` } `yaml:"expose"` diff --git a/internal/config/modules_secrets_storage.go b/internal/config/modules_secrets_storage.go index 006edf5..0db1329 100644 --- a/internal/config/modules_secrets_storage.go +++ b/internal/config/modules_secrets_storage.go @@ -11,6 +11,7 @@ type SecretsStorage struct { Expose struct { Type string `yaml:"type"` Domain string `yaml:"domain"` + Path string `yaml:"path" env-default:"/"` NodePort int `yaml:"node_port"` Tls struct { Enabled bool `yaml:"enabled"` diff --git a/internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl b/internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl index 066c4a1..7d16d4f 100644 --- a/internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl @@ -7,3 +7,248 @@ {{- else }} release_state: "absent" {{- end }} + values: + linux: + enabled: true + image: + repository: registry.k8s.io/csi-secrets-store/driver + tag: v1.4.3 + #digest: sha256: + pullPolicy: IfNotPresent + + crds: + enabled: true + image: + repository: registry.k8s.io/csi-secrets-store/driver-crds + tag: v1.4.3 + pullPolicy: IfNotPresent + ## Optionally override resource limits for crd hooks(jobs) + resources: {} + # requests: + # cpu: "100m" + # memory: "128Mi" + # limits: + # cpu: "500m" + # memory: "512Mi" + annotations: {} + podLabels: {} + + ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: type + operator: NotIn + values: + - virtual-kubelet + + driver: + resources: + limits: + cpu: 200m + memory: 200Mi + requests: + cpu: 50m + memory: 100Mi + + registrarImage: + repository: registry.k8s.io/sig-storage/csi-node-driver-registrar + tag: v2.10.0 + #digest: sha256: + pullPolicy: IfNotPresent + + registrar: + resources: + limits: + cpu: 100m + memory: 100Mi + requests: + cpu: 10m + memory: 20Mi + logVerbosity: 5 + + livenessProbeImage: + repository: registry.k8s.io/sig-storage/livenessprobe + tag: v2.12.0 + #digest: sha256: + pullPolicy: IfNotPresent + + livenessProbe: + resources: + limits: + cpu: 100m + memory: 100Mi + requests: + cpu: 10m + memory: 20Mi + + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + + kubeletRootDir: /var/lib/kubelet + providersDir: /var/run/secrets-store-csi-providers + additionalProvidersDirs: + - /etc/kubernetes/secrets-store-csi-providers + nodeSelector: {} + # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything. + tolerations: + - operator: "Exists" + metricsAddr: ":8095" + env: [] + priorityClassName: "" + daemonsetAnnotations: {} + podAnnotations: {} + podLabels: {} + + # volumes is a list of volumes made available to secrets store csi driver. + volumes: null + # - name: foo + # emptyDir: {} + + # volumeMounts is a list of volumeMounts for secrets store csi driver. + volumeMounts: null + # - name: foo + # mountPath: /bar + # readOnly: true + + windows: + enabled: false + image: + repository: registry.k8s.io/csi-secrets-store/driver + tag: v1.4.3 + #digest: sha256: + pullPolicy: IfNotPresent + + ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: type + operator: NotIn + values: + - virtual-kubelet + + driver: + resources: + limits: + cpu: 400m + memory: 400Mi + requests: + cpu: 100m + memory: 100Mi + + registrarImage: + repository: registry.k8s.io/sig-storage/csi-node-driver-registrar + tag: v2.10.0 + #digest: sha256: + pullPolicy: IfNotPresent + + registrar: + resources: + limits: + cpu: 200m + memory: 200Mi + requests: + cpu: 100m + memory: 100Mi + logVerbosity: 5 + + livenessProbeImage: + repository: registry.k8s.io/sig-storage/livenessprobe + tag: v2.12.0 + #digest: sha256: + pullPolicy: IfNotPresent + + livenessProbe: + resources: + limits: + cpu: 200m + memory: 200Mi + requests: + cpu: 100m + memory: 100Mi + + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + + kubeletRootDir: C:\var\lib\kubelet + providersDir: C:\\k\\secrets-store-csi-providers + additionalProvidersDirs: + nodeSelector: {} + # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything. + tolerations: + - operator: "Exists" + metricsAddr: ":8095" + env: [] + priorityClassName: "" + daemonsetAnnotations: {} + podAnnotations: {} + podLabels: {} + + # volumes is a list of volumes made available to secrets store csi driver. + volumes: null + # - name: foo + # emptyDir: {} + + # volumeMounts is a list of volumeMounts for secrets store csi driver. + volumeMounts: null + # - name: foo + # mountPath: /bar + # readOnly: true + + # log level. Uses V logs (klog) + logVerbosity: 0 + + # logging format JSON + logFormatJSON: false + + livenessProbe: + port: 9808 + logLevel: 2 + + ## Maximum size in bytes of gRPC response from plugins + maxCallRecvMsgSize: 4194304 + + ## Install Default RBAC roles and bindings + rbac: + install: true + pspEnabled: false + + ## Install RBAC roles and bindings required for K8S Secrets syncing if true + syncSecret: + enabled: false + + ## Enable secret rotation feature [alpha] + enableSecretRotation: false + + ## Secret rotation poll interval duration + rotationPollInterval: + + ## Provider HealthCheck + providerHealthCheck: false + + ## Provider HealthCheck interval + providerHealthCheckInterval: 2m + + imagePullSecrets: [] + + ## This allows CSI drivers to impersonate the pods that they mount the volumes for. + # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details. + # Supported only for Kubernetes v1.20+ + tokenRequests: [] + # - audience: aud1 + # - audience: aud2 + + # -- Labels to apply to all resources + commonLabels: {} + # team_name: dev \ No newline at end of file diff --git a/internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl b/internal/resources/templates/helm-apps/releases/authentication/keycloak.yml.tmpl new file mode 100644 index 0000000..e69de29 diff --git a/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl b/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl index c4977dc..21edde0 100644 --- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl @@ -11,6 +11,7 @@ values: services: - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }} + path: {{ .Modules.Cicd.ArgoCd.Expose.Path }} address: argo-cd-argocd-server port: 80 secretName: argo-cd-server-tls diff --git a/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl b/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl index 4ea1390..24f2432 100644 --- a/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl @@ -89,6 +89,9 @@ configs: params: server.insecure: true + {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }} + server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}' + {{- end }} secret: argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }} diff --git a/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl b/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl index e37042b..43bff48 100644 --- a/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl @@ -209,6 +209,7 @@ enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }} serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }} domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }} + path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }} {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }} serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }} {{- end }} @@ -225,7 +226,10 @@ config: server: | enable_gzip = true - root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }} + root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }} + {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }} + serve_from_sub_path = true + {{- end }} security: | admin_user = admin diff --git a/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl b/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl index dbecedf..0132006 100644 --- a/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl @@ -41,7 +41,7 @@ port: 443 nodePort: {{ .Modules.Registry.Expose.NodePortHttps }} - externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }} + externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }} persistence: resourcePolicy: "keep" persistentVolumeClaim: diff --git a/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl b/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl index 756a599..423a180 100644 --- a/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl +++ b/internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl @@ -710,6 +710,7 @@ ui: enabled: true domain: {{ .Modules.SecretsStorage.Expose.Domain }} + path: {{ .Modules.SecretsStorage.Expose.Path }} publishNotReadyAddresses: true # The service should only contain selectors for active Vault pod activeVaultPodOnly: false @@ -785,7 +786,11 @@ pod: annotations: {} - tolerations: [] + tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule + - key: node-role.kubernetes.io/control-plane + effect: NoSchedule nodeSelector: {} affinity: {} extraLabels: {} diff --git a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl index 51c51f3..964dcb6 100644 --- a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl +++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl @@ -154,7 +154,7 @@ cert_manager_dns_config: - "8.8.4.4" # MetalLB deployment -{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }} +{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }} metallb_enabled: true {{- else }} metallb_enabled: false diff --git a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl index e2e765d..865e4dc 100644 --- a/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl +++ b/internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl @@ -126,7 +126,7 @@ kube_proxy_mode: ipvs # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface # must be set to true for MetalLB, kube-vip(ARP enabled) to work -{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }} +{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }} kube_proxy_strict_arp: true {{- else }} kube_proxy_strict_arp: false diff --git a/kubespray/inventory/group_vars/k8s_cluster/addons.yml b/kubespray/inventory/group_vars/k8s_cluster/addons.yml index e1ead0a..173cea0 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/addons.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/addons.yml @@ -2895,7 +2895,251 @@ releases: chart_ref: kube-forge/secrets-store-csi-driver chart_version: 1.4.3 release_state: "present" + values: + linux: + enabled: true + image: + repository: registry.k8s.io/csi-secrets-store/driver + tag: v1.4.3 + #digest: sha256: + pullPolicy: IfNotPresent + crds: + enabled: true + image: + repository: registry.k8s.io/csi-secrets-store/driver-crds + tag: v1.4.3 + pullPolicy: IfNotPresent + ## Optionally override resource limits for crd hooks(jobs) + resources: {} + # requests: + # cpu: "100m" + # memory: "128Mi" + # limits: + # cpu: "500m" + # memory: "512Mi" + annotations: {} + podLabels: {} + + ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: type + operator: NotIn + values: + - virtual-kubelet + + driver: + resources: + limits: + cpu: 200m + memory: 200Mi + requests: + cpu: 50m + memory: 100Mi + + registrarImage: + repository: registry.k8s.io/sig-storage/csi-node-driver-registrar + tag: v2.10.0 + #digest: sha256: + pullPolicy: IfNotPresent + + registrar: + resources: + limits: + cpu: 100m + memory: 100Mi + requests: + cpu: 10m + memory: 20Mi + logVerbosity: 5 + + livenessProbeImage: + repository: registry.k8s.io/sig-storage/livenessprobe + tag: v2.12.0 + #digest: sha256: + pullPolicy: IfNotPresent + + livenessProbe: + resources: + limits: + cpu: 100m + memory: 100Mi + requests: + cpu: 10m + memory: 20Mi + + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + + kubeletRootDir: /var/lib/kubelet + providersDir: /var/run/secrets-store-csi-providers + additionalProvidersDirs: + - /etc/kubernetes/secrets-store-csi-providers + nodeSelector: {} + # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything. + tolerations: + - operator: "Exists" + metricsAddr: ":8095" + env: [] + priorityClassName: "" + daemonsetAnnotations: {} + podAnnotations: {} + podLabels: {} + + # volumes is a list of volumes made available to secrets store csi driver. + volumes: null + # - name: foo + # emptyDir: {} + + # volumeMounts is a list of volumeMounts for secrets store csi driver. + volumeMounts: null + # - name: foo + # mountPath: /bar + # readOnly: true + + windows: + enabled: false + image: + repository: registry.k8s.io/csi-secrets-store/driver + tag: v1.4.3 + #digest: sha256: + pullPolicy: IfNotPresent + + ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: type + operator: NotIn + values: + - virtual-kubelet + + driver: + resources: + limits: + cpu: 400m + memory: 400Mi + requests: + cpu: 100m + memory: 100Mi + + registrarImage: + repository: registry.k8s.io/sig-storage/csi-node-driver-registrar + tag: v2.10.0 + #digest: sha256: + pullPolicy: IfNotPresent + + registrar: + resources: + limits: + cpu: 200m + memory: 200Mi + requests: + cpu: 100m + memory: 100Mi + logVerbosity: 5 + + livenessProbeImage: + repository: registry.k8s.io/sig-storage/livenessprobe + tag: v2.12.0 + #digest: sha256: + pullPolicy: IfNotPresent + + livenessProbe: + resources: + limits: + cpu: 200m + memory: 200Mi + requests: + cpu: 100m + memory: 100Mi + + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + + kubeletRootDir: C:\var\lib\kubelet + providersDir: C:\\k\\secrets-store-csi-providers + additionalProvidersDirs: + nodeSelector: {} + # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything. + tolerations: + - operator: "Exists" + metricsAddr: ":8095" + env: [] + priorityClassName: "" + daemonsetAnnotations: {} + podAnnotations: {} + podLabels: {} + + # volumes is a list of volumes made available to secrets store csi driver. + volumes: null + # - name: foo + # emptyDir: {} + + # volumeMounts is a list of volumeMounts for secrets store csi driver. + volumeMounts: null + # - name: foo + # mountPath: /bar + # readOnly: true + + # log level. Uses V logs (klog) + logVerbosity: 0 + + # logging format JSON + logFormatJSON: false + + livenessProbe: + port: 9808 + logLevel: 2 + + ## Maximum size in bytes of gRPC response from plugins + maxCallRecvMsgSize: 4194304 + + ## Install Default RBAC roles and bindings + rbac: + install: true + pspEnabled: false + + ## Install RBAC roles and bindings required for K8S Secrets syncing if true + syncSecret: + enabled: false + + ## Enable secret rotation feature [alpha] + enableSecretRotation: false + + ## Secret rotation poll interval duration + rotationPollInterval: + + ## Provider HealthCheck + providerHealthCheck: false + + ## Provider HealthCheck interval + providerHealthCheckInterval: 2m + + imagePullSecrets: [] + + ## This allows CSI drivers to impersonate the pods that they mount the volumes for. + # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details. + # Supported only for Kubernetes v1.20+ + tokenRequests: [] + # - audience: aud1 + # - audience: aud2 + + # -- Labels to apply to all resources + commonLabels: {} + # team_name: dev - name: fluent-operator namespace: observability create_namespace: true @@ -3793,6 +4037,7 @@ releases: enabled: true serviceMonitor: true domain: &grafanaDomain grafana.disk.lt.t1.cloud + path: / image: repository: grafana/grafana tag: 10.4.1 @@ -3806,7 +4051,7 @@ releases: config: server: | enable_gzip = true - root_url = https://grafana.disk.lt.t1.cloud + root_url = https://grafana.disk.lt.t1.cloud/ security: | admin_user = admin @@ -4355,7 +4600,7 @@ releases: namespace: cicd create_namespace: true chart_ref: kube-forge/argo-cd - chart_version: 5.46.7 + chart_version: 6.7.10 release_state: "present" values: crds: @@ -4413,7 +4658,7 @@ releases: server.insecure: true secret: - argocdServerAdminPassword: $2a$10$N3yN5AWSH6e7MfcQUt7/NOJpXacdWK1vPRiZPbzsUsMWNqCy9G8l6 + argocdServerAdminPassword: $2a$10$eb0YB2bJ/B9XvAOACyvWGOUMDfyOO.Jfej8DyA.7MhzzwhopgkVFq repositories: # add default helm-repository from harbor @@ -4421,7 +4666,7 @@ releases: cm: create: true - url: "https://argocd.disk.lt.t1.cloud" + url: "https://cicd.disk.lt.t1.cloud" accounts.developer: login accounts.guest: login @@ -5139,7 +5384,8 @@ releases: release_state: "present" values: services: - - domain: argocd.disk.lt.t1.cloud + - domain: cicd.disk.lt.t1.cloud + path: / address: argo-cd-argocd-server port: 80 secretName: argo-cd-server-tls @@ -5854,6 +6100,7 @@ releases: ui: enabled: true domain: vault.disk.lt.t1.cloud + path: / publishNotReadyAddresses: true # The service should only contain selectors for active Vault pod activeVaultPodOnly: false @@ -5924,7 +6171,11 @@ releases: pod: annotations: {} - tolerations: [] + tolerations: + - key: node-role.kubernetes.io/master + effect: NoSchedule + - key: node-role.kubernetes.io/control-plane + effect: NoSchedule nodeSelector: {} affinity: {} extraLabels: {}