repo migration
This commit is contained in:
@@ -0,0 +1,93 @@
|
|||||||
|
# clustertool
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Getting started
|
||||||
|
|
||||||
|
To make it easy for you to get started with GitLab, here's a list of recommended next steps.
|
||||||
|
|
||||||
|
Already a pro? Just edit this README.md and make it your own. Want to make it easy? [Use the template at the bottom](#editing-this-readme)!
|
||||||
|
|
||||||
|
## Add your files
|
||||||
|
|
||||||
|
- [ ] [Create](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#create-a-file) or [upload](https://docs.gitlab.com/ee/user/project/repository/web_editor.html#upload-a-file) files
|
||||||
|
- [ ] [Add files using the command line](https://docs.gitlab.com/ee/gitlab-basics/add-file.html#add-a-file-using-the-command-line) or push an existing Git repository with the following command:
|
||||||
|
|
||||||
|
```
|
||||||
|
cd existing_repo
|
||||||
|
git remote add origin https://gitlab.wpjones.com/wjones/clustertool.git
|
||||||
|
git branch -M main
|
||||||
|
git push -uf origin main
|
||||||
|
```
|
||||||
|
|
||||||
|
## Integrate with your tools
|
||||||
|
|
||||||
|
- [ ] [Set up project integrations](https://gitlab.wpjones.com/wjones/clustertool/-/settings/integrations)
|
||||||
|
|
||||||
|
## Collaborate with your team
|
||||||
|
|
||||||
|
- [ ] [Invite team members and collaborators](https://docs.gitlab.com/ee/user/project/members/)
|
||||||
|
- [ ] [Create a new merge request](https://docs.gitlab.com/ee/user/project/merge_requests/creating_merge_requests.html)
|
||||||
|
- [ ] [Automatically close issues from merge requests](https://docs.gitlab.com/ee/user/project/issues/managing_issues.html#closing-issues-automatically)
|
||||||
|
- [ ] [Enable merge request approvals](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/)
|
||||||
|
- [ ] [Set auto-merge](https://docs.gitlab.com/ee/user/project/merge_requests/merge_when_pipeline_succeeds.html)
|
||||||
|
|
||||||
|
## Test and Deploy
|
||||||
|
|
||||||
|
Use the built-in continuous integration in GitLab.
|
||||||
|
|
||||||
|
- [ ] [Get started with GitLab CI/CD](https://docs.gitlab.com/ee/ci/quick_start/index.html)
|
||||||
|
- [ ] [Analyze your code for known vulnerabilities with Static Application Security Testing (SAST)](https://docs.gitlab.com/ee/user/application_security/sast/)
|
||||||
|
- [ ] [Deploy to Kubernetes, Amazon EC2, or Amazon ECS using Auto Deploy](https://docs.gitlab.com/ee/topics/autodevops/requirements.html)
|
||||||
|
- [ ] [Use pull-based deployments for improved Kubernetes management](https://docs.gitlab.com/ee/user/clusters/agent/)
|
||||||
|
- [ ] [Set up protected environments](https://docs.gitlab.com/ee/ci/environments/protected_environments.html)
|
||||||
|
|
||||||
|
***
|
||||||
|
|
||||||
|
# Editing this README
|
||||||
|
|
||||||
|
When you're ready to make this README your own, just edit this file and use the handy template below (or feel free to structure it however you want - this is just a starting point!). Thanks to [makeareadme.com](https://www.makeareadme.com/) for this template.
|
||||||
|
|
||||||
|
## Suggestions for a good README
|
||||||
|
|
||||||
|
Every project is different, so consider which of these sections apply to yours. The sections used in the template are suggestions for most open source projects. Also keep in mind that while a README can be too long and detailed, too long is better than too short. If you think your README is too long, consider utilizing another form of documentation rather than cutting out information.
|
||||||
|
|
||||||
|
## Name
|
||||||
|
Choose a self-explaining name for your project.
|
||||||
|
|
||||||
|
## Description
|
||||||
|
Let people know what your project can do specifically. Provide context and add a link to any reference visitors might be unfamiliar with. A list of Features or a Background subsection can also be added here. If there are alternatives to your project, this is a good place to list differentiating factors.
|
||||||
|
|
||||||
|
## Badges
|
||||||
|
On some READMEs, you may see small images that convey metadata, such as whether or not all the tests are passing for the project. You can use Shields to add some to your README. Many services also have instructions for adding a badge.
|
||||||
|
|
||||||
|
## Visuals
|
||||||
|
Depending on what you are making, it can be a good idea to include screenshots or even a video (you'll frequently see GIFs rather than actual videos). Tools like ttygif can help, but check out Asciinema for a more sophisticated method.
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
Within a particular ecosystem, there may be a common way of installing things, such as using Yarn, NuGet, or Homebrew. However, consider the possibility that whoever is reading your README is a novice and would like more guidance. Listing specific steps helps remove ambiguity and gets people to using your project as quickly as possible. If it only runs in a specific context like a particular programming language version or operating system or has dependencies that have to be installed manually, also add a Requirements subsection.
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
Use examples liberally, and show the expected output if you can. It's helpful to have inline the smallest example of usage that you can demonstrate, while providing links to more sophisticated examples if they are too long to reasonably include in the README.
|
||||||
|
|
||||||
|
## Support
|
||||||
|
Tell people where they can go to for help. It can be any combination of an issue tracker, a chat room, an email address, etc.
|
||||||
|
|
||||||
|
## Roadmap
|
||||||
|
If you have ideas for releases in the future, it is a good idea to list them in the README.
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
State if you are open to contributions and what your requirements are for accepting them.
|
||||||
|
|
||||||
|
For people who want to make changes to your project, it's helpful to have some documentation on how to get started. Perhaps there is a script that they should run or some environment variables that they need to set. Make these steps explicit. These instructions could also be useful to your future self.
|
||||||
|
|
||||||
|
You can also document commands to lint the code or run tests. These steps help to ensure high code quality and reduce the likelihood that the changes inadvertently break something. Having instructions for running tests is especially helpful if it requires external setup, such as starting a Selenium server for testing in a browser.
|
||||||
|
|
||||||
|
## Authors and acknowledgment
|
||||||
|
Show your appreciation to those who have contributed to the project.
|
||||||
|
|
||||||
|
## License
|
||||||
|
For open source projects, say how it is licensed.
|
||||||
|
|
||||||
|
## Project status
|
||||||
|
If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers.
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
talconfig.json
|
||||||
|
clusterconfig
|
||||||
|
patches/all.yaml
|
||||||
|
patches/controlplane.yaml
|
||||||
|
patches/worker.yaml
|
||||||
|
*patches/all.yaml
|
||||||
|
*patches/controlplane.yaml
|
||||||
|
*patches/worker.yaml
|
||||||
|
all.yaml
|
||||||
|
controlplane.yaml
|
||||||
|
worker.yaml
|
||||||
|
*sopssecret.secret.yaml
|
||||||
|
sopssecret.secret.yaml
|
||||||
|
cluster/main/kubernetes/**/bootstrap-values.yaml.ct
|
||||||
|
*kubeconfig
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
#ENC[AES256_GCM,data:ivlK3YpKOUqjcg9WZBhyONqJSMxwYu1G46U6LbJ9jbgD/omtZy5Ucin/6Vh+2r9980rJ4zomOC2BJ2kQ9+sDdN0=,iv:FnA29cUcvbixPFwiJkDnC0+BxXeOYY0kC8gJKkBYfD0=,tag:UGXMkl7lRqaMPlLbp6DWmQ==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:Bppx2CNz0EZragTJPWXZqfhe13ryCa7Er4+TPprZMEOgexWm/8ooXj2WFR8=,iv:Fq5+IxGM/sQkSjWkU6+737MlzFkqRzxV4RvCceQ09i8=,tag:BTFZ5QxaB0Ykhq++IC3D7A==,type:comment]
|
||||||
|
VIP: ENC[AES256_GCM,data:Uv98AXTJXy1On6bWG84=,iv:lx4hIP4qUcf74f3/iFccbVqwyRuwYttS6pCP+rFuX2Q=,tag:/oAq2l1A4JrB5bFpbhsldw==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:7L6tWYFr5k4SIsJramEgXk1gMAKlrF2oT/YD,iv:8bt5i4S1q2v4ji8Fi62ZgMxKrxJp7Tuu/KxglNADdzU=,tag:PRQ/cfqxhCosTYCjKmmJAw==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:NSONj2MFQiwmi5/dTH6uXDLAS2T2GUEigzXgV+HYDWg0XJJy5nMyOnZDpy7a1Mc+FYKSALfSL3uqqVdmhhXQSJSbgmTPHAwBydbdODzwjK8f2VC2up8Ub88=,iv:ZrphGBtpT0T5ovdQfhVGCXL27SZJ3tdzbTWpD3WL7c4=,tag:Br7GAul9iu/hPOkNFub+pw==,type:comment]
|
||||||
|
MASTER1IP: ENC[AES256_GCM,data:E7MiHC/0BIcGg1m0a1g=,iv:rtSW16TRZ2Y0Um6ynpljTQFpNp5mO+PxdR5/xtFt5hs=,tag:f9cdE2zGGNmIlXQw0w6K0A==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:pXAeQ708XL5X038epItt+vKfFfNmzXdZcRARfuNTY4hf0g==,iv:IefEzb6+pgvr3wQuw4JR0QWszALCMV9zM/mksuvfDDw=,tag:bmCyNhzxPEAjyULtxuWagQ==,type:comment]
|
||||||
|
GATEWAY: ENC[AES256_GCM,data:jo99rvL/2mZr1QmW,iv:/klNo9RcxOAIaTdfxOB4ECncqkqRYsTOUwFcUOlKPPA=,tag:/bUW/liFM2526SwQL5OPaA==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:SQ+c5x0ttyXjb2OEKzapI4D7dDHs6o7UX1hE1XL62kRPOJy90QbrYXDg6XmRNCY=,iv:WT47h4mJXOFxH+dUUtJq1SYn9Escu9eWpPKgG9VFKxU=,tag:hmP0Lene9tpzFxAmmFybIw==,type:comment]
|
||||||
|
METALLB_RANGE: ENC[AES256_GCM,data:KOCmXROWGo5FORcJ9yUMFHCYYeBLJgyk6RpICbE=,iv:L+JXilO0WCjwOZm+c1xWzDfljvaW8kEirQ7HYb8vYMs=,tag:TpIdpLTfZapTs2zxYcVpNA==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:MET5IzgvYtaCkYKSeEK2Ury8yBEMEoLioD71cUpkvBA/uxf7yDAYa0bKfn0K7E+kRPTnHkx1XMXl4hcwA7Z1eTXhOVuzYENjBHDVPOkDhe4=,iv:LgE01YlqS0fsLpXjniPOzn79SXElbXbqEAVmaV2XwX8=,tag:YVvpwYxW+pIPWul//EoaZg==,type:comment]
|
||||||
|
DASHBOARD_IP: ENC[AES256_GCM,data:XP5XyqUH69BYbrMvn3c=,iv:lnGNGmTYIAcTkatwoTuj7JlPdZpS4np7g+heMZzjU2Q=,tag:Z2cZphwUpm/nrfZZ42qlTA==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:+AenhvLAoSl1L55niyNp9X9BsAQN2NhSRmyA83uMe5tymNH8B4AZKpjXTDXyARoH3fwIR5EHWW8=,iv:iWAWt1Rsr5/eJ0phPw1z/5yv3mBoLbCED0qilxlKaf0=,tag:WFhPlyXF2o5Mu+4AsSWjeQ==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:uz0Nzd6XawwKY7J8UNxCWh7nZ9hFwhswow==,iv:l3Y8jyHx6YxQgE0OTQDtHX9cSpud2nqci6bxy1qGZr4=,tag:SdARU5q0vYbymnpl04RsTQ==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:b5AFePED60sjR300CX6DQoKLneb9YWDT9Q7qW5woAg6yqWyfZOYY6QbtxCx3T4zYksHRn8vUkcJ0ASZSNQOf9swGFVW0xl+o7i3fclQ=,iv:+tguqQ69hAB+NNNnKfex+RmZNSntxcEhU+dUGmvn4m0=,tag:FD/gG3zgdIdFNXJtH+X5mA==,type:comment]
|
||||||
|
GITHUB_REPOSITORY: ""
|
||||||
|
#ENC[AES256_GCM,data:V75/HDxAPDmk+Z4lOee8nBwjRTmizrOE+s2Xlg16k47GclREPlYZ/622Ccm2TTs+QFgQZtnXF44qjckgaiTWKseIeGyNJmw=,iv:24vvye0kwWfTyL6G4I4bUn433Xvg07c85VSWf2UdpYo=,tag:dP7kjyfvusmLUKeQxSku1Q==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:6Z2muYxNZ3T8khpSCQ9KGwbNG4KmMFp+5MikXwii/anULJ0GAsDHj3bNq08YuA6oTX3rItuq,iv:xXrsqPXoxibPPhFnRwyYdJyUi3JLNbW/n/rkOD2TKQc=,tag:3GwrxTkcfGrg9YfMujmOGA==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:8qIATB8dT/lar5TRnvX/RXjr2OpjaXIOa0vdCxb/MFay9+Y=,iv:darE3gv5X7LlG43gP4ZSrN4MQAi43OUYicZ6kI2SNCE=,tag:9KQzt412IqnqEthF7kvDqg==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:N3E5+UhvkdKOSWxSNlwb1CGMsHRY+PzNQMNuR+AXfk3qaj+N2oid,iv:MUXmT25hGIkqYkUyIilthR0+E+0J4dGmYTZVudDxpQg=,tag:gLZ6LKzhNvR/Z6QvQXbGuw==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:UPZOh94uHTQ6O8ypX78=,iv:NBLUXe3ZzSUJuix+1y/qdflEI/cLx4CNO6uiRfouzyI=,tag:T6NkesW3tZTTNqrN2yCd9g==,type:comment]
|
||||||
|
PODNET: ENC[AES256_GCM,data:6bhhVR+yZ4HV3wf5Zg==,iv:GN13FZVqzOWfIa6FWqSb9ti3cm5dduwpW5XAJjs+hnc=,tag:DJtGCpIscYs40l3kOIgcrw==,type:str]
|
||||||
|
SVCNET: ENC[AES256_GCM,data:+Aw9NaKtqw48ardNKg==,iv:F0I8wPiMkb4TCmMqgmr6mNEJufZoy2p+v08pHTBNS9Y=,tag:5aq1bExpYCyt7uQn0oD40g==,type:str]
|
||||||
|
sops:
|
||||||
|
shamir_threshold: 3
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
|
age:
|
||||||
|
- recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNTXRyWjl5QVE5M2hxNHVS
|
||||||
|
UWRGRkFFNHdZcDNVb1lyWWdkOWE5UW5pL0RvCmFOZlZDV3BERmZkVnBud25YVjJ3
|
||||||
|
bDNySGhScjN6bHp4Mit3UFZPSit4VzAKLS0tIEtrcUNNM3B1aldLMStXSCtZUEhx
|
||||||
|
WWt1c052cjE4RzJIZ1NRbDFzTHpWN1kKRCMjS4EVveIsE9so1pJpZgeM5Ub/8rQj
|
||||||
|
WPz2XvrIpL7h+WY88JAP8JPDk3dIfYu41ZrmjykwLwpIAY4AJCGSRw==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2024-11-05T18:25:50Z"
|
||||||
|
mac: ENC[AES256_GCM,data:FHqoHJ2/jG5AY63yxHM8yx6QcriMHwahF150xHAzPIVcZmYml7mB27b+pH1jMtdWK7t3JLtl3ZPRszrBm1NGqXW4FDwlJdpfgnQjRp434KUoENjWgzH/C6L8voLWqZS8HiJ86PpKaxp5s/V+BhjSv4eNkF7iZVNpGueF64b14LM=,iv:rN362UoGmejMWRm4a5ph40S0eMx6pf0Ocg3EfMJD8+g=,tag:yS9YrRhCTHVI5vW5yzn6Ew==,type:str]
|
||||||
|
pgp: []
|
||||||
|
version: 3.9.1
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: kubernetes-dashboard
|
||||||
|
namespace: kubernetes-dashboard
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: kubernetes-dashboard
|
||||||
|
version: 1.10.0
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values:
|
||||||
|
service:
|
||||||
|
main:
|
||||||
|
type: LoadBalancer
|
||||||
|
loadBalancerIP: ${DASHBOARD_IP}
|
||||||
|
ports:
|
||||||
|
main:
|
||||||
|
port: 80
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: kubernetes-dashboard
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: kubernetes-dashboard
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/apps/kubernetes-dashboard/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- kubernetes-dashboard/ks.yaml
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- kyverno-policies/ks.yaml
|
||||||
|
- metallb-config/ks.yaml
|
||||||
|
- system-upgrade-controller-plans/ks.yaml
|
||||||
@@ -0,0 +1,53 @@
|
|||||||
|
## This Can be enabled in the kustomization.yaml file.
|
||||||
|
## Please note not every chart or application is compatible with this behavior
|
||||||
|
## Primarily operators spinning their own pods, might include conflicting validation
|
||||||
|
## Add manual exclusions where needed
|
||||||
|
apiVersion: kyverno.io/v1
|
||||||
|
kind: ClusterPolicy
|
||||||
|
metadata:
|
||||||
|
name: resolve-image-to-digest
|
||||||
|
annotations:
|
||||||
|
policies.kyverno.io/title: Resolve Image to Digest
|
||||||
|
policies.kyverno.io/category: Other
|
||||||
|
policies.kyverno.io/severity: medium
|
||||||
|
kyverno.io/kyverno-version: 1.6.0
|
||||||
|
policies.kyverno.io/minversion: 1.6.0
|
||||||
|
kyverno.io/kubernetes-version: "1.23"
|
||||||
|
policies.kyverno.io/subject: Pod
|
||||||
|
policies.kyverno.io/description: >-
|
||||||
|
Image tags are mutable and the change of an image can result in the same tag.
|
||||||
|
This policy resolves the image digest of each image in a container and replaces
|
||||||
|
the image with the fully resolved reference which includes the digest rather than tag.
|
||||||
|
spec:
|
||||||
|
background: false
|
||||||
|
rules:
|
||||||
|
- name: resolve-to-digest
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- Pod
|
||||||
|
exclude:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- Pod
|
||||||
|
name: '*cnpg*'
|
||||||
|
preconditions:
|
||||||
|
all:
|
||||||
|
- key: "{{request.operation || 'BACKGROUND'}}"
|
||||||
|
operator: NotEquals
|
||||||
|
value: DELETE
|
||||||
|
mutate:
|
||||||
|
foreach:
|
||||||
|
- list: "request.object.spec.containers"
|
||||||
|
context:
|
||||||
|
- name: resolvedRef
|
||||||
|
imageRegistry:
|
||||||
|
reference: "{{ element.image }}"
|
||||||
|
jmesPath: "resolvedImage"
|
||||||
|
patchStrategicMerge:
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ element.name }}"
|
||||||
|
image: "{{ resolvedRef }}"
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- schematic-to-pod.yaml
|
||||||
|
# - ensure-digest.yaml
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kyverno.io/v2beta1
|
||||||
|
kind: ClusterPolicy
|
||||||
|
metadata:
|
||||||
|
name: mutate-pod-binding
|
||||||
|
annotations:
|
||||||
|
pod-policies.kyverno.io/autogen-controllers: none
|
||||||
|
policies.kyverno.io/title: Mutate Pod Add Schematic
|
||||||
|
policies.kyverno.io/category: Other
|
||||||
|
policies.kyverno.io/subject: Pod
|
||||||
|
kyverno.io/kyverno-version: 1.10.0
|
||||||
|
policies.kyverno.io/minversion: 1.10.0
|
||||||
|
kyverno.io/kubernetes-version: "1.30"
|
||||||
|
spec:
|
||||||
|
background: false
|
||||||
|
rules:
|
||||||
|
- name: project-foo
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- Pod/binding
|
||||||
|
names:
|
||||||
|
- apply-talos*
|
||||||
|
context:
|
||||||
|
- name: node
|
||||||
|
variable:
|
||||||
|
jmesPath: request.object.target.name
|
||||||
|
default: ''
|
||||||
|
- name: schematic
|
||||||
|
apiCall:
|
||||||
|
urlPath: "/api/v1/nodes/{{node}}"
|
||||||
|
jmesPath: "metadata.annotations.\"extensions.talos.dev/schematic\" || 'empty'"
|
||||||
|
mutate:
|
||||||
|
patchStrategicMerge:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
extensions.talos.dev/schematic: "{{ schematic }}"
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: kyverno-policies
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/core/kyverno-policies/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,42 @@
|
|||||||
|
---
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: metallb-config
|
||||||
|
namespace: metallb-config
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: metallb-config
|
||||||
|
version: 8.2.2
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values:
|
||||||
|
L2Advertisements:
|
||||||
|
- name: main
|
||||||
|
addressPools:
|
||||||
|
- main
|
||||||
|
ipAddressPools:
|
||||||
|
- name: main
|
||||||
|
autoAssign: false
|
||||||
|
avoidBuggyIPs: true
|
||||||
|
addresses:
|
||||||
|
- ${METALLB_RANGE}
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: metallb-config
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: metallb-config
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/core/metallb-config/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
|
||||||
|
apiVersion: upgrade.cattle.io/v1
|
||||||
|
kind: Plan
|
||||||
|
metadata:
|
||||||
|
name: kubernetes
|
||||||
|
namespace: system-upgrade
|
||||||
|
spec:
|
||||||
|
version: ${KUBERNETES_VERSION}
|
||||||
|
serviceAccountName: system-upgrade
|
||||||
|
secrets:
|
||||||
|
- name: talos
|
||||||
|
path: /var/run/secrets/talos.dev
|
||||||
|
ignoreUpdates: true
|
||||||
|
concurrency: 1
|
||||||
|
exclusive: true
|
||||||
|
nodeSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: feature.node.kubernetes.io/system-os_release.ID
|
||||||
|
operator: In
|
||||||
|
values: ["talos"]
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
- key: feature.node.kubernetes.io/system-os_release.VERSION_ID
|
||||||
|
operator: In
|
||||||
|
values: ["${TALOS_VERSION}"]
|
||||||
|
- key: kubernetes.io/hostname
|
||||||
|
operator: In
|
||||||
|
values: ["k8s-control-1"]
|
||||||
|
tolerations:
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
prepare: &prepare
|
||||||
|
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
|
||||||
|
envs:
|
||||||
|
- name: NODE_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
args:
|
||||||
|
- --nodes=$(NODE_IP)
|
||||||
|
- health
|
||||||
|
- --server=false
|
||||||
|
upgrade:
|
||||||
|
<<: *prepare
|
||||||
|
args:
|
||||||
|
- --nodes=$(NODE_IP)
|
||||||
|
- upgrade-k8s
|
||||||
|
- --to=$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
# - schematics.yaml
|
||||||
|
- kubernetes.yaml
|
||||||
|
- talos.yaml
|
||||||
@@ -0,0 +1,53 @@
|
|||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/upgrade.cattle.io/plan_v1.json
|
||||||
|
apiVersion: upgrade.cattle.io/v1
|
||||||
|
kind: Plan
|
||||||
|
metadata:
|
||||||
|
name: talos
|
||||||
|
namespace: system-upgrade
|
||||||
|
spec:
|
||||||
|
version: ${TALOS_VERSION}
|
||||||
|
serviceAccountName: system-upgrade
|
||||||
|
secrets:
|
||||||
|
- name: talos
|
||||||
|
path: /var/run/secrets/talos.dev
|
||||||
|
ignoreUpdates: true
|
||||||
|
concurrency: 1
|
||||||
|
exclusive: true
|
||||||
|
nodeSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: feature.node.kubernetes.io/system-os_release.ID
|
||||||
|
operator: In
|
||||||
|
values: ["talos"]
|
||||||
|
- key: feature.node.kubernetes.io/system-os_release.VERSION_ID
|
||||||
|
operator: NotIn
|
||||||
|
values: ["${TALOS_VERSION}"]
|
||||||
|
tolerations:
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
prepare: &prepare
|
||||||
|
image: ghcr.io/siderolabs/talosctl:${TALOS_VERSION}
|
||||||
|
envs:
|
||||||
|
- name: NODE_IP
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: status.hostIP
|
||||||
|
- name: SCHEMATIC
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.annotations['extensions.talos.dev/schematic']
|
||||||
|
args:
|
||||||
|
- --nodes=$(NODE_IP)
|
||||||
|
- health
|
||||||
|
- --server=false
|
||||||
|
upgrade:
|
||||||
|
<<: *prepare
|
||||||
|
args:
|
||||||
|
- --nodes=$(NODE_IP)
|
||||||
|
- upgrade
|
||||||
|
- --image=factory.talos.dev/installer/$(SCHEMATIC):$(SYSTEM_UPGRADE_PLAN_LATEST_VERSION)
|
||||||
|
- --preserve=true
|
||||||
|
- --wait=false
|
||||||
|
- --force
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: system-upgrade-controller-plans
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/core/system-upgrade-controller-plans/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,43 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: flux-entry
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: ./clusters/main/kubernetes
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
decryption:
|
||||||
|
provider: sops
|
||||||
|
secretRef:
|
||||||
|
name: sops-age
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- kind: ConfigMap
|
||||||
|
name: cluster-config
|
||||||
|
patches:
|
||||||
|
- patch: |-
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: not-used
|
||||||
|
spec:
|
||||||
|
decryption:
|
||||||
|
provider: sops
|
||||||
|
secretRef:
|
||||||
|
name: sops-age
|
||||||
|
postBuild:
|
||||||
|
substituteFrom:
|
||||||
|
- kind: ConfigMap
|
||||||
|
name: cluster-config
|
||||||
|
- kind: ConfigMap
|
||||||
|
name: upgrade-settings
|
||||||
|
target:
|
||||||
|
group: kustomize.toolkit.fluxcd.io
|
||||||
|
kind: Kustomization
|
||||||
|
labelSelector: substitution.flux.home.arpa/disabled notin (true)
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- github.com/fluxcd/flux2/manifests/install?ref=v2.3.0
|
||||||
|
- ./deploykey.secret.yaml
|
||||||
|
- ./clustersettings.secret.yaml
|
||||||
|
patches:
|
||||||
|
# Remove the built-in network policies
|
||||||
|
- target:
|
||||||
|
group: networking.k8s.io
|
||||||
|
kind: NetworkPolicy
|
||||||
|
patch: |
|
||||||
|
$patch: delete
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: not-used
|
||||||
|
# Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
|
||||||
|
- target:
|
||||||
|
kind: ResourceQuota
|
||||||
|
name: critical-pods
|
||||||
|
patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /metadata/name
|
||||||
|
value: critical-pods-flux-system
|
||||||
|
- target:
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
name: cluster-reconciler
|
||||||
|
patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /metadata/name
|
||||||
|
value: cluster-reconciler-flux-system
|
||||||
|
- target:
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
name: crd-controller
|
||||||
|
patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /metadata/name
|
||||||
|
value: crd-controller-flux-system
|
||||||
|
- target:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: crd-controller
|
||||||
|
patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /metadata/name
|
||||||
|
value: crd-controller-flux-system
|
||||||
|
- target:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: flux-edit
|
||||||
|
patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /metadata/name
|
||||||
|
value: flux-edit-flux-system
|
||||||
|
- target:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: flux-view
|
||||||
|
patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /metadata/name
|
||||||
|
value: flux-view-flux-system
|
||||||
@@ -0,0 +1,51 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: cluster-config
|
||||||
|
namespace: flux-system
|
||||||
|
data:
|
||||||
|
#ENC[AES256_GCM,data:6niImlDSQviFNVT+wpv5whjt7ZguY+f54tf/PrF0hAfGkSMtDiIhCgr6Et/YAFISMl5T749cMpURqs8tV1zeVgk=,iv:NVFPacP85GuM8UmX6ZFrNRrmtKLVRCCo9EXOszcmJAY=,tag:UBCBIF+HQdRjK8tXWmbKcg==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:akDxDmJ6Cv9hl27tOna6FrweZuGDIAxcmKgaJw3U+3n+Ur7BB99NjTqX1ZM=,iv:l4vLnUDcZOIxO9U1Wyhd8JVZ9vkpvQorgXtayM3v9ME=,tag:VOmz6x1wlU/dggtcYK5xAw==,type:comment]
|
||||||
|
VIP: ENC[AES256_GCM,data:jbuffX6q+hSIdovsBts=,iv:sfi9HYiKKuVKvCkaVpTMD0/v05JwpjIKhTv8cohpvmo=,tag:uyrAdF3No00Ha40FqAyJlg==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:5G6PwTJ6afWfXC2juUtWFxaPnbQv6hty+48D,iv:107g3C7zLAIMPnTl6E6a8876rEj3Ktx7F/LcVemGQCs=,tag:07aa6W3IiPm2nGyXtMJDNg==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:4NKPCDJWoGd6BzrwSqKrwwLRwgSh8YSwS3/g+bwoULUG6MH6XiHV4HQ7RhYyq2mKvgSSu4rrgco12TK489v+K6kNo9f5eqKk9iXjDepM/eHTV9xECBzkoA4=,iv:X6cYcGVyD0F3aH9Y2zFveVI0XZqz10/j8skua+FDjfg=,tag:2hgXM4ep1ypNDKtYRhTRcg==,type:comment]
|
||||||
|
MASTER1IP: ENC[AES256_GCM,data:9TqnldHD1QMT13aKLwI=,iv:SsOmDkDgRdZDUrFxXK9uM01mzdBab7ukv7/oirfqcGI=,tag:vO2BwNjDGqnsPIxDqQig7Q==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:B6V8Ts98f3ODrIpwnkMio0sPy6HYowl091ENhsAiuy6uEQ==,iv:8IwF6gB8N2oCwJ7SVhHPC8qiqdUNkoXZGQBnjZsghrc=,tag:8XfkNXg5lz5GvRRl4V2fxA==,type:comment]
|
||||||
|
GATEWAY: ENC[AES256_GCM,data:dwRSmkaQ7Z8SlMns,iv:sQUNWkRj8DbtYAMkaJ065wor/vCqEUDtHkOi9H7ckbI=,tag:InqxnwFE/2nT71BCSwEoHQ==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:S88nu3SeeGJjADqto4w0g3iUAcnlR8nf14CMuOJXhJQxXDr4JgznAF3fIEc9UPQ=,iv:eaizFGe4ID3Fp/5d+6uIyoWVpdBHOCD6CGL++k+bXdg=,tag:9pJ7F+XtX+zb92B7Af0Eyg==,type:comment]
|
||||||
|
METALLB_RANGE: ENC[AES256_GCM,data:iKzw4CwM//ML26rwXmLM9UR0fnKGj2N3rBEfqos=,iv:aC/kAd4uejXNd0G8o84XW9jN1hKWuuFcarq7F/9xcj8=,tag:lIur2oQjzuhKsZ+xz8Yraw==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:WFPGMGFllHwO3vFsbeMEnyWY/oEwEn2jyLPwvvjKqaNtc9ebtG9cqqV3/zLLP2yYUtnGfmjmAmoQiBgTVOQOb+y6VUty1OQPA0v73xYtNM8=,iv:SJ4Y2RlrPNSMs8WG2VgWEO1kIyYLDs6HQlXsWl5VLqA=,tag:bCXqgHsKQb+MHUXDFngKog==,type:comment]
|
||||||
|
DASHBOARD_IP: ENC[AES256_GCM,data:8xnbx9Ia+va2jlZ+EgI=,iv:mPAhjRH6hYD4kH0HTBNUMqbznytodakRfVKXm5CQR0c=,tag:bpBWLEJpuQL2vvX6Fqdw9A==,type:str]
|
||||||
|
#ENC[AES256_GCM,data:Sk8XfYXVLw9gdg4ttflghvml9PtnR+WsGb4y1Xb9aXa47DBzTkzMbz/o9hSg5y3z528i8wUeCK4=,iv:CPzT3IpTCk1nTD03UuVQycZDyaDyHuN4mvzK7h7MhAM=,tag:fv56PV3Qwja1tVPEdA9q8A==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:7EzBlNF5OGXHSKGGZUyIsBXPznEgmIH/JQ==,iv:WncKNSiaVFBz+n1WwsGsINCo/CSUlc46WnWknPKLwoQ=,tag:P6ffhRSOI8gY0FvcKIJCMw==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:zETwKu0C/izvA/yac7NXzIh/hUBZ9O12uvhpEa/xLWQCw3HR83aFYxOeALK/4yio/YRBmW525laSbawBe7sJ8rYRMhbs+f/0/JorJ4A=,iv:L3yOFifUWMSe0djQbMD+cbjwPtDn/q7KuW7RABmUigY=,tag:QAMYNeUJML0omyrgt6m+IA==,type:comment]
|
||||||
|
GITHUB_REPOSITORY: ""
|
||||||
|
#ENC[AES256_GCM,data:ACa3nQrqwjGZmlK5flUrZGwXxfFBjEYSjh1Epkh6sUp+De6FYrDJdiXcoHFcRBzUPOABiiHp5dPZjSZsLuE8azje74epxNI=,iv:ADMSMkzvqDzUGVv2M3uSlD82MQi9Gi5KLrT1AkxYyvo=,tag:sr4zTcydQGobL7+Muj8WvQ==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:RJFxS5mGXqnxI5G0B/FcL5MxY/3CXv9CvpFZHNmiZBIOeTiX5OUZsE3eNSeD3ja6KShQXUWp,iv:2D9CEtn1zH3+Rdln/qz00as66009PYdEORi5kK4fW+A=,tag:aWqc/IX5kXUS60Zn02scGg==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:KbpFKs+ijAQy0q/OM1kTiAqxVrYqD9AbxkMsSjkWCIV6DLo=,iv:P1W1MU42pfl2NRQ5d5YQjVeed+VjXt2ggpY7V1aP2qk=,tag:haGA0I65BTdV9AgalqS5Kg==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:9nTD4v8T/VEDTHFsWWPf5ZO83SlOWbpkVnkCFt/Y6nyk2UVs/KI0,iv:txxfhJyprXgbVsYXhJfEo1X5qqzlSuMVjSNj1Mbl8WM=,tag:Yeal+o/LfjIjptsCo6IWLQ==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:V+d/Qs89lqeqjEeLeJc=,iv:oWskIshGu/GsOyhLTO58GhmokgFoRlq95RXxFWkY4x8=,tag:Am+I8CsmieIBomnrhEgtnA==,type:comment]
|
||||||
|
PODNET: ENC[AES256_GCM,data:ewO6HIksqTvSSV3Kqg==,iv:ypzdCZaqOG9hTktbjSDGhAjPGlhQx3CFPGC00CpHZ2U=,tag:/VQL28wnkmJyrsCcfNvohA==,type:str]
|
||||||
|
SVCNET: ENC[AES256_GCM,data:CpGlBxFc7KtvKP0w1g==,iv:MFTqQbuoHy2//wQORRecOyBmyOLtheePJpk+MftyNW0=,tag:mSzr04c2Tf6xD8wR0JIIzA==,type:str]
|
||||||
|
CLUSTERNAME: ENC[AES256_GCM,data:Zqa1ew==,iv:gbTl6h/YadrBoAvU8/sp8xQ1eEjbUPjl6QtRoccJja8=,tag:D4/nRuF6RyX4pJBOncZdqA==,type:str]
|
||||||
|
sops:
|
||||||
|
shamir_threshold: 3
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
|
age:
|
||||||
|
- recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlM3owZ3F6WHhQWE96QzZH
|
||||||
|
VVJzQjhUc2dGRTNMNXhGdHBVSU9tb004RDJVCnNUT2pYY3hzSVVEVjg5R29PMnpI
|
||||||
|
ZnNtdjBZSXdML0FIZ2NUWXZQQmhwdUEKLS0tIDM3eXRkSmtXak9tT3g1NU92YzFI
|
||||||
|
bGxJMDA4WWppZm1uL2l5QkRXUDZFbjAKhhOuASw+0mTaN817fRlCaMGCdeAFezm9
|
||||||
|
FKHTVUHi03UXu6kwyZ3sa4x7V1Bw8hGroroL3Sp4BibrAwfYgGQxng==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2024-11-05T18:25:50Z"
|
||||||
|
mac: ENC[AES256_GCM,data:t+YlmYlUx9noaOr4id/+ZRmpkv2JR4I7jzdwm/p7UQLmByr11KgdakTQGhYY0mfqYZgGWzeQNeZVzjFoNFCIkSCJef7WdBeT7yzRRxscYovnlUZ0dBGTTuc1pWsYjDPc3kbHel7AdeDBB2l0qbMxD4At1r1UbvvOi0cdL/OoYFQ=,iv:RB3vdWiQcnywVxUGf+4jpP5t606akBnsf0REENzUF/U=,tag:aQGqxTgqrM7voYxnglqKGg==,type:str]
|
||||||
|
pgp: []
|
||||||
|
encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))
|
||||||
|
version: 3.9.1
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: deploy-key
|
||||||
|
namespace: flux-system
|
||||||
|
stringData:
|
||||||
|
identity: ENC[AES256_GCM,data:a+OyM/CAfSbL82Ii8FFc0pnmOS339fjx0MY6TcS5hxnq/o6T/ZRT5wyuEdAizQh1fg57iQfK5M3JB5V64I7Vf2/eUd6gQFMMG9DBS6xpbIdlrAq5fg51zlrQ0GdcdwtBE0TMQx9RARvgFRCM0Ibl5To9ztM5Dg5DSdYwO967VY8HhNa7RYt4ta6A/fD5xgSytVS2iChNk7bPGv40QS4tjam1gjInh4eA8K0YsBdz2L2IVotmDp3rfDbkSlgafAowcnwm5yHY8zMJMEAKGGdPz7ZTAUB/npM1AqZ5Xea4pO1WsgvmhX7j5zGmbLm3POyDEfKU12GI3RetKqPr1HKA/dXe+y5yJAf9Ryt16hFM+yff8OerYNPYOzSu7XH5omir,iv:VW6/5kReBh0BZBRXqaOVGhsAPQX9Z2b80J/eUHi2dvk=,tag:DSBJ6JP4cEg5LjqGjc6GpQ==,type:str]
|
||||||
|
identity.pub: ENC[AES256_GCM,data:1lsFtoFsl94Bn51rG6ltUq2xKcSJ16C8g8DK+nwZ7/k5sfUxtEEuDve1EuxuUcPt7jt2OqF1rWiQ0FR1mNhj9PeBmyewlON5MinuMaZ0yTLsCdZC25cYJ+Dz6nB66ihPbq2cCi3VdURQLhPOgdFELXmJ1sdaYLllk5II5otXKVSyJe2N/QJ6oQzlPHwIzr63GrB/YGpFtMEOwzH2MmK0tn8boG9PJ/HpLFKU/Z3NGrbjU1wo+UiiLYRE5YdRMwiT5x29ot/iMd6adyop4A==,iv:zuCnmxG+eLeofXkI42mYS4QlUxKFPVvpQjKHJklr6z0=,tag:scJIB2ZK9i5fhGFvMgqfcA==,type:str]
|
||||||
|
known_hosts: ENC[AES256_GCM,data:RM4p4j4LMRjezS3V/GzU45LA7pH2+E5wv575f2SUSmyNb03zrq6Ll+6c1ez2h/6ik6NxgU7goLBKy1F/szdRVu/Cc3P7E2/u8qRgld6lGU+yNjifbc9yu5YQk9SXEduyALVMgk/A0o/1nFfJloTaVOCgOQ8/leucwAsqRoBGmaqms2Hs8fhlpNuKHzgQE7H26422y6OhkkFZzNSsN5hFdwDjiOXIz8U+FIHu,iv:FVEqEqPUk8dRrEReV8aaAhBJRNew+TYbH9uorleTkeU=,tag:R5iJuxOCOYXYG7J3gj6Ecg==,type:str]
|
||||||
|
type: Opaque
|
||||||
|
sops:
|
||||||
|
shamir_threshold: 3
|
||||||
|
kms: []
|
||||||
|
gcp_kms: []
|
||||||
|
azure_kv: []
|
||||||
|
hc_vault: []
|
||||||
|
age:
|
||||||
|
- recipient: age1482xg0tg4yng6fnzew483rh70vlzh70p7403sv4tmns80jfd25wqsq3ag6
|
||||||
|
enc: |
|
||||||
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDc0M3bWpvOTI3WDY3UURT
|
||||||
|
amd1dnNGd2dyQjRSYXhIVUZhajdyNWNpYkNFCjNDU3dOTTJXNWtJVkEwOXh3bVg3
|
||||||
|
WVR0Z3VRdzlpamlGcTliRURmR0x4RmsKLS0tIHpmUk1MTjB0dXBOOGtsSE5zdFRq
|
||||||
|
QTRiNzhFQ0Q1MjNyMENNMzd4T29mdXcKUTurohm+cx2NJDwhAd03bfI8JGFdVNbx
|
||||||
|
eIamNTnvt/xEI8665fd2piuxe9BTljp8Jgxul+k/n4ZT1V4wnX2tJg==
|
||||||
|
-----END AGE ENCRYPTED FILE-----
|
||||||
|
lastmodified: "2024-11-05T18:25:50Z"
|
||||||
|
mac: ENC[AES256_GCM,data:TiLcKT3Khdne8sep2FqTYgm9zVMzQupJneUmzjPqz3M3W0/itiOQtlQvn/DzAZ1nIm36wzBZL80mZ+2Yj5SPAeJ3QE1NJH7FBJ3fUszKQNgzqWO95W2E0OYR+2BjOtkq7hUoq2jBY2ZeqSHYR+WX04b5X6+H1Vwt8cfHIwYONlU=,iv:wqQa+2gW3wpIN4PpVq0+ATwC9ExGYSeqDTD1AyBC+fA=,tag:UoaGeYkUkQGpaoR/A5RWPw==,type:str]
|
||||||
|
pgp: []
|
||||||
|
encrypted_regex: ((?i)(displayname|email|pass|ca|id|bootstraptoken|secretboxencryptionsecret|secrets|secrets|password|cert|secret($|[^N])|key|token|^data$|^stringData))
|
||||||
|
version: 3.9.1
|
||||||
@@ -0,0 +1,87 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: flux
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: ./
|
||||||
|
prune: true
|
||||||
|
wait: true
|
||||||
|
sourceRef:
|
||||||
|
kind: OCIRepository
|
||||||
|
name: flux-manifests
|
||||||
|
patches:
|
||||||
|
# Remove the network policies that does not work with k3s
|
||||||
|
- patch: |
|
||||||
|
$patch: delete
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: not-used
|
||||||
|
target:
|
||||||
|
group: networking.k8s.io
|
||||||
|
kind: NetworkPolicy
|
||||||
|
# Increase the number of reconciliations that can be performed in parallel and bump the resources limits
|
||||||
|
# Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#increase-the-number-of-workers
|
||||||
|
- patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --concurrent=12
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --kube-api-qps=500
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --kube-api-burst=1000
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --requeue-dependency=5s
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: (kustomize-controller|helm-controller|source-controller)
|
||||||
|
- patch: |
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: not-used
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: manager
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
memory: 2Gi
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: (kustomize-controller|helm-controller|source-controller)
|
||||||
|
# Enable in-memory-kustomize builds
|
||||||
|
# Ref: https://fluxcd.io/flux/installation/configuration/vertical-scaling/#enable-in-memory-kustomize-builds
|
||||||
|
- patch: |
|
||||||
|
- op: replace
|
||||||
|
path: /spec/template/spec/volumes/0
|
||||||
|
value:
|
||||||
|
name: temp
|
||||||
|
emptyDir:
|
||||||
|
medium: Memory
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: kustomize-controller
|
||||||
|
# Enable Helm near OOM detection
|
||||||
|
# Ref: https://fluxcd.io/flux/cheatsheets/bootstrap/#enable-helm-near-oom-detection
|
||||||
|
- patch: |
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --feature-gates=OOMWatch=true
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --oom-watch-memory-threshold=95
|
||||||
|
- op: add
|
||||||
|
path: /spec/template/spec/containers/0/args/-
|
||||||
|
value: --oom-watch-interval=500ms
|
||||||
|
target:
|
||||||
|
kind: Deployment
|
||||||
|
name: helm-controller
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- ./deploykey.secret.yaml
|
||||||
|
- ./clustersettings.secret.yaml
|
||||||
|
- ./flux.yaml
|
||||||
|
- ./upgradesettings.yaml
|
||||||
|
- ./namespace.yaml
|
||||||
|
# - sopssecret.secret.yaml
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: flux-system
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: upgrade-settings
|
||||||
|
namespace: flux-system
|
||||||
|
data:
|
||||||
|
# renovate: datasource=docker depName=ghcr.io/siderolabs/installer
|
||||||
|
TALOS_VERSION: v1.8.2
|
||||||
|
# renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
|
||||||
|
KUBERNETES_VERSION: v1.31.2
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- flux
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
## DO NOT ALTER THIS FILE, CHANGE DO NOT PERSIST. Alter clusterenv.yaml instead.
|
||||||
|
hubble:
|
||||||
|
enabled: false
|
||||||
@@ -0,0 +1,80 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: cilium
|
||||||
|
namespace: kube-system
|
||||||
|
annotations:
|
||||||
|
meta.helm.sh/release-name: cilium
|
||||||
|
meta.helm.sh/release-namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: cilium
|
||||||
|
version: 1.16.3
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: cilium
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
remediateLastFailure: true
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values:
|
||||||
|
# autoDirectNodeRoutes: true
|
||||||
|
# routingMode: native
|
||||||
|
hubble:
|
||||||
|
enabled: false
|
||||||
|
cluster:
|
||||||
|
name: ${CLUSTERNAME}
|
||||||
|
id: 1
|
||||||
|
ipv4NativeRoutingCIDR: ${PODNET}
|
||||||
|
securityContext:
|
||||||
|
privileged: true
|
||||||
|
capabilities:
|
||||||
|
ciliumAgent:
|
||||||
|
- CHOWN
|
||||||
|
- KILL
|
||||||
|
- NET_ADMIN
|
||||||
|
- NET_RAW
|
||||||
|
- IPC_LOCK
|
||||||
|
- SYS_ADMIN
|
||||||
|
- SYS_RESOURCE
|
||||||
|
- DAC_OVERRIDE
|
||||||
|
- FOWNER
|
||||||
|
- SETGID
|
||||||
|
- SETUID
|
||||||
|
cleanCiliumState:
|
||||||
|
- NET_ADMIN
|
||||||
|
- SYS_ADMIN
|
||||||
|
- SYS_RESOURCE
|
||||||
|
cgroup:
|
||||||
|
automount:
|
||||||
|
enabled: false
|
||||||
|
hostRoot: /sys/fs/cgroup
|
||||||
|
enableRuntimeDeviceDetection: true
|
||||||
|
endpointRoutes:
|
||||||
|
enabled: true
|
||||||
|
ipam:
|
||||||
|
mode: kubernetes
|
||||||
|
k8sServiceHost: 127.0.0.1
|
||||||
|
k8sServicePort: 7445
|
||||||
|
kubeProxyReplacement: true
|
||||||
|
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
||||||
|
localRedirectPolicy: true
|
||||||
|
operator:
|
||||||
|
rollOutPods: true
|
||||||
|
rollOutCiliumPods: true
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cilium
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/kube-system/cilium/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,68 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: descheduler
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: descheduler
|
||||||
|
version: 0.1.0
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values:
|
||||||
|
|
||||||
|
kind: Deployment
|
||||||
|
deschedulerPolicy:
|
||||||
|
strategies:
|
||||||
|
RemoveDuplicates:
|
||||||
|
enabled: true
|
||||||
|
RemovePodsViolatingNodeTaints:
|
||||||
|
enabled: true
|
||||||
|
RemovePodsViolatingNodeAffinity:
|
||||||
|
enabled: true
|
||||||
|
params:
|
||||||
|
nodeAffinityType:
|
||||||
|
- requiredDuringSchedulingIgnoredDuringExecution
|
||||||
|
RemovePodsViolatingTopologySpreadConstraint:
|
||||||
|
enabled: true
|
||||||
|
params:
|
||||||
|
includeSoftConstraints: true
|
||||||
|
RemovePodsViolatingInterPodAntiAffinity:
|
||||||
|
enabled: true
|
||||||
|
params:
|
||||||
|
nodeFit: true
|
||||||
|
LowNodeUtilization:
|
||||||
|
enabled: false
|
||||||
|
RemoveFailedPods:
|
||||||
|
enabled: true
|
||||||
|
params:
|
||||||
|
failedPods:
|
||||||
|
includingInitContainers: true
|
||||||
|
excludeOwnerKinds:
|
||||||
|
- Job
|
||||||
|
minPodLifetimeSeconds: 3600
|
||||||
|
RemovePodsHavingTooManyRestarts:
|
||||||
|
enabled: true
|
||||||
|
params:
|
||||||
|
podsHavingTooManyRestarts:
|
||||||
|
podRestartThreshold: 100
|
||||||
|
includingInitContainers: true
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: descheduler
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/kube-system/descheduler/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
metrics:
|
||||||
|
main:
|
||||||
|
enabled: false
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: kubelet-csr-approver
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
interval: 30m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: kubelet-csr-approver
|
||||||
|
version: 1.1.2
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 30m
|
||||||
|
values: {}
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: kubelet-csr-approver
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/kube-system/kubelet-csr-approver/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- cilium/ks.yaml
|
||||||
|
- descheduler/ks.yaml
|
||||||
|
- kubelet-csr-approver/ks.yaml
|
||||||
|
- metrics-server/ks.yaml
|
||||||
|
- node-feature-discovery/ks.yaml
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: metrics-server
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: metrics-server
|
||||||
|
version: 0.1.0
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values:
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: metrics-server
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/kube-system/metrics-server/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: kube-system
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: node-feature-discovery
|
||||||
|
namespace: kube-system
|
||||||
|
spec:
|
||||||
|
interval: 30m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: node-feature-discovery
|
||||||
|
version: 0.1.0
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
install:
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
strategy: rollback
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
|
worker:
|
||||||
|
config:
|
||||||
|
core:
|
||||||
|
sources: ["pci", "system", "usb"]
|
||||||
|
prometheus:
|
||||||
|
enable: true
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: node-feature-discovery
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/kube-system/node-feature-discovery/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- apps
|
||||||
|
- core
|
||||||
|
- flux-entry.yaml
|
||||||
|
- flux-system
|
||||||
|
- kube-system
|
||||||
|
- system
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
namespace: cert-manager
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
|
||||||
|
chart: cert-manager
|
||||||
|
version: 6.2.2
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 5m
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/cert-manager/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: cloudnative-pg
|
||||||
|
namespace: cloudnative-pg
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
|
||||||
|
chart: cloudnative-pg
|
||||||
|
version: 8.2.0
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 5m
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cloudnative-pg
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/cloudnative-pg/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: kubernetes-reflector
|
||||||
|
namespace: snapshot-controller
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: kubernetes-reflector
|
||||||
|
version: 6.2.1
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: kubernetes-reflector
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/kubernetes-reflector/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,16 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- cert-manager/ks.yaml
|
||||||
|
- cloudnative-pg/ks.yaml
|
||||||
|
- kubernetes-reflector/ks.yaml
|
||||||
|
- kyverno/ks.yaml
|
||||||
|
- longhorn/ks.yaml
|
||||||
|
- metallb/ks.yaml
|
||||||
|
- openebs/ks.yaml
|
||||||
|
- prometheus-operator/ks.yaml
|
||||||
|
- snapshot-controller/ks.yaml
|
||||||
|
- spegel/ks.yaml
|
||||||
|
- system-upgrade-controller/ks.yaml
|
||||||
|
- traefik-crds/ks.yaml
|
||||||
|
- volsync/ks.yaml
|
||||||
@@ -0,0 +1,198 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: kyverno
|
||||||
|
namespace: kyverno
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: kyverno
|
||||||
|
version: 3.3.2
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: kyverno
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values:
|
||||||
|
|
||||||
|
crds:
|
||||||
|
install: true
|
||||||
|
grafana:
|
||||||
|
enabled: true
|
||||||
|
annotations:
|
||||||
|
grafana_folder: System
|
||||||
|
backgroundController:
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
rbac:
|
||||||
|
clusterRole:
|
||||||
|
extraResources:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
- pods
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
cleanupController:
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
reportsController:
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
admissionController:
|
||||||
|
replicas: 3
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: true
|
||||||
|
rbac:
|
||||||
|
clusterRole:
|
||||||
|
extraResources:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
- pods
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
topologySpreadConstraints:
|
||||||
|
- maxSkew: 1
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
whenUnsatisfiable: DoNotSchedule
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: kyverno
|
||||||
|
app.kubernetes.io/component: kyverno
|
||||||
|
|
||||||
|
config:
|
||||||
|
# -- Resource types to be skipped by the Kyverno policy engine.
|
||||||
|
# Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list.
|
||||||
|
# These are joined together without spaces, run through `tpl`, and the result is set in the config map.
|
||||||
|
# @default -- See [values.yaml](values.yaml)
|
||||||
|
resourceFilters:
|
||||||
|
- '[Event,*,*]'
|
||||||
|
- '[*/*,kube-system,*]'
|
||||||
|
- '[*/*,kube-public,*]'
|
||||||
|
- '[*/*,kube-node-lease,*]'
|
||||||
|
- '[Node,*,*]'
|
||||||
|
- '[Node/*,*,*]'
|
||||||
|
- '[APIService,*,*]'
|
||||||
|
- '[APIService/*,*,*]'
|
||||||
|
- '[TokenReview,*,*]'
|
||||||
|
- '[SubjectAccessReview,*,*]'
|
||||||
|
- '[SelfSubjectAccessReview,*,*]'
|
||||||
|
- '[ReplicaSet,*,*]'
|
||||||
|
- '[ReplicaSet/*,*,*]'
|
||||||
|
# exclude resources from the chart
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
|
||||||
|
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
|
||||||
|
- '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
||||||
|
- '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
|
||||||
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
|
||||||
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
|
||||||
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
|
||||||
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
|
||||||
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
||||||
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
|
||||||
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
|
||||||
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
|
||||||
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
||||||
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
|
||||||
|
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
|
||||||
|
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
|
||||||
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
|
||||||
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
|
||||||
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
|
||||||
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
|
||||||
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
|
||||||
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
|
||||||
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
|
||||||
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
|
||||||
|
- '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
|
||||||
|
- '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
|
||||||
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
|
||||||
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
|
||||||
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
|
||||||
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
|
||||||
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
|
||||||
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
|
||||||
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
|
||||||
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
|
||||||
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
|
||||||
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
|
||||||
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
|
||||||
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
|
||||||
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
||||||
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
|
||||||
|
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
|
||||||
|
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
---
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
|
- namespace.yaml
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: kyverno
|
||||||
|
labels:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
|
goldilocks.fairwinds.com/enabled: "true"
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: kyverno
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/kyverno/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: longhorn
|
||||||
|
namespace: longhorn-system
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
releaseName: longhorn
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
|
||||||
|
chart: longhorn
|
||||||
|
version: 1.7.2
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: longhorn
|
||||||
|
namespace: flux-system
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
|
defaultSettings:
|
||||||
|
# Increase to 3 for a multi-node cluster
|
||||||
|
defaultReplicaCount: 1
|
||||||
|
# Overprovisioning might be needed when using volsync
|
||||||
|
storageOverProvisioningPercentage: 100000
|
||||||
|
# v2DataEngine: true
|
||||||
|
persistence:
|
||||||
|
# Set to false to pick another CSI as default
|
||||||
|
defaultClass: true
|
||||||
|
# Increase to 3 for a multi-node cluster
|
||||||
|
defaultClassReplicaCount: 1
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
|
- volumeSnapshotClass.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: longhorn-system
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
---
|
||||||
|
kind: VolumeSnapshotClass
|
||||||
|
apiVersion: snapshot.storage.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: longhorn-snapshot-vsc
|
||||||
|
annotations:
|
||||||
|
snapshot.storage.kubernetes.io/is-default-class: 'true'
|
||||||
|
driver: driver.longhorn.io
|
||||||
|
deletionPolicy: Delete
|
||||||
|
parameters:
|
||||||
|
type: snap
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: longhorn
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/longhorn/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: metallb
|
||||||
|
namespace: metallb
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: metallb
|
||||||
|
version: 0.14.8
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: metallb
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 5m
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
|
speaker:
|
||||||
|
ignoreExcludeLB: true
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: metallb
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: metallb
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/metallb/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: openebs
|
||||||
|
namespace: openebs
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
releaseName: openebs
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
|
||||||
|
chart: openebs
|
||||||
|
version: 4.1.1
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: openebs
|
||||||
|
namespace: flux-system
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
|
openebs-crds:
|
||||||
|
csi:
|
||||||
|
volumeSnapshots:
|
||||||
|
enabled: false
|
||||||
|
keep: false
|
||||||
|
|
||||||
|
engines:
|
||||||
|
local:
|
||||||
|
# The lvm-localpv backend contains a duplicate of snapshot controller which will cause conflicts
|
||||||
|
lvm:
|
||||||
|
enabled: false
|
||||||
|
# The ZFS backend contains a duplicate of snapshot controller which will cause conflicts
|
||||||
|
zfs:
|
||||||
|
enabled: false
|
||||||
|
replicated:
|
||||||
|
# The Mayastor backend contains a duplicate of snapshot controller which will cause conflicts
|
||||||
|
mayastor:
|
||||||
|
enabled: false
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: openebs
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: openebs
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/openebs/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: prometheus-operator
|
||||||
|
namespace: prometheus-operator
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
|
||||||
|
chart: prometheus-operator
|
||||||
|
version: 8.8.2
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 5m
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
values: {}
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: prometheus-operator
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/prometheus-operator/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: snapshot-controller
|
||||||
|
namespace: snapshot-controller
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: snapshot-controller
|
||||||
|
version: 3.3.1
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 5m
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
crds: CreateReplace
|
||||||
|
remediation:
|
||||||
|
strategy: rollback
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: snapshot-controller
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/snapshot-controller/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: spegel
|
||||||
|
namespace: spegel
|
||||||
|
spec:
|
||||||
|
interval: 30m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: spegel
|
||||||
|
version: 2.0.7
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
install:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
strategy: rollback
|
||||||
|
retries: 3
|
||||||
|
values: {}
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: spegel
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: spegel
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/spegel/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,102 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: system-upgrade-controller
|
||||||
|
namespace: system-upgrade
|
||||||
|
spec:
|
||||||
|
interval: 30m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: app-template
|
||||||
|
version: 3.5.1
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: bjw-s
|
||||||
|
namespace: flux-system
|
||||||
|
install:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
strategy: rollback
|
||||||
|
retries: 3
|
||||||
|
values:
|
||||||
|
controllers:
|
||||||
|
system-upgrade-controller:
|
||||||
|
strategy: RollingUpdate
|
||||||
|
containers:
|
||||||
|
app:
|
||||||
|
image:
|
||||||
|
repository: docker.io/rancher/system-upgrade-controller
|
||||||
|
tag: v0.14.1@sha256:7e13a9b2b984f0c0fd6328439b575348723cc6954b91db3453057fcb784e2d29
|
||||||
|
env:
|
||||||
|
SYSTEM_UPGRADE_CONTROLLER_DEBUG: false
|
||||||
|
SYSTEM_UPGRADE_CONTROLLER_THREADS: 2
|
||||||
|
SYSTEM_UPGRADE_JOB_ACTIVE_DEADLINE_SECONDS: 900
|
||||||
|
SYSTEM_UPGRADE_JOB_BACKOFF_LIMIT: 99
|
||||||
|
SYSTEM_UPGRADE_JOB_IMAGE_PULL_POLICY: IfNotPresent
|
||||||
|
SYSTEM_UPGRADE_JOB_KUBECTL_IMAGE: registry.k8s.io/kubectl:v1.31.1
|
||||||
|
SYSTEM_UPGRADE_JOB_POD_REPLACEMENT_POLICY: Failed
|
||||||
|
SYSTEM_UPGRADE_JOB_PRIVILEGED: true
|
||||||
|
SYSTEM_UPGRADE_JOB_TTL_SECONDS_AFTER_FINISH: 900
|
||||||
|
SYSTEM_UPGRADE_PLAN_POLLING_INTERVAL: 15m
|
||||||
|
SYSTEM_UPGRADE_CONTROLLER_NAME: system-update-controller
|
||||||
|
SYSTEM_UPGRADE_CONTROLLER_NAMESPACE:
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
capabilities: { drop: ["ALL"] }
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
defaultPodOptions:
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65534
|
||||||
|
runAsGroup: 65534
|
||||||
|
seccompProfile: { type: RuntimeDefault }
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
tolerations:
|
||||||
|
- key: CriticalAddonsOnly
|
||||||
|
operator: Exists
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
- key: node-role.kubernetes.io/master
|
||||||
|
operator: Exists
|
||||||
|
effect: NoSchedule
|
||||||
|
serviceAccount:
|
||||||
|
create: true
|
||||||
|
name: system-upgrade
|
||||||
|
persistence:
|
||||||
|
tmp:
|
||||||
|
type: emptyDir
|
||||||
|
etc-ssl:
|
||||||
|
type: hostPath
|
||||||
|
hostPath: /etc/ssl
|
||||||
|
hostPathType: DirectoryOrCreate
|
||||||
|
globalMounts:
|
||||||
|
- readOnly: true
|
||||||
|
etc-pki:
|
||||||
|
type: hostPath
|
||||||
|
hostPath: /etc/pki
|
||||||
|
hostPathType: DirectoryOrCreate
|
||||||
|
globalMounts:
|
||||||
|
- readOnly: true
|
||||||
|
etc-ca-certificates:
|
||||||
|
type: hostPath
|
||||||
|
hostPath: /etc/ca-certificates
|
||||||
|
hostPathType: DirectoryOrCreate
|
||||||
|
globalMounts:
|
||||||
|
- readOnly: true
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
|
- rbac.yaml
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: system-upgrade
|
||||||
|
annotations:
|
||||||
|
volsync.backube/privileged-movers: "true"
|
||||||
|
labels:
|
||||||
|
kustomize.toolkit.fluxcd.io/prune: disabled
|
||||||
|
goldilocks.fairwinds.com/enabled: "true"
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: system-upgrade
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cluster-admin
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: system-upgrade
|
||||||
|
namespace: system-upgrade
|
||||||
|
---
|
||||||
|
apiVersion: talos.dev/v1alpha1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: talos
|
||||||
|
namespace: system-upgrade
|
||||||
|
spec:
|
||||||
|
roles:
|
||||||
|
- os:admin
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: system-upgrade-controller
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/system-upgrade-controller/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
# yaml-language-server: $schema=https://kubernetes-schemas.zinn.ca/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: traefik-crds
|
||||||
|
namespace: system
|
||||||
|
spec:
|
||||||
|
interval: 15m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: traefik-crds
|
||||||
|
version: 3.2.3
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 15m
|
||||||
|
timeout: 20m
|
||||||
|
maxHistory: 3
|
||||||
|
driftDetection:
|
||||||
|
mode: warn
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
uninstall:
|
||||||
|
keepHistory: false
|
||||||
|
values: {}
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: traefik-crds
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/traefik-crds/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: volsync
|
||||||
|
namespace: volsync
|
||||||
|
spec:
|
||||||
|
interval: 5m
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
|
||||||
|
chart: volsync
|
||||||
|
version: 2.4.1
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: truecharts
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 5m
|
||||||
|
install:
|
||||||
|
createNamespace: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
resources:
|
||||||
|
- namespace.yaml
|
||||||
|
- helm-release.yaml
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: volsync
|
||||||
|
labels:
|
||||||
|
pod-security.kubernetes.io/enforce: privileged
|
||||||
|
topolvm.io/webhook: ignore
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: volsync
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: clusters/main/kubernetes/system/volsync/app
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: cluster
|
||||||
|
|
||||||
@@ -0,0 +1,2 @@
|
|||||||
|
main-k8s-control-1.yaml
|
||||||
|
talosconfig
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user