293 lines
6.2 KiB
YAML
293 lines
6.2 KiB
YAML
credentials:
|
|
user: sre-admin
|
|
ask_sudo_password: false
|
|
private_key_file: /home/sre-admin/.ssh/id_rsa
|
|
|
|
hosts:
|
|
- hostname: vbox-prod-k8s-master-01
|
|
ip: "10.250.50.22"
|
|
roles: [control_plane, etcd]
|
|
|
|
# # Optional creds for each host
|
|
# user: user
|
|
# password: nF5S8nuKi87Dh42Jnjik
|
|
|
|
- hostname: vbox-prod-k8s-slave-01
|
|
ip: "10.250.50.23"
|
|
roles: [node]
|
|
|
|
- hostname: vbox-prod-k8s-slave-02
|
|
ip: "10.250.50.21"
|
|
roles: [node]
|
|
|
|
orchestrator:
|
|
version: v1.29.0
|
|
cluster_name: k8s-cluster.local
|
|
# bin_dir: /usr/local/bin
|
|
# sysctl_file_path: /etc/sysctl.d/99-sysctl.conf
|
|
loadbalancer_apiserver_port: 6443
|
|
dns:
|
|
servers:
|
|
- 8.8.8.8
|
|
- 8.8.4.4
|
|
disable_host_nameservers: false
|
|
# cloud_provider: "" # 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
|
|
# external_cloud_provider: "" # 'openstack', 'vsphere' and 'hcloud'
|
|
|
|
container_engine:
|
|
type: containerd # docker, crio and containerd
|
|
install: true
|
|
|
|
ping_access_ip: true
|
|
auto_renew_certificates: true
|
|
event_ttl: "1h0m0s"
|
|
pod_security_policy_enabled: true
|
|
|
|
network:
|
|
plugin: calico # cilium, calico, kube-ovn, weave or flannel
|
|
# service_addresses: 10.233.0.0/18
|
|
# pods_subnet: 10.233.64.0/18
|
|
|
|
modules:
|
|
admin_password: changeit
|
|
|
|
## Add additional helm repositories before installation
|
|
# additional_repositories:
|
|
# - name: argo-helm
|
|
# url: "https://argoproj.github.io/argo-helm"
|
|
|
|
observability:
|
|
enabled: true
|
|
|
|
logging:
|
|
enabled: true
|
|
|
|
loki:
|
|
persistence:
|
|
storage_size: 10Gi
|
|
retention: 168h
|
|
|
|
events:
|
|
enabled: true
|
|
cron:
|
|
schedule: "*/2 * * * *"
|
|
|
|
tracing:
|
|
enabled: true
|
|
|
|
tempo:
|
|
retention: 24h
|
|
listen_port: 3100
|
|
|
|
persistence:
|
|
storage_size: 10Gi
|
|
|
|
tempo_query:
|
|
listen_port: 16686
|
|
|
|
monitoring:
|
|
enabled: true
|
|
|
|
prometheus:
|
|
scrape_interval: 15s
|
|
persistence:
|
|
storage_size: 3Gi
|
|
retention: 7d
|
|
|
|
alert_manager:
|
|
enabled: true
|
|
# additionalMessageTemplates: {}
|
|
|
|
route:
|
|
receiver: kvazaric_notifications
|
|
group_wait: 1s
|
|
repeat_interval: 180m
|
|
|
|
routes:
|
|
- receiver: "kvazaric_notifications"
|
|
group_by: ["alertname"]
|
|
group_wait: 1s
|
|
repeat_interval: 8737h
|
|
matchers:
|
|
- fireOnce=true
|
|
receivers:
|
|
- name: kvazaric_notifications
|
|
telegram_configs:
|
|
- send_resolved: true
|
|
api_url: https://api.telegram.org
|
|
bot_token: bot_token
|
|
chat_id: chat_id # int
|
|
parse_mode: HTML
|
|
message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
|
|
http_config:
|
|
follow_redirects: true
|
|
enable_http2: false
|
|
|
|
blackbox:
|
|
enabled: true
|
|
additional_modules: |
|
|
|
|
kube_state:
|
|
enabled: true
|
|
|
|
node:
|
|
enabled: true
|
|
|
|
visualization:
|
|
enabled: true
|
|
|
|
grafana:
|
|
enabled: true
|
|
expose:
|
|
type: ingress # ingress or NodePort
|
|
domain: grafana.disk.lt.t1.cloud
|
|
node_port_http: 30007
|
|
|
|
tls:
|
|
enabled: true
|
|
|
|
persistence:
|
|
storage_size: 2Gi
|
|
|
|
cicd:
|
|
enabled: true
|
|
|
|
argo_cd:
|
|
expose:
|
|
type: ingress # ingress or NodePort
|
|
domain: argocd.disk.lt.t1.cloud
|
|
|
|
node_port_http: 30005
|
|
node_port_https: 30006
|
|
|
|
tls:
|
|
enabled: true
|
|
|
|
repositories:
|
|
{}
|
|
# harbor-helm:
|
|
# enableOCI: "true"
|
|
# type: helm
|
|
# name: helm-mountbit
|
|
# url: harbor.disk.t1.cloud/mountbit-helm
|
|
# username: username
|
|
# password: password
|
|
rbac:
|
|
additional_policies: |
|
|
p, developer, applications, *, */*, allow
|
|
|
|
p, developer, applications, *, */*logging*, deny
|
|
p, developer, repositories, get, *, allow
|
|
p, developer, projects, get, *, allow
|
|
|
|
p, developer, logs, get, *, allow
|
|
|
|
p, guest, applications, get, */*, allow
|
|
p, guest, projects, get, *, allow
|
|
|
|
ha:
|
|
enabled: false
|
|
autoscaling: false
|
|
|
|
rollouts:
|
|
enabled: true
|
|
|
|
updates_operator:
|
|
enabled: true
|
|
|
|
secrets_storage:
|
|
enabled: true
|
|
key_shares: 5
|
|
key_threshold: 3
|
|
|
|
# specify unseal keys to auto-unseal after updates or restarts
|
|
unseal_keys:
|
|
- "abc"
|
|
- "abc"
|
|
- "abc"
|
|
expose:
|
|
type: ingress # ingress or NodePort
|
|
domain: vault.disk.lt.t1.cloud
|
|
node_port: 30004
|
|
|
|
tls:
|
|
enabled: true
|
|
|
|
# requires secrets_store_csi_driver in additional modules
|
|
csi_integration:
|
|
enabled: true
|
|
agent:
|
|
image: hashicorp/vault
|
|
tag: 1.16.0
|
|
server:
|
|
image: "hashicorp/vault"
|
|
tag: 1.16.0
|
|
persistence:
|
|
size: 10Gi
|
|
|
|
registry:
|
|
enabled: true
|
|
expose:
|
|
type: ingress # ingress or nodePort
|
|
# if expose_type is "ingress"
|
|
domain: harbor.disk.lt.t1.cloud
|
|
|
|
# if expose_type is "NodePort"
|
|
node_port_http: 30002
|
|
node_port_https: 30003
|
|
tls:
|
|
enabled: true
|
|
|
|
persistence:
|
|
registry_size: 10Gi
|
|
jobservice_size: 1Gi
|
|
database_size: 2Gi
|
|
redis_size: 1Gi
|
|
trivy_size: 5Gi
|
|
|
|
defaultProjects:
|
|
- name: harbor-helm
|
|
public: false
|
|
enabled_scanner: true
|
|
|
|
additional:
|
|
cert_manager:
|
|
enabled: true
|
|
ha_enabled: false
|
|
dns_servers:
|
|
- "1.1.1.1"
|
|
- "8.8.8.8"
|
|
account_email: reversstorm@gmail.com
|
|
|
|
ingress:
|
|
type: nginx # nginx
|
|
enabled: true
|
|
ingress_class_name: nginx
|
|
host_network: true
|
|
|
|
# load_balancer:
|
|
# type: metallb
|
|
# install: true
|
|
|
|
# docker_secrets:
|
|
# repositories:
|
|
# - name: registry
|
|
# repository: registry.example.com
|
|
# username: admin
|
|
# password: admin
|
|
# namespaces:
|
|
# - default
|
|
|
|
storage:
|
|
local_path_provisioner:
|
|
storage_class_name: local-path
|
|
reclaim_policy: Delete
|
|
|
|
longhorn:
|
|
enabled: true
|
|
|
|
secrets_store_csi_driver:
|
|
enabled: true
|
|
|
|
## TODO: ceph
|